@sigrun/sigrun 0.6.1 → 0.7.0

package/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.0] - 2026-11-04
+
+The polish pass: three waves of behaviour fixes, the full deferred-minors sweep, and a
+fresh-eyes clean-room install verification.
+
+### Core
+
+- **Host-bridge fail-fast** (breaking for embedders): bridged host members now reject
+  immediately with `HostBridgeUnavailableError` when no server will ever bind the bridge
+  (`openHarness` gains `expectHostBridge`; `createServer` marks it expected on entry).
+  Handlers log once per extension+member instead of stalling the hook deadline.
+- Date-range presets (`PnD`/`PnW`) count calendar days; the `T…` part stays elapsed time.
+- `modelBreadcrumb` in `@sigrun/shared/model-label`; the webui shows the provider as a
+  breadcrumb (`b/c/acme-flash`) with the full id on hover.
+- `isProxyOnly` lives once in `@sigrun/shared/auth` (empty/absent methods fail safe);
+  the CLI onboarding gate keys on proxy identity (its claim can never carry the loopback
+  vouch; `sigrun run`'s own loopback companion is exempt).
+- Curator: empty-text skill writes refused; `.tmp` sweep; pruned undos report-and-continue
+  (siblings still revert); two-targets-one-tool validated at load; scan caps gained
+  cursors; the 10k guard reports truncation.
+- serializePolicy has one writer; smoke scripts fail loudly (the registry smoke's
+  false-green fixed); `-h/--help` accepted at every CLI level.
+- Onboarding claim errors list the accepted body keys; token-create against fresh roots
+  blames the roots.
+- e2e suite: zero fixed sleeps (condition waits + boot barriers); a stale-closure in the
+  composer's answered-refetch was found and fixed by the strictness.
+
+### Fresh-eyes fixes (clean-room verified)
+
+- The compose route boots (tmpfs `/cache:uid=1000`); the container documents its token
+  path and the image puts `sigrun` on PATH (next build); the README documents the
+  submission and claim body shapes and where the setup code lands per deploy shape.
+
 ## [0.6.1] - 2026-11-03
 
 ### Fixed
@@ -15,6 +48,65 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Release-pin bump to 0.6.1 (root, shared, tui, sandbox platform packages, chart appVersion, compose defaults).
 
+## [Unreleased]
+
+### Added
+- **Views are tabs (webui).** The webui shell registers views as rail
+  tabs with remembered routes; the chat view keeps the conversation
+  list and right panel to itself. Below the tablet breakpoint a phone
+  bottom tab bar (with a More sheet) replaces the rail.
+- **`page.selection`** — a server-declared, presentation-only
+  list-first drill-in for compact widths (`{selected, back}` on a
+  `page`; webui and TUI render it, `toText` ignores it).
+- **Core views.** Core attaches its own view surfaces under the
+  reserved `core` slug and lists them as `coreViews` (one
+  `CoreViewInfo {id, title, icon, refreshMs?}` per view) on
+  `/v1/extensions` and `/v1/meta`; they are never `extensions[]` rows,
+  so the health dot is unaffected. `job.changed` now bumps every
+  rendered core/jobs instance.
+- **The Jobs tab** (`core/jobs`): the jobs surface as a core blocks
+  view — sidebar of the caller-visible jobs, drill-in with summary,
+  paged runs and revisions (a selected revision diffs its spec JSON
+  against the previous one), Run now / Reset state for write access,
+  and per-row navigation into a run's conversation. The Jobs panel is
+  gone.
+- **The Skills tab** (`core/skills`): every skill root the deployment
+  serves — Workspace / Learned / Config dir (the deployment-wide
+  `<config-dir>/skills/`, read-only) / one group per installed package
+  (`· <pkg>`, with a per-row package badge) / Deleted — with shadowing visible, owned-skill CRUD, per-skill git
+  history (25 entries per page, per-file diffs, restore), deleted-skill
+  restore, and per-user overlays as the only write to the read-only
+  shared roots. Some surface actions return `navigate`; the webui
+  applies that navigation, the TUI does not yet (a known channel gap).
+- **Every-root skill discovery** (`src/skills/roots.ts`): workspace,
+  learned, user dir, and every installed package's skills listed in one
+  pass, with precedence/shadowing resolution and symlink-safe reads.
+- **GitHistory** (`src/history/git.ts`) — isolated local git for
+  sigrun-owned history stores: execFile with explicit `--git-dir` /
+  `--work-tree`, a hermetic git env, per-repo locking, and fail-soft
+  writes (a broken repo is quarantined aside and re-initialized;
+  mutations never fail because history did).
+- **Curation stores on git** (Task 9): each user's learned skills,
+  overlays, and curator state live in a per-user git history repo; the
+  change feed's `actor` widens to `"outside"` and its `id`/`before`/
+  `after` are commit SHAs. A once-per-process migration imports the
+  pre-git store (the legacy files are left read-only, outside the
+  repo's pathspec).
+- **Workspace skills history** (Task 10): the workspace `skills/`
+  tree gets its own per-user repo (git dir outside the work tree),
+  caught up on settled runs and tab opens; ownerless conversations
+  skip it.
+
+### Changed
+- **The curation seal**: workspaces and grants that sit inside or
+  contain a user's `curation/` tree are rejected; boot revalidates
+  stored records and names each failing one loudly. A user whose
+  workspace was the bare user area loses agent tools until an admin
+  re-points it: `PATCH /v1/users/<u> {"workspace": "<userArea>/workspace"}`.
+  History tamper-resistance holds under active sandbox isolation; a
+  single-user install without isolation runs the agent unsandboxed
+  (the existing trust model).
+
 ## [0.6.0] - 2026-11-02
 
