@sema-agent/server 7.100.0 → 7.101.0

package/dist/plugins/tidb-session-store.js

@@ -3,6 +3,7 @@ import { TiDBSessionStorage } from "./tidb-session-storage.js";
 import { decodeSessionEventPayload } from "./session-event-payload.js";
 import { jsonColumnText } from "./sql-json-column.js";
 import { escapeLike } from "./sql-escape.js";
+import { BASELINE_IO_DEADLINE_MS, decodeInstructionSource, encodeInstructionSource } from "../instruction-source-notice.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
 import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
 import { assertPlacementAdmission, LIST_PLACED_BATCH, PLACEMENT_SELECT_COLUMNS, placedRowFromRow, placementFromRow, placementInsertValues, SQL_SESSION_PLACEMENTS, } from "./session-placement.js";
@@ -183,6 +184,19 @@ export class TiDBSessionStore {
         const [r] = await this.pool.query("UPDATE session_meta SET title = ? WHERE session_id = ? AND title IS NULL", [title, sessionId]);
         return r.affectedRows > 0;
     }
+    async readInstructionSource(sessionId) {
+        const [rows] = await this.pool.query({ sql: "SELECT instruction_source FROM session_meta WHERE session_id = ?", timeout: BASELINE_IO_DEADLINE_MS }, [sessionId]);
+        return decodeInstructionSource(rows[0]?.instruction_source);
+    }
+    async recordInstructionSource(sessionId, expected, source) {
+        const next = encodeInstructionSource(source);
+        if (expected.recorded) {
+            await this.pool.query({ sql: "UPDATE session_meta SET instruction_source = ? WHERE session_id = ? AND instruction_source = ?", timeout: BASELINE_IO_DEADLINE_MS }, [next, sessionId, encodeInstructionSource(expected.source)]);
+        }
+        else {
+            await this.pool.query({ sql: "UPDATE session_meta SET instruction_source = ? WHERE session_id = ? AND instruction_source IS NULL", timeout: BASELINE_IO_DEADLINE_MS }, [next, sessionId]);
+        }
+    }
     async fork(sourceId, owner) {
         const [metaRows] = await this.pool.query("SELECT leaf_id FROM session_meta WHERE session_id = ?", [sourceId]);
         if (!metaRows[0])

package/dist/plugins/web-search.d.ts

@@ -139,7 +139,8 @@ export interface WebSearchBackend {
 export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) => void) | undefined): void;
 /**
  * Build the `WebSearchConfig` (a `search` fn + `maxResults`) for `assembleFullBodyTools({ webSearch })`. The API key
- * stays captured in this closure — it is never surfaced to the model or the tool args.
+ * stays captured in this closure — it is never surfaced to the model or the tool args. Every error a leg throws leaves
+ * through {@link redactedBackendFailure} (S-716 ③).
  */
 export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): WebSearchBackend;
 /**

package/dist/plugins/web-search.js

@@ -1,5 +1,5 @@
 import { createSearxngSearchBackend } from "@sema-agent/core";
-import { isHierarchicalUrl } from "../trace/redact.js";
+import { isHierarchicalUrl, redactSecrets } from "../trace/redact.js";
 export const WEB_SEARCH_PROVIDERS = ["brave", "tavily", "searxng"];
 function isWebSearchProvider(word) {
     return WEB_SEARCH_PROVIDERS.includes(word);
@@ -80,7 +80,7 @@ async function tavilySearch(fetchImpl, cfg, query, max, signal, opts) {
         body.include_domains = opts.allowedDomains.slice(0, 300);
     if (opts?.blockedDomains?.length)
         body.exclude_domains = opts.blockedDomains.slice(0, 150);
-    const res = await fetchImpl(cfg.endpoint || TAVILY_BASE, {
+    const res = await fetchImpl(new URL(cfg.endpoint || TAVILY_BASE), {
         method: "POST",
         headers: { "Content-Type": "application/json", Authorization: `Bearer ${cfg.apiKey}` },
         body: JSON.stringify(body),
@@ -116,6 +116,11 @@ async function searxngSearch(fetchImpl, cfg, query, max, signal, timeoutMs, opts
     }
     return normalize(rows, (r) => ({ title: r.title, url: r.url, snippet: r.snippet }), max, "searxng");
 }
+function redactedBackendFailure(e) {
+    const text = e instanceof Error ? e.message : String(e);
+    const safe = redactSecrets(text);
+    return safe === text ? e : new Error(safe);
+}
 export function createWebSearchBackend(cfg) {
     const fetchImpl = cfg.fetchImpl ?? fetch;
     const maxResults = Math.max(1, Math.min(20, cfg.maxResults ?? DEFAULT_MAX_RESULTS));
@@ -132,6 +137,9 @@ export function createWebSearchBackend(cfg) {
                 case "searxng": return await searxngSearch(fetchImpl, cfg, q, maxResults, sig, timeoutMs, opts);
             }
         }
+        catch (e) {
+            throw redactedBackendFailure(e);
+        }
         finally {
             done();
         }
@@ -153,6 +161,7 @@ function judgeText(raw) {
     return isBlank(raw) ? ABSENT : { ok: true, value: raw };
 }
 const ENDPOINT_FORM = "must be an absolute URL with a scheme and a host, such as https://search.example.com (a bare host or host:port is not one)";
+const ENDPOINT_USERINFO = "must not carry userinfo (user or user:password before the host)";
 function judgeEndpoint(raw) {
     if (raw === undefined || raw === null)
         return ABSENT;
@@ -160,7 +169,10 @@ function judgeEndpoint(raw) {
         return { ok: false, issue: ENDPOINT_FORM };
     if (isBlank(raw))
         return ABSENT;
-    return isHierarchicalUrl(raw) ? { ok: true, value: raw } : { ok: false, issue: ENDPOINT_FORM };
+    if (!isHierarchicalUrl(raw))
+        return { ok: false, issue: ENDPOINT_FORM };
+    const url = new URL(raw);
+    return url.username !== "" || url.password !== "" ? { ok: false, issue: ENDPOINT_USERINFO } : { ok: true, value: raw };
 }
 const COUNT_FORM = "must be a number ≥ 1";
 function judgeCount(raw) {
@@ -173,10 +185,11 @@ function envNumber(raw) {
 }
 const SEARXNG_PARAM_NAME = /^[A-Za-z0-9_.-]+$/;
 const SEARXNG_PARAMS_FORM = 'must be an object of parameter name → non-empty string, or a "name=value;name=value" string';
+const paramIssue = (entry, problem) => ({ ok: false, issue: `${SEARXNG_PARAMS_FORM} — entry #${entry} ${problem}` });
 function judgeSearxngParams(raw) {
     if (raw === undefined || raw === null)
         return ABSENT;
-    const pairs = [];
+    const params = [];
     if (typeof raw === "string") {
         const segments = raw.split(";");
         for (const [i, seg] of segments.entries()) {
@@ -184,32 +197,33 @@ function judgeSearxngParams(raw) {
                 continue;
             const eq = seg.indexOf("=");
             if (eq < 0)
-                return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — segment ${i + 1} has no "="` };
-            pairs.push([seg.slice(0, eq).trim(), seg.slice(eq + 1).trim()]);
+                return paramIssue(i + 1, 'has no "="');
+            params.push({ entry: i + 1, name: seg.slice(0, eq).trim(), value: seg.slice(eq + 1).trim() });
         }
     }
     else if (typeof raw === "object" && !Array.isArray(raw)) {
         const entries = Object.entries(raw);
-        for (const [k, v] of entries) {
+        for (const [i, [k, v]] of entries.entries()) {
             if (typeof v !== "string")
-                return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — the value of ${JSON.stringify(k)} is not a string` };
-            pairs.push([k, v.trim()]);
+                return paramIssue(i + 1, "has a value that is not a string");
+            params.push({ entry: i + 1, name: k, value: v.trim() });
         }
     }
     else {
         return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — got ${Array.isArray(raw) ? "an array" : `a ${typeof raw}`}` };
     }
-    const seen = new Set();
-    for (const [k, v] of pairs) {
-        if (!SEARXNG_PARAM_NAME.test(k))
-            return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — ${JSON.stringify(k)} is not a parameter name (letters, digits, "_", "-", ".")` };
-        if (v === "")
-            return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — ${k} has an empty value` };
-        if (seen.has(k))
-            return { ok: false, issue: `${SEARXNG_PARAMS_FORM} — ${k} is given more than once` };
-        seen.add(k);
+    const firstEntryOf = new Map();
+    for (const p of params) {
+        if (!SEARXNG_PARAM_NAME.test(p.name))
+            return paramIssue(p.entry, 'has a name that is not a parameter name (letters, digits, "_", "-", ".")');
+        if (p.value === "")
+            return paramIssue(p.entry, "has an empty value");
+        const first = firstEntryOf.get(p.name);
+        if (first !== undefined)
+            return paramIssue(p.entry, `repeats the name of entry #${first}`);
+        firstEntryOf.set(p.name, p.entry);
     }