 ### Added

package/README.md

@@ -20,7 +20,10 @@ contracts can still evolve between minor releases. See
 [`SECURITY.md`](SECURITY.md) for the support, trust, and verification
 posture, and [`CONTRIBUTING.md`](CONTRIBUTING.md) to build and test.
 
-**Try it:** `npm i -g @sigrun/sigrun && sigrun run` — or jump to
+**Try it:** `npm i -g @sigrun/sigrun && sigrun run` (on a workstation,
+with a terminal — `sigrun run` is the interactive mode: it claims the
+install via prompts and launches the TUI; without a TTY or on a server,
+use `sigrun serve` below) — or jump to
 [Install](#install) and [Quickstart](#quickstart) for the model/credential
 setup every install needs.
 
@@ -114,6 +117,9 @@ Open `http://localhost:3000/` (web UI) or drive the API:
 ```bash
 curl localhost:3000/v1/meta
 curl -X POST localhost:3000/v1/conversations -H 'content-type: application/json' -d '{}'
+# A submission carries its text in the `input` field:
+curl -X POST localhost:3000/v1/conversations/1/submissions \
+  -H 'content-type: application/json' -d '{"input": "hello"}'
 ```
 
 From a source checkout the dev shape is `npm install && npm start`
@@ -121,6 +127,9 @@ From a source checkout the dev shape is `npm install && npm start`
 
 ## Launch modes
 
+`sigrun --help` (or `-h`) prints usage and exits 0; the same flag works
+after a subcommand (`sigrun serve --help`).
+
 The `sigrun` binary (`package.json` `bin`, run via tsx) has three
 entrypoints:
 
@@ -387,7 +396,7 @@ or a `/32` / `/128` entry) does vouch, as an explicit operator
 decision, and boot logs a warning for each such entry when no shared
 secret is configured.
 
-**Rejection diagnostics.** Each rejection logs one sanitized line
+**Rejection diagnostics.** A rejection logs one sanitized line
 (subject to the throttle below) naming the socket peer, the method, a
 short reason, and the route, when known — never tokens, cookies, or
 identity-header values. The throttle emits one line per reason per 60 s,
@@ -664,17 +673,26 @@ re-pointed to a different user. The holder or an administrator must remove
 a conflicting old link first.
 