-    return pairs.length === 0 ? ABSENT : { ok: true, value: Object.fromEntries(pairs) };
+    return params.length === 0 ? ABSENT : { ok: true, value: Object.fromEntries(params.map((p) => [p.name, p.value])) };
 }
 function assembleBackendConfig(provider, f) {
     return {
@@ -248,12 +262,17 @@ export function webSearchConfigFromEnv(env = process.env) {
     });
 }
 const SETTINGS_WEB_SEARCH_FORM = "settings.webSearch must be an object { provider, apiKey?, endpoint?, searxngParams?, maxResults? }";
+const providerIssue = (shape) => ({
+    ok: false,
+    issue: `must name one of ${WEB_SEARCH_PROVIDERS.join(" | ")} (${shape}) — it names where this request's searches go, so an unknown or missing provider is refused rather than replaced by this deployment's own backend`,
+});
 function judgeRequestProvider(raw) {
-    const got = raw === undefined || raw === null ? "it is missing" : typeof raw === "string" ? `got ${JSON.stringify(raw.slice(0, 40))}` : `got a ${Array.isArray(raw) ? "array" : typeof raw}`;
-    const word = typeof raw === "string" ? providerWord(raw) : undefined;
-    return word !== undefined && isWebSearchProvider(word)
-        ? { ok: true, value: word }
-        : { ok: false, issue: `must name one of ${WEB_SEARCH_PROVIDERS.join(" | ")} (${got}) — it names where this request's searches go, so an unknown or missing provider is refused rather than replaced by this deployment's own backend` };
+    if (raw === undefined || raw === null)
+        return providerIssue("it is missing");
+    if (typeof raw !== "string")
+        return providerIssue("it is not a string");
+    const word = providerWord(raw);
+    return isWebSearchProvider(word) ? { ok: true, value: word } : providerIssue("it is not one of them");
 }
 export function judgeRequestWebSearch(raw) {
     if (raw === undefined || raw === null)

package/dist/project-memory.d.ts

@@ -1,5 +1,6 @@
 import { type PlatformPath } from "node:path";
 import type { ProjectMemoryLoad } from "@sema-agent/core";
+import { type InstructionSourceSeat } from "./instruction-source-notice.js";
 interface ProjectMemoryCtx {
     cwd: string;
     handsEnabled: boolean;
@@ -46,6 +47,13 @@ export declare function instructionChainCoordinates(absPath: string, p?: Platfor
  * (mid-run file edits surface via the probe as tail attachments, never a silently re-rendered prefix).
  * `phase: "post-compact"` forces a re-read (core re-renders the prefix there anyway). No entry for
  * sessionless one-shot runs. (post-clear never arrives from core — [ref] — so it is not a cache key here.)
+ *
+ * S-690 — source-change notice: with `instructionSource` wired, every prepare of a non-subagent session that WALKED the
+ * instruction chain hands the chain member it selected (`null` = none) to {@link announceInstructionSource}, which
+ * compares it with the session's persisted baseline. A prepare stopped by a pre-walk gate (hands-less, a cwd that is not
+ * an absolute local directory) is "not applicable", not "none" — it never reaches the mint (O6, see `LoadOutcome`). The member is the one the snapshot carries — a cache hit answers the cached pick, so
+ * the notice follows what the model actually reads, not the disk (a same-process edit changes nothing until the
+ * snapshot is re-read: restart, post-compact, or a new session).
  */
 export declare function makeLoadProjectMemory(opts: {
     logger?: {
@@ -54,6 +62,8 @@ export declare function makeLoadProjectMemory(opts: {
     maxBytes?: number;
     /** TEST-ONLY: shrink the snapshot-cache bound so the settle-time trim is observable without 256 sessions. */
     cacheMax?: number;
+    /** S-690: the baseline store + notice exit. Absent ⇒ no source-change notice (the session store has no baseline face). */
+    instructionSource?: InstructionSourceSeat;
 }): (ctx: ProjectMemoryCtx) => Promise<string | null | ProjectMemoryLoad>;
 /**
  * ② The `RunnerDeps.probeInstructionSources` seam: re-fingerprint the declared instruction files mid-run so

package/dist/project-memory.js

@@ -2,6 +2,7 @@ import { promises as fs, constants as fsConstants } from "node:fs";
 import { execFile } from "node:child_process";
 import { createHmac, randomBytes } from "node:crypto";
 import hostPath, { isAbsolute, join } from "node:path";
+import { announceInstructionSource } from "./instruction-source-notice.js";