 **Onboarding (the first claim).** An unclaimed server serves
-`GET /v1/onboarding` + `POST /v1/onboarding/claim`. On a loopback bind
-or through a trusted proxy identity the claim needs no code; otherwise
-the one-shot setup code is required — printed once in the log at boot
-and written to `<cacheDir>/setup-code` (in the Helm chart: the pod log
-and `/cache/setup-code`; `SIGRUN_SETUP_CODE` pins it instead). The
-claimant becomes the first admin and owns the reserved root
-conversation. Later users join by invite code (`POST /v1/users/invites`,
-admin) or by trusted-proxy auto-provision; admins can transfer or remove
-users (`PATCH`/`DELETE /v1/users/{user}` — deletion transfers their
+`GET /v1/onboarding` + `POST /v1/onboarding/claim`. The claim body is
+`{"code": "…", "user": "<username>"}` (plus optional `name`, `email`,
+`issueToken`, `tokenName`); the identity field is `user`, not
+`username`. On a loopback bind or through a trusted proxy identity the
+claim needs no code; otherwise the one-shot setup code is required —
+printed once in the log at boot and written to `<cacheDir>/setup-code`
+(in the Helm chart: the pod log and `/cache/setup-code`;
+`SIGRUN_SETUP_CODE` pins it instead). The claimant becomes the first
+admin and owns the reserved root conversation. Later users join by
+invite code (`POST /v1/users/invites`, admin) or by trusted-proxy
+auto-provision; admins can transfer or remove users
+(`PATCH`/`DELETE /v1/users/{user}` — deletion transfers their
 conversations).
 
+**Setup code location.** `<cacheDir>` resolves from `SIGRUN_CACHE_DIR`
+(compose/chart set it to `/cache`); without it the code lands under the
+`SIGRUN_HOME`-derived XDG cache (e.g. `/data/home/.cache/sigrun` on the
+published image). The boot **log line** is the always-true source
+regardless of deploy shape — grep it: `grep 'setup code' <the log>`.
+
 **Proxy-only onboarding.** On a proxy-only server bound beyond
 loopback, onboarding happens entirely **through the proxy**: the first
 claim and every later sign-in arrive as trusted proxy identities, no
@@ -1206,14 +1224,42 @@ typed — the submission's user entry carries
 `{kind: "sigrun.user.expanded", data: {typed, command}}` while the
 model receives the expanded text.
 
+**The Skills tab.** The core Skills view (`#/ext/core/skills`) is the
+management surface for all of this: every skill root the deployment
+serves, grouped — **Workspace**, **Learned**, **Config dir** (the
+deployment-wide `<config-dir>/skills/`, read-only), one group **per
+installed package** (`· <pkg>` — package skills, each row carrying the
+package badge), and **Deleted** — with
+shadowing made visible (a lower-precedence skill that never wins says
+so). Skills you own are editable in place; the deployment's shared
+roots (the config dir and packages) are read-only here, and a per-user
+**overlay** is their only write (your overlay, your precedence — other
+users are unaffected). Each history-backed skill keeps its full **git
+history**: page through it 25 entries at a time, read the per-file
+diffs of any change, and restore an old state.
+
+The tab is per-user — a caller sees their own Workspace and Learned
+roots. On the naive single-operator loopback posture (the userless
+superuser — no `X-Sigrun-User` header), the Skills tab resolves that
+caller to the **primary admin** (the earliest-created directory user
+with the admin flag — the same fallback the execution jail uses), so
+her workspace and learned skills are the ones on screen. With an empty
+directory (no claimed user yet) there is no primary admin, so the
+tab shows only the deployment's shared roots (Config dir / Packages)
+and its own empty Workspace/Learned scope.
+
+Some surface actions
+hand the channel a navigation to apply (a surface action returning
+`navigate`): the webui applies it; the TUI does not yet apply
+`ActionResult.navigate` — a known channel gap.
+
 **The curator and learned skills.** Beyond the three roots above, every
 user has a private fourth root — learned skills the curator records for
 them under `<data-dir>/users/<user>/skills/`. For skills it ranks second:
 the workspace wins over it, and it wins over the user dir and packages. The curator reviews the
 user's conversations (owner-authored tool calls are captured as
 "Noted" hints, never executed on the spot) and writes through the
-versioned `skill_manage` surface, so every learned skill keeps its last
-ten versions, a change feed, and one-call undo. Learned skills never
+versioned `skill_manage` surface. Learned skills never
 leave their user: they are not shared, not transferred on ownership
 moves, and removed with the user on `DELETE /v1/users/{user}`. Each
 user can pause or disable the curator in their own per-user settings —
@@ -1223,6 +1269,36 @@ off entirely (both are per-user and take effect on the next run) — and
 an operator can disable it server-wide with
 `"builtinExtensions": {"curator": false}` (restart required).
 
+**Skill history is local git, per user.** Both writable roots keep
+their history in a private per-user git repository under the user's
+curation history dir — the learned skills, overlays, and curator state
+in one repo, the workspace's `skills/` tree in a second repo whose git
+dir lives outside the work tree. There is no remote and no upstream:
+the history is a local audit trail, not a bounded version count. Edits
+made outside the store are folded in as catch-up commits: when the tab
+opens they record actor `outside`; when a run settles, the workspace
+repo catches up with actor `agent` carrying the conversation id (only
+the workspace repo has a settle hook). History writes for the
+workspace root are keyed to the conversation's owner — ownerless
+conversations skip it. The history's tamper-resistance holds under
+active sandbox isolation (the agent's jail never grants the curation
+dir); a single-user install without isolation runs the agent
+unsandboxed — the existing trust model, nothing extra promised.
+
+**Upgrade note (curation seal).** Workspaces and grants are now
+rejected when they sit inside or contain a user's `curation/` tree — a
+record pointing at the bare user area would hand the agent the whole
+curation state, history included. A pre-existing user whose workspace
+or grant was exactly that loses its agent's tools until an admin
+re-points it; boot logs each such user and path loudly. The repair is
+one call:
+
+```sh
+curl -X PATCH localhost:3000/v1/users/<u> \
+  -H 'content-type: application/json' \
+  -d '{"workspace": "<userArea>/workspace"}'
+```
+
 ## Jobs
 
 A job is a schedule plus an action, durable by construction — one
@@ -1281,9 +1357,17 @@ always maps to the exact definition it ran.
 
 **Run now:** `POST /v1/jobs/{id}/run` (write access) fires immediately
 — the same hook external triggers (CI, Alertmanager) use with a token.
-In the web UI the Jobs panel (the clock icon in the header) lists jobs
-with a “Run now” button; in the TUI `/jobs` prints the table (name,
-next run, last outcome).
+In the web UI the Jobs tab (the core `core/jobs` view, `#/ext/core/jobs`)
+lists jobs with a “Run now” button; in the TUI `/jobs` prints the table (name,
+next run, last outcome). The tab is the block-rendered twin of the
+REST surface: the sidebar lists the caller-visible jobs, selecting one
+drills into its summary, runs, and revisions (a revision view diffs its
+spec against the previous one), and a run with a conversation links
+straight to it — that action-result navigation is applied by the webui;
+the TUI does not yet apply `ActionResult.navigate` (a known channel
+gap). Access is exactly the `/v1/jobs` rule — including the naive
+single-operator posture: the userless superuser (no `X-Sigrun-User`
+header) sees and manages every job, matching the REST routes' grant.
 
 ## Restarting
 
@@ -1353,11 +1437,14 @@ curl -X POST -H "Authorization: Bearer $TOKEN" \
   the history (newest first).
 - `POST /v1/conversations`, `POST /v1/conversations/{id}/submissions`,
   `GET /v1/conversations/{id}` — the durable conversation surface
-  (SSE streaming views included).
+  (SSE streaming views included). A submission body is
+  `{"input": "..."}` (or a `{"input": [parts]}` array of
+  text/image/file content parts).
 - `GET /v1/providers` — per-provider readiness, statuses only (never
   credentials); `GET /v1/auth/check` is the deprecated alias.
 - `GET /v1/onboarding`, `POST /v1/onboarding/claim` — the unclaimed
-  state and the first-user claim.
+  state and the first-user claim (body `{"code": "…", "user": "…"}` —
+  the identity field is `user`).
 - `POST /v1/auth/login`, `POST /v1/auth/logout`, `GET /v1/auth/whoami` —
   token sign-in, logout, and the resolved principal.
 - `GET /v1/auth/providers`, `GET /v1/auth/login/{provider}`,