 import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
 import { scrubServerSecrets } from "./server-secret-env.js";
 import { redactSecrets } from "./trace/redact.js";
@@ -41,6 +42,7 @@ function instructionHash(raw) {
     return `hmac-sha256:${createHmac("sha256", INSTRUCTION_HASH_KEY).update(raw).digest("hex")}`;
 }
 const ABSENT_HASH = null;
+const NOT_APPLICABLE = { walked: false, answer: null };
 export function instructionChainCoordinates(absPath, p = hostPath) {
     const candidates = INSTRUCTION_FILE_CHAIN.filter((rel) => absPath.endsWith(p.sep + rel.split("/").join(p.sep))).sort((a, b) => b.length - a.length);
     for (const rel of candidates) {
@@ -72,7 +74,7 @@ function git(root, args, maxBytes) {
     const safeArgs = ["-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args];
     const scrubFindings = [];
     const scrubbedEnv = scrubServerSecrets(process.env, scrubFindings);
-    recordSecretEnvScrub("server.project-memory.git-subprocess", scrubFindings);
+    recordSecretEnvScrub("server.project-memory.git-subprocess", scrubFindings, []);
     return new Promise((res) => {
         execFile("git", safeArgs, { cwd: root, timeout: 5000, maxBuffer: maxBytes, env: { ...scrubbedEnv, GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null" } }, (err, stdout, stderr) => {
             if (!err)
@@ -90,17 +92,24 @@ export function makeLoadProjectMemory(opts) {
     const gitCap = 8 * 1024;
     const cache = new Map();
     const CACHE_MAX = opts.cacheMax ?? 256;
+    const seat = opts.instructionSource;
     return async (ctx) => {
+        const outcome = await loadOutcome(ctx);
+        if (seat && ctx.sessionId && !ctx.isSubagent && outcome.walked)
+            await announceInstructionSource(seat, ctx.sessionId, outcome.instructionFile);
+        return outcome.answer;
+    };
+    async function loadOutcome(ctx) {
         if (!ctx.handsEnabled)
-            return null;
+            return NOT_APPLICABLE;
         if (!isAbsolute(ctx.cwd))
-            return null;
+            return NOT_APPLICABLE;
         let root;
         try {
             root = await fs.realpath(ctx.cwd);
         }
         catch {
-            return null;
+            return NOT_APPLICABLE;
         }
         const cacheKey = ctx.sessionId && !ctx.isSubagent ? `${ctx.sessionId}\u0000${root}` : undefined;
         if (cacheKey) {
@@ -144,11 +153,11 @@ export function makeLoadProjectMemory(opts) {
             });
         }
         return load;
-    };
+    }
     async function doLoad(ctx, root) {
         const st = await fs.stat(root).catch(() => null);
         if (!st?.isDirectory())
-            return null;
+            return NOT_APPLICABLE;
         const claudeTrunc = { v: false };
         let claudeRaw = null;
         let hitFile;
@@ -202,28 +211,33 @@ export function makeLoadProjectMemory(opts) {
                 parts.push(`## Working tree\n${status.out.split("\n").slice(0, 40).join("\n")}`);
             gitNarrative = parts.join("\n\n");
         }
+        const instructionFile = hitFile ?? null;
         const sections = [];
         if (claude && hitFile)
             sections.push(`# ${hitFile}\n${claude}`);
         if (gitNarrative)
             sections.push(gitNarrative);
         if (sections.length === 0)
-            return null;
+            return { walked: true, answer: null, instructionFile };
         const redacted = redactSecrets(sections.join("\n\n"));
         const capped = capUtf8(redacted, totalCap);
         opts.logger?.debug?.("project_memory_loaded", { cwd: root, bytes: Buffer.byteLength(capped, "utf8"), isSubagent: ctx.isSubagent, gitOk, ...(gitDropReason ? { gitDropReason } : {}), claudeTruncated, ...(hitFile ? { instructionFile: hitFile } : {}), ...(ctx.phase ? { phase: ctx.phase } : {}), cacheSize: cache.size });
         if (!capped)
-            return null;
+            return { walked: true, answer: null, instructionFile };
         if (hitFile && hitHash) {
             return {
-                content: capped,
-                instructionSources: [
-                    ...INSTRUCTION_FILE_CHAIN.slice(0, hitIndex).map((rel) => ({ path: join(root, rel), contentHash: ABSENT_HASH })),
-                    { path: join(root, hitFile), contentHash: hitHash },
-                ],
+                walked: true,
+                answer: {