package/dist/blocks/build-stamp.json

@@ -1,13 +1,13 @@
 {
   "algorithm": "sha256",
   "sources": {
-    "shared/src/blocks/index.ts": "ca37dbb56a4a1a05a40a0125a06d864b9a0671c70817c83a44dd0e3962999e30",
+    "shared/src/blocks/index.ts": "f1a1a5c59d83ee1b062b6ee118597cf20094a40df13554d7aa572c41cb2d64a0",
     "src/blocks/builders.ts": "a0c9835aaeab871bc2548d4b8d4426849c60cdb0cb1b20142d3bbe11e8377005",
     "src/blocks/images.ts": "2e1bd54546c9c1c5bf0cfe9b488aaffd7c37979ef84bae9789168275e63e202f",
     "src/blocks/index.ts": "8878a2e2269572ebdecca2cf3b95fa67f144232d8a8fe4258b120948064d0520",
     "src/blocks/limits.ts": "1e913f29167114e26bed6f8c1fd04c64b119ee1db3f4e9e2ae161ddf70578683",
     "src/blocks/placements.ts": "fccda42669713d91dc78d025268ee127f926891cf383727c1e235a39b9f15c6f",
-    "src/blocks/schema.ts": "27dbc5cdf1152a16a75bfb1a70383f1a456999a41d393308c05079b41f087a83",
+    "src/blocks/schema.ts": "13f2a225b09e41019f448b88a47b6f98ef508561955b8d847314dc88351f930a",
     "src/blocks/validate.ts": "31b9fc78f569cceff229bd1f28bfc62e2f8da437684100e051104f059a1ca19f"
   }
 }

package/dist/blocks/schema.js

@@ -185,6 +185,11 @@ const PageBlock = Type.Object({
         title: Type.String(),
         hint: Type.Optional(Type.String()),
     })),
+    /** Server-declared compact drill-in (presentation-only). */
+    selection: Type.Optional(Type.Object({
+        selected: Type.Boolean(),
+        back: Type.Object({}, { additionalProperties: true }),
+    })),
 });
 const StackBlock = Type.Object({
     ...BlockBase,