+                    content: capped,
+                    instructionSources: [
+                        ...INSTRUCTION_FILE_CHAIN.slice(0, hitIndex).map((rel) => ({ path: join(root, rel), contentHash: ABSENT_HASH })),
+                        { path: join(root, hitFile), contentHash: hitHash },
+                    ],
+                },
+                instructionFile,
             };
         }
-        return capped;
+        return { walked: true, answer: capped, instructionFile };
     }
 }
 export function makeProbeInstructionSources() {

package/dist/run-local.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { type Brain, type OnAsk, type TaskSpec } from "@sema-agent/core";
+import { type AskRequest, type Brain, type TaskSpec } from "@sema-agent/core";
 import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView } from "./deployment-governance.js";
 import { type ServiceConfig } from "./config.js";
 import { type Logger } from "./observability/logger.js";
@@ -77,9 +77,12 @@ export interface LocalGovernanceConfigView extends DeploymentGovernanceConfigVie
  * 叠上部署治理段(autonomy / commandPolicy / MANUAL_MODE_SHELL_GATE / 守卫集)。本函数一条 policy 都不
  * 自己合成。
  *
- * · **审批基线 = adjudicated allow-all**:一次性 CLI 没有 durable 审批设施(没有 `/decide` 腿可赎回),
- *   所以 `createApprovalBaselinePolicy` 走 durable 缺席那一臂。它是一条**在场的** effect-aware 策略
- *   (满足 core 的 `hasEffectAwareGate`),运维照旧用 `AUTONOMY` / `commandPolicy` / 守卫集在其上收紧。
+ * · **审批基线 = live 席**({@link RUN_LOCAL_APPROVAL_SEAT},S-694):一次性 CLI 没有 durable 审批设施(没有
+ *   `/decide` 腿可赎回),但**有**一只活 onAsk 席({@link createLocalApprover})。三张审批名单因此与 HTTP 腿
+ *   **同一只**策略执法(`createDurableAskPolicy`:deny ⇒ 拒;require / never-auto ⇒ ask ⇒ 那只席当场服),
+ *   不叠 durable 问答门。修前本腿不传席 ⇒ 落 allow-all 臂 ⇒ 名单在 CLI 上无声空转 —— [ref] 件一把「没有
+ *   durable 赎回腿」等同成了「ask 无处可服」,可件三同窗装上的正是那只服 ask 的席。运维照旧用
+ *   `AUTONOMY` / `commandPolicy` / 守卫集在其上收紧。
  * · **裁决 env 恒 host 形,锚 `workspaceDir`**:run-local 的手就跑在这台机器的这个目录上
  *   (`--workspace` / config.d workdir / cwd 三选一,调用方已解析好),所以 `cwd` 恒在场 —— 相对形写目标
  *   由 core 按 `rootPath` 解析进真身裁决,构造口的词法补层(沙箱腿那条)在这里自动不铺。
@@ -122,27 +125,26 @@ export interface LocalApproverIo {
  * ⛔ **不在 toolPolicy 层做 ask→deny 映射**:core 自己就有 headless auto-deny 的语义与文案,在策略层
  * 复刻一份 = 同源谎(两处判据日后各改各的)。裁决归 core,座位归这里。
  *
+ * 🔴 S-694 起本席也服**三张审批名单**产的 ask(审批基线取 live 席,见 {@link RUN_LOCAL_APPROVAL_SEAT}):
+ * `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO` 命中 ⇒ 策略 `ask` ⇒ 落到这里。`AskRequest` 不带是哪条声明产的
+ * ask(core 把 `matchedAskRule` 刻意留在闸内、不上请求),所以无 TTY 拒句**列出**可能产门的全部旋钮,
+ * `APPROVAL_DENY` 也点名(它当场拒、不经本席 —— 运维排查「为什么这只工具不跑」时要在同一句里看到它)。
+ *
  * 🔴 非 TTY 臂答 `false`(真 deny),**绝不答 `"unavailable"`**:后者被 core 读成「席位够不到」并**改道
  * `suspendAsk`**(dist `core/hooks.js` 的 `approverUnavailable` 重投)。今天本腿无店 ⇒ 那条改道无处
  * 可去(fail-closed 拒),但这一条仍是本席的契约:答案是「不批」,不是「找不到人」。
  */
-export declare function createLocalApprover(io: LocalApproverIo): OnAsk;
-/** 默认的 TTY 问人器:一问一答,回答写 **stderr**(stdout 是任务结果的专用管道,别污染它)。
- *  streams 可注入=EOF/abort 两臂测得动(默认 process.stdin/stderr)。
- *
- *  🔴 决断三臂(codex 验收轮 high,红先修):`readline/promises` 的 `question` 在输入流 EOF/close 时
- *  **不决**(promise 悬挂)——Ctrl-D、关闭的 stdin、任务取消都会把 runLocal 永久挂住,文件后端的锁
- *  跟着被拖住,下一次同 root 调用直接卡死。三臂全部 fail-closed 决 false:
- *   · `signal` abort(core `OnAsk` 递进来的取消,含预先 aborted);
- *   · readline `close`(输入流 end/close 时 readline 自关);
- *   · `question` 自身 reject(abort throw / 流错误)。 */
+/** 本席的形:core `OnAsk` 的函数臂(`"allow"` / `"deny"` 两个字面臂本席从不用),答案恒是布尔 —— 结构上可赋给 `OnAsk`。 */
+export type LocalApprover = (req: AskRequest, signal?: AbortSignal) => Promise<boolean>;
+export declare function createLocalApprover(io: LocalApproverIo): LocalApprover;
 export declare function promptYesNoOnTty(prompt: string, signal?: AbortSignal, streams?: {
     input: NodeJS.ReadableStream;
     output: NodeJS.WritableStream;
 }): Promise<boolean>;
 /**
  * Boot the engine in LOCAL mode, run ONE task to completion, print the result. Returns the process exit
- * code (0 = completed, 1 = the task did not complete / a fatal error, 2 = bad usage / unmet env). Pure of
+ * code (0 = completed its work, 1 = the task did not complete — including a `completed` run that a person stopped,
+ * see {@link personStopOf} — / a fatal error, 2 = bad usage / unmet env). Pure of
  * `process.exit` so a test can assert the code; `main()` applies it.