package/dist/cli.js

@@ -40,7 +40,7 @@
  * cluster's monolith).
  */
 import { spawn as nodeSpawn } from "node:child_process";
-import { readFileSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { mkdir, readFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
@@ -57,9 +57,11 @@ import { SettingsStore } from "./harness/settings.js";
 import { resolveHelper } from "./sandbox/helper.js";
 import { selfPackageRoot } from "./harness/packages.js";
 import { createAdmissionGuard } from "./harness/identity/users.js";
+import { isProxyOnly } from "@sigrun/shared/auth";
 import { serve } from "./serve.js";
 import { ACCENT_NAMES, PALETTE_NAMES, isAccentName, isPaletteName, } from "@sigrun/shared/themes";
-export const USAGE_TEXT = `usage: sigrun [--user <name>]
+export const USAGE_TEXT = `usage: sigrun [-h | --help]
+       sigrun [--user <name>]
        sigrun serve
        sigrun attach [--server <url>] [--user <name>]
        sigrun token create <name> --user <user>
@@ -92,6 +94,8 @@ function usageError(message) {
  * is a usage error.
  */
 function parseTokenArgs(argv) {
+    if (argv.includes("-h") || argv.includes("--help"))
+        return { command: "help" };
     const sub = argv[0];
     if (sub === "list") {
         if (argv.length !== 1) {
@@ -143,6 +147,8 @@ function parseTokenArgs(argv) {
  * deriving it from the external username; ordinary add still requires it.
  */
 function parseUserArgs(argv) {
+    if (argv.includes("-h") || argv.includes("--help"))
+        return { command: "help" };
     const sub = argv[0];
     if (sub === "list") {
         if (argv.length !== 1) {
@@ -215,6 +221,8 @@ function parseUserArgs(argv) {
  * note says so).
  */
 function parseProviderArgs(argv) {
+    if (argv.includes("-h") || argv.includes("--help"))
+        return { command: "help" };
     const sub = argv[0];
     if (sub !== "list" && sub !== "key" && sub !== "clear") {
         throw usageError(`unknown provider subcommand ${JSON.stringify(sub ?? "")} (list, key, clear)`);
@@ -277,6 +285,12 @@ export function parseArgs(argv) {
         return parseUserArgs(argv.slice(1));
     if (argv[0] === "provider")
         return parseProviderArgs(argv.slice(1));
+    // `-h`/`--help` ANYWHERE wins over every other argument: the first
+    // thing a stranger types must print usage with exit 0, never a usage
+    // error (fresh-eyes A6).
+    if (argv.includes("-h") || argv.includes("--help")) {
+        return { command: "help" };
+    }
     let command;
     let server;
     let user;
@@ -526,10 +540,21 @@ export async function ttyPrompt(question, opts) {
  * source is operator-typed (unchecked): derive the canonical key before
  * it reaches the wire (the server derives on receipt too). Unusable
  * input fails loud, never a silent empty identity.
+ *
+ * The flag is OPERATOR-EXPLICIT (polish task 12): an empty `--user ""`
+ * errors like any other unusable flag value — never a silent fallthrough
+ * to SIGRUN_USER/tui.json (the operator asked for a user; resolving a
+ * different identity would be a surprise). Ambient sources (env, file)
+ * keep the lenient "empty means unset" rule.
  */
-function resolveUser(parsed, env, file) {
-    const raw = parsed.user ?? env.SIGRUN_USER ?? file.user;
-    if (raw === undefined || raw.trim() === "")
+export function resolveUser(parsed, env, file) {
+    // The ambient chain: an empty/blank value means UNSET and the next
+    // source takes over (the pre-existing env→file semantics — only the
+    // explicit flag errors on empty).
+    const envUser = env.SIGRUN_USER?.trim() === "" ? undefined : env.SIGRUN_USER;
+    const fileUser = file.user?.trim() === "" ? undefined : file.user;
+    const raw = parsed.user ?? envUser ?? fileUser;
+    if (raw === undefined)
         return undefined;
     const derived = deriveUsername(raw);
     if (derived === undefined) {
@@ -677,7 +702,8 @@ async function runProviderCommand(parsed, env, io, fetchImpl, readSecret) {
  * - `token revoke` fails loud on an unknown id.
  */
 async function runIdentityCommand(parsed, env, io, isolationProbe) {
-    const stores = openIdentityStores(resolveStoreRoots(env));
+    const roots = resolveStoreRoots(env);
+    const stores = openIdentityStores(roots);
     if (parsed.command === "token") {
         switch (parsed.sub) {
             case "create": {
@@ -690,6 +716,17 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
                 }
                 const user = derived;
                 if (stores.users.get(user) === undefined) {
+                    // Fresh-eyes B2b: an ABSENT users.json means this CLI is
+                    // pointed at roots that have never been claimed — almost
+                    // always the host-vs-container trap (the claim happened in
+                    // the container's /data; the host CLI reads XDG roots), so
+                    // "add the user" is the wrong remedy. A PRESENT directory
+                    // without the user is a genuine unknown user.
+                    if (!existsSync(join(roots.configDir, "users.json"))) {
+                        throw new Error(`unknown user "${user}" — no user directory at ${roots.configDir}: this CLI's state roots hold no claimed install. ` +
+                            `If the server runs in a container, mint the token there (docker exec <ctr> sigrun token create …), ` +
+                            `or point this CLI at the same state roots (SIGRUN_CONFIG_DIR/SIGRUN_DATA_DIR) as the server.`);
+                    }
                     throw new Error(`unknown user "${user}" — add it first: sigrun user add ${user}`);
                 }
                 const { token } = await stores.tokens.create(parsed.tokenName, user);
@@ -810,15 +847,6 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
     // parseArgs guarantees one of the cases above.
     throw new Error(`unhandled ${parsed.command} subcommand`);
 }
-/**
- * The CLI-local mirror of the server's proxy-only rule (proxy-trust
- * Task 6): no token callers exist, so a setup-code prompt can never
- * be redeemed. Kept here rather than imported from src/server — the
- * CLI does not import server auth modules.
- */
-function isProxyOnly(methods) {
-    return methods.includes("proxy") && !methods.includes("token");
-}
 /**
  * The pre-launch onboarding flow (Task 7, spec §5.8): `attach`/`run`
  * ask the server its state; an UNCLAIMED server gets the interactive
@@ -830,7 +858,14 @@ function isProxyOnly(methods) {
  * old path and surfaces whatever the server says. A failed CLAIM is
  * loud (the server's error body, exit 1) — the operator re-runs.
  */
-async function onboardIfUnclaimed(server, prompt, fetchImpl) {
+export async function onboardIfUnclaimed(server, prompt, fetchImpl, 
+/**
+ * `loopbackVouch`: set by the `run` command — its companion boot is
+ * loopback-bound, so the claim redeems on the loopback vouch even
+ * though the (unauthenticated) methods list is the proxy-only
+ * fail-safe shape. Unset (attach) keeps the strict guard.
+ */
+opts) {
     let state;
     try {
         const response = await fetchImpl(`${server}/v1/onboarding`, {
@@ -846,6 +881,10 @@ async function onboardIfUnclaimed(server, prompt, fetchImpl) {
             const body = (await response.json().catch(() => undefined));
             if (body?.error !== "setup_required")
                 return undefined;
+            // The 403 carries no methods: the posture is unknown, so the
+            // dead-end guard stays armed (`[]` is proxy-only by definition —
+            // a stranger-facing server that hides its methods must not
+            // prompt for a setup code it may not accept).
             state = { state: "unclaimed", methods: [], codeRequired: true };
         }
         else {
@@ -858,10 +897,21 @@ async function onboardIfUnclaimed(server, prompt, fetchImpl) {
     }
     if (state.state !== "unclaimed")
         return undefined;
-    // Proxy-trust Task 6: a proxy-only server without a vouched identity
-    // refuses the claim (403 proxy_identity_required) and never mints a
-    // setup code — prompt for one and the operator can only lose.
-    if (isProxyOnly(state.methods) && state.codeRequired && state.proxyIdentity === undefined) {
+    // Proxy-trust Task 6 (+ polish task 12's parity ruling): a proxy-only
+    // server mints no redeemable setup code, so ANY CLI claim against it
+    // dead-ends — even a non-loopback deployment with NO proxy secret
+    // (the loopback peer vouches in that shape, so codeRequired is false,
+    // yet the claim 403s on own-host protection). The webui gates on
+    // codeRequired && no proxyIdentity alone; the CLI used to ALSO exempt
+    // that loopback case and prompt for a code the server then refuses
+    // with 403 proxy_identity_required. The CLI now gates exactly like
+    // the webui: a proxy-only server means onboarding happens in a
+    // browser, no exceptions. (The run-mode companion boot IS exempted:
+    // it binds loopback, which both drops codeRequired AND vouches the
+    // identity. Its methods are [] — proxy-only by the fail-safe — and
+    // the claim then succeeds on the loopback vouch.)
+    const methods = state.methods; // the ?? [] version-skew guard lives in isProxyOnly itself (fail-safe on unknown posture)
+    if (isProxyOnly(methods) && state.proxyIdentity === undefined && opts?.loopbackVouch !== true) {
         throw new Error("sigrun: this sigrun onboards through its sign-in proxy; open it in a browser");
     }
     let code;
@@ -965,6 +1015,12 @@ export async function cliMain(argv, env = process.env, deps, io = {
     }
     try {
         switch (parsed.command) {
+            case "help": {
+                // Help goes to the DATA sink (stdout): the operator asked for
+                // it, so exit 0 — only a usage ERROR prints to stderr + exit 1.
+                io.out?.(USAGE_TEXT);
+                return 0;
+            }
             case "serve": {
                 await realDeps.serve(env);
                 return 0;
@@ -1028,8 +1084,15 @@ export async function cliMain(argv, env = process.env, deps, io = {
                     const server = `http://localhost:${booted.port}`;
                     // Loopback onboarding (Task 7): no code (loopback is the trust);
                     // tui.json gains ONLY the user — workstation run stays
-                    // unauthenticated, so there is no token to keep.
-                    const onboarded = await onboardIfUnclaimed(server, prompt, fetchImpl);
+                    // unauthenticated, so there is no token to keep. The
+                    // loopbackVouch exemption (fresh-eyes A5): this boot's methods
+                    // are [] (unauthenticated loopback), which the dead-end guard
+                    // reads as proxy-only — but the claim HERE redeems on the
+                    // loopback vouch, so run mode must skip the guard or a fresh
+                    // `sigrun run` dead-ends on the proxy message.
+                    const onboarded = await onboardIfUnclaimed(server, prompt, fetchImpl, {
+                        loopbackVouch: true,
+                    });
                     if (onboarded !== undefined) {
                         await writeTuiFile({ user: onboarded.user }, env);
                     }