  */
 export declare function runLocal(argv: string[], deps?: RunLocalDeps): Promise<number>;

package/dist/run-local.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { DEFAULT_MODEL_REF } from "./model-select.js";
+import { DEFAULT_MODEL_REF, resolveTaskModel } from "./model-select.js";
+import { defaultModelRefusal, modelUnavailableMessage } from "./model-entry-refusal.js";
 import { buildDurableAbsenceNote, createCorruptReadSeat } from "./observability/corrupt-read-seat.js";
 import { outwardPlane } from "./terminal.js";
 import { homedir } from "node:os";
@@ -8,7 +9,7 @@ import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
-import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
+import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
@@ -25,6 +26,7 @@ import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario,
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
 import { executionLaneHomeDir, executionLaneOf } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
+import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
@@ -122,22 +124,81 @@ export function missingGatewayRequirements(config) {
     }
     return missing;
 }
+const RUN_LOCAL_APPROVAL_SEAT = { kind: "live" };
 export function applyLocalGovernance(base, config, workspaceDir, engineDataRoot) {
-    return applyRuntimeGovernance({ ...base, toolPolicy: createApprovalBaselinePolicy(config) }, createDeploymentGovernanceInputs(config, { env: new NodeExecutionEnv({ cwd: workspaceDir }), cwd: workspaceDir }, { engineDataRoot }));
+    return applyRuntimeGovernance({ ...base, toolPolicy: createApprovalBaselinePolicy(config, RUN_LOCAL_APPROVAL_SEAT) }, createDeploymentGovernanceInputs(config, { env: new NodeExecutionEnv({ cwd: workspaceDir }), cwd: workspaceDir }, { engineDataRoot }));
 }
 export function createLocalApprover(io) {
+    let tail = Promise.resolve();
     return async (req, signal) => {
         if (!io.isTty) {
-            io.printErr(`denied "${req.toolName}" (${req.message}) — this run-local invocation has no TTY, so there is nobody to ask. ` +
-                `The gate comes from this deployment's governance knobs: AUTONOMY, MANUAL_MODE_SHELL_GATE, ` +
-                `runtime.commandPolicy (config.d/governance.json). Run it in a terminal to answer interactively, or relax the knob.`);
+            io.printErr(`denied "${terminalSafeText(req.toolName)}" (${terminalSafeText(req.message)}) — this run-local invocation has no TTY, so there is nobody to ask. ` +
+                `The gate comes from this deployment's governance knobs: APPROVAL_REQUIRE / APPROVAL_NEVER_AUTO (the approval lists; ` +
+                `APPROVAL_DENY refuses outright without asking), AUTONOMY, MANUAL_MODE_SHELL_GATE, runtime.commandPolicy (config.d/governance.json). ` +
+                `Run it in a terminal to answer interactively, or relax the knob (APPROVAL_AUTO_BUDGET auto-approves that many APPROVAL_REQUIRE calls; ` +
+                `a separate .env for this CLI keeps a server's lists off it).`);
             return false;
         }
-        return io.askYesNo(`approve "${req.toolName}"? ${req.message} [y/N] `, signal);
+        const argsShown = argsDisplayOf(req.args);
+        if (!argsShown.ok) {
+            io.printErr(`denied "${terminalSafeText(req.toolName)}" (${terminalSafeText(req.message)}) — its arguments cannot be displayed ` +
+                `(${terminalSafeText(argsShown.reason)}), so there is nothing a person could review; refusing instead of asking.`);
+            return false;
+        }
+        const prior = tail;
+        let release;
+        const mine = new Promise((resolve) => {
+            release = resolve;
+        });
+        tail = prior.then(() => mine);
+        try {
+            if (!(await priorSettledUnlessAborted(prior, signal)))
+                return false;
+            return await io.askYesNo(buildLocalAskPrompt(req, argsShown.text), signal);
+        }
+        finally {
+            release();
+        }
     };
 }
-export async function promptYesNoOnTty(prompt, signal, streams = { input: process.stdin, output: process.stderr }) {
+function priorSettledUnlessAborted(prior, signal) {
     if (signal?.aborted)
+        return Promise.resolve(false);
+    if (signal === undefined)
+        return prior.then(() => true);
+    return new Promise((resolve) => {
+        const onAbort = () => resolve(false);
+        signal.addEventListener("abort", onAbort, { once: true });
+        void prior.then(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(!signal.aborted);
+        });
+    });
+}
+function argsDisplayOf(args) {
+    let json;
+    try {
+        json = JSON.stringify(args);
+    }
+    catch (e) {
+        return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+    }
+    if (json === undefined)
+        return { ok: false, reason: "the arguments serialize to nothing" };
+    return { ok: true, text: terminalSafeText(json) };
+}
+function buildLocalAskPrompt(req, argsShown) {
+    return `approve "${terminalSafeText(req.toolName)}"? ${terminalSafeText(req.message)}\n  ${argsShown}\n[y/N] `;
+}
+function terminalSafeText(text) {
+    return text.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function inputAlreadyEnded(input) {
+    const state = input;
+    return state.readableEnded === true || state.destroyed === true;
+}
+export async function promptYesNoOnTty(prompt, signal, streams = { input: process.stdin, output: process.stderr }) {
+    if (signal?.aborted || inputAlreadyEnded(streams.input))
         return false;
     const rl = createInterface({ input: streams.input, output: streams.output });
     try {
@@ -158,6 +219,27 @@ export async function promptYesNoOnTty(prompt, signal, streams = { input: proces
         rl.close();
     }
 }
+function personStopOf(result) {
+    if (result.terminal.kind !== "completed")
+        return undefined;
+    if (result.haltedOnUserRejection === true)
+        return "haltedOnUserRejection";
+    if (result.haltedByUser === true)
+        return "haltedByUser";
+    return undefined;
+}
+function buildPersonStopFooter(stop, sessionId) {
+    switch (stop) {
+        case "haltedOnUserRejection":
+            return `task stopped (haltedOnUserRejection): a tool call was refused, so the run did not finish its work — continue it with --session ${sessionId}`;
+        case "haltedByUser":
+            return `task stopped (haltedByUser): the run was halted before it finished its work — continue it with --session ${sessionId}`;
+        default: {
+            const unhandled = stop;
+            throw new Error(`person-stop marker "${String(unhandled)}" has no footer`);
+        }
+    }
+}
 export async function runLocal(argv, deps = {}) {
     const print = deps.print ?? ((l) => console.log(l));
     const printErr = deps.printErr ?? ((l) => console.error(l));
@@ -195,6 +277,8 @@ export async function runLocal(argv, deps = {}) {
         if (r) {
             for (const de of r.domainErrors ?? [])
                 logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "domain fell to schema defaults; other domains applied normally" });
+            for (const d of r.droppedEntries ?? [])
+                logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
             effective = r.effective;
             applyEffective(config, r.effective, logger, { leg: "boot" });
             if (effective?.mcp)
@@ -208,6 +292,9 @@ export async function runLocal(argv, deps = {}) {
     catch (err) {
         logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
     }
+    const noDefaultModel = defaultModelRefusal(config, "env");
+    if (noDefaultModel !== undefined)
+        throw new Error(noDefaultModel);
     const endpointRefusal = modelRouteEndpointRefusal(config);
     if (endpointRefusal !== undefined)
         throw new Error(endpointRefusal);
@@ -242,7 +329,7 @@ export async function runLocal(argv, deps = {}) {
         return 2;
     }
     const ungatedCompensation = buildOnlySensitiveBaselineWarning(config, {
-        durableEnabled: false,
+        approvalSeat: RUN_LOCAL_APPROVAL_SEAT.kind,
         singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config),
     });
     if (ungatedCompensation)
@@ -286,7 +373,7 @@ export async function runLocal(argv, deps = {}) {
             ...(hostRx.commandTimeoutMs != null ? { commandTimeoutMs: hostRx.commandTimeoutMs } : {}),
         })
         : undefined;
-    const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? createHostLspManager((event, fields) => logger.info(event, fields)) : undefined;
+    const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? createHostLspManager(config, (event, fields) => logger.info(event, fields)) : undefined;
     const memoryEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