package/dist/curation/host.js

@@ -119,6 +119,7 @@ export function createCurationHost(deps) {
             let count = 0;
             let scanned = 0;
             let cursor;
+            let truncated = false;
             for (;;) {
                 const page = await conversation.entries(query, MODEL_CALLS_PAGE, cursor, BACKGROUND_CONTEXT);
                 for (const entry of page.items) {
@@ -129,13 +130,20 @@ export function createCurationHost(deps) {
                         continue;
                     count += 1;
                 }
-                if (page.next === undefined ||
-                    page.items.length === 0 ||
-                    scanned >= MODEL_CALLS_SCAN_LIMIT) {
+                if (page.next === undefined || page.items.length === 0)
+                    break;
+                if (scanned >= MODEL_CALLS_SCAN_LIMIT) {
+                    truncated = true;
                     break;
                 }
                 cursor = page.next;
             }
+            if (truncated) {
+                // Report, never truncate silently (the A9 ruling): the count
+                // is a LOWER bound — a review gated on it may fire early,
+                // and the operator must know the scan guard tripped.
+                console.warn(`curation: modelCallsSince(${String(id)}) hit the ${MODEL_CALLS_SCAN_LIMIT}-entry scan guard — the reported count ${count} is a lower bound (the conversation is longer)`);
+            }
             return count;
         },
         async takeHints(id) {
@@ -202,7 +210,9 @@ export function createCurationHost(deps) {
                 list: () => store.list(),
                 view: (name, file) => store.view(name, file),
                 feed: (limit, before) => store.feed(limit, before),
-                pin: (name, pinned) => store.pin(name, pinned),
+                pin: async (name, pinned) => {
+                    await store.pin(name, pinned);
+                },
                 undo: (entryIds) => store.undo(entryIds),
                 apply: (name, change, meta) => store.apply(name, change, {
                     actor: "curator",
@@ -301,25 +311,40 @@ export function createCurationHost(deps) {
         const conversation = await harness.conversation(runId, BACKGROUND_CONTEXT);
         if (conversation === undefined)
             return;
-        const page = await conversation.entries({ order: "ascending" }, 500, undefined, BACKGROUND_CONTEXT);
-        for (const entry of page.items) {
-            if (entry.kind !== "pi.tool-result")
-                continue;
-            for (const message of entry.model ?? []) {
-                if (message.role !== "toolResult")
-                    continue;
-                // SAFETY: the tool-result details carry the A6/A8
-                // `details.curation` shape ({changeId, summary}); the
-                // structural read below only touches those two fields.
-                const details = message.details;
-                const change = details?.curation;
-                if (change === undefined)
-                    continue;
-                const target = curation.byTool(message.toolName);
-                if (target === undefined)
+        // Cursor-complete walk (the A9 ruling): a run with more tool
+        // results than one page loses NOTHING — pages until exhaustion,
+        // bounded so a cursor bug cannot loop forever.
+        let cursor;
+        let scanned = 0;
+        for (;;) {
+            const page = await conversation.entries({ order: "ascending" }, 500, cursor, BACKGROUND_CONTEXT);
+            for (const entry of page.items) {
+                scanned += 1;
+                if (entry.kind !== "pi.tool-result")
                     continue;
-                await target.undo(user, change.changeId, { abortSignal: undefined });
+                for (const message of entry.model ?? []) {
+                    if (message.role !== "toolResult")
+                        continue;
+                    // SAFETY: the tool-result details carry the A6/A8
+                    // `details.curation` shape ({changeId, summary}); the
+                    // structural read below only touches those two fields.
+                    const details = message.details;
+                    const change = details?.curation;
+                    if (change === undefined)
+                        continue;
+                    const target = curation.byTool(message.toolName);
+                    if (target === undefined)
+                        continue;
+                    await target.undo(user, change.changeId, { abortSignal: undefined });
+                }
+            }
+            if (page.next === undefined || page.items.length === 0)
+                return;
+            if (scanned >= MODEL_CALLS_SCAN_LIMIT) {
+                console.warn(`curation: undoTargetChanges hit the ${MODEL_CALLS_SCAN_LIMIT}-entry scan guard on review ${reviewId} — target undos beyond the guard were NOT run`);
+                return;
             }
+            cursor = page.next;
         }
     }
     /** The run conversation carrying one reviewId (or undefined). */