     let memorySync;
     if (config.memorySync && memoryEngine) {
@@ -417,7 +504,10 @@ export async function runLocal(argv, deps = {}) {
         onError: engineOnError,
         onAsk,
         ...(config.projectMemoryEnabled
-            ? { loadProjectMemory: makeLoadProjectMemory({ logger }), probeInstructionSources: makeProbeInstructionSources() }
+            ? {
+                loadProjectMemory: makeLoadProjectMemory({ logger, instructionSource: createInstructionSourceSeat(sessionStore, sharedRunnerDeps.onNotice) }),
+                probeInstructionSources: makeProbeInstructionSources(),
+            }
             : {}),
     };
     const runner = new Runner(runnerDeps);
@@ -460,7 +550,14 @@ export async function runLocal(argv, deps = {}) {
         }
         throw err;
     }
-    const mention = parseModelMention(args.objective, Object.keys(config.models));
+    const mention = resolveTaskModel(undefined, args.objective, config.models, undefined, config.modelRefusals);
+    if (mention.unavailable !== undefined) {
+        const { requested, name, refusal } = mention.unavailable;
+        printErr(`cannot run: ${modelUnavailableMessage("@-mention", requested, name, refusal)}`);
+        void lspManager?.dispose();
+        await fileBackend.dispose();
+        return 2;
+    }
     const scope = args.user ?? "local";
     const taskTimeoutSec = Math.floor(parseNumOrFailNonNegative("TASK_TIMEOUT_SEC", process.env.TASK_TIMEOUT_SEC || "0"));
     const timeoutSec = taskWallClockSec(taskTimeoutSec, false, scenarioName === "discuss");
@@ -474,13 +571,13 @@ export async function runLocal(argv, deps = {}) {
         ...(maxTokens !== undefined ? { maxTokens } : {}),
     };
     const spec = applyLocalGovernance({
-        objective: mention.cleanedText || args.objective,
+        objective: mention.cleanedObjective,
         sessionId,
         backgroundScope: "session",
         oneShot: true,
         principal: scope,
         ...(memoryEngine ? { memory: memorySpecForRequest(scope, memoryProjectKeyFor(config, scope, workspaceDir), undefined) } : {}),
-        model: mention.model ?? "default",
+        model: mention.model,
         getApiKeyAndHeaders: keyResolver,
         tools: cap.tools,
         skills: cap.skills,
@@ -527,11 +624,14 @@ export async function runLocal(argv, deps = {}) {
         await fileBackend.dispose();
         return 1;
     }
+    const personStop = personStopOf(result);
     if (args.json) {
         print(JSON.stringify(result, null, 2));
     }
     else if (result.terminal.kind === "completed") {
         print(result.result);
+        if (personStop !== undefined)
+            printErr(buildPersonStopFooter(personStop, sessionId));
     }
     else {
         const plane = outwardPlane(result.terminal);
@@ -540,7 +640,7 @@ export async function runLocal(argv, deps = {}) {
             print(salvage);
         printErr(`task ${plane.status}${plane.errorCode ? ` (${plane.errorCode})` : ""}${plane.errorMessage ? `: ${plane.errorMessage}` : ""}`);
     }
-    if (result.terminal.kind !== "completed")
+    if (result.terminal.kind !== "completed" || personStop !== undefined)
         exitCode = 1;
     if (memorySync) {
         try {

package/dist/sealed-key.d.ts

@@ -23,8 +23,11 @@ export interface SealedKeyStore extends SealedKeyOpener {
         createdAt: string;
     };
 }
-/** Why a model's sealed key could not be unsealed (the poison-pill diagnosis, see SealedKeyPoison). */
-export type SealedKeyPoisonReason = "sealed_decrypt_failed" | "stale_ciphertext" | "unsupported_alg" | "no_key_store";
+/** Why a model's sealed key could not be unsealed (the poison-pill diagnosis, see SealedKeyPoison). CUSTODY failures only:
+ *  a sealedApiKey that is malformed (alg other than the pinned v1 SEALED_KEY_ALG, non-base64 ciphertext) makes the whole
+ *  catalog entry unavailable instead (S-704 `config.model_entry_invalid`, settings-schema `SealedApiKey` is the shape
+ *  owner) — the former `unsupported_alg` reason was retired with that move (it could no longer be reached). */
+export type SealedKeyPoisonReason = "sealed_decrypt_failed" | "stale_ciphertext" | "no_key_store";
 /**
  * Poison-pill entry for the per-model key map (`config.modelApiKeys`): planted by applyEffective when
  * a model CARRIES `sealedApiKey` but the ciphertext cannot be unsealed. We deliberately do NOT drop