@sigrun/sigrun 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -5,6 +5,84 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.0] - 2026-11-05
+
+### Added
+
+- Decision providers: a factory result's `decisionProviders` contributes typed-question models
+  (noul / choice / score) keyed in `auth.json` with a `credentialEnv` fallback; credentials write
+  through `PUT/DELETE /v1/providers/:id/credential` (a decision-only id re-reads readiness
+  instead of refreshing). `host.decisions.evaluate` (never throws; validated against the wire
+  schema and the model's limits; a 15 s deadline capped by `server.decisions.timeoutMs` /
+  `SIGRUN_DECISION_TIMEOUT_MS`), the `decisionModel` setting (live), decision entries with
+  `kind` + model ids on `GET /v1/providers`, a `decisions` projection on `GET /v1/meta`, and the
+  opt-in `decision_evaluate` tool (`decisions.tool`, default false). Docs:
+  "Contributing decision providers" in docs/extending.md.
+- `host.jobs.activeRun(conversationId)`: the job whose fire is CURRENTLY running in a
+  conversation (both fire shapes), with its effective owner — the unattended-run marker
+  extensions need to route destructive calls. Fixed-conversation fires settle their runs via the
+  submission's `job:` requestId (no meta stamp; a fire into an existing conversation does not
+  mark its later runs job-driven).
+- `host.models.complete(input)`: one-shot chat completions for extensions (no conversation);
+  explicit model → `namingModel` → default, `role: "utility"`, a 60 s default timeout, both the
+  timer and the caller's signal bounding the wait.
+- Declinable interaction records: `declinable: true` marks a pending record declinable;
+  `POST /v1/conversations/:id/interactions/:callId/decline` (write access) settles it
+  `skipped` with `declinedVia: "button"` (404 `no_such_interaction` / 404 `not_pending` /
+  409 `not_declinable`); `host.declineInteraction(conversationId, callId, context, {user})`
+  is the extension-side peer; `interactionSettled` payloads carry `declinedVia`. Declining
+  sweeps the record's unread secret delivery inside the same commit.
+- Interactive tools: a factory result's `interactiveTools` names the registered tools that
+  need a human present. Core hides them in job-run conversations (`conversation: "new"`
+  fires, `host.conversations.create({job})`) and curator runs (digest agents exclude them;
+  every run's `allow` list loses them with one warning; fork reviews keep them listed for
+  prompt-cache parity and the gate blocks a call instead). `host.jobs.isJobRun` tells an
+  interactive tool's execute whether the current run is job-driven (a job firing into an
+  existing conversation is not covered by the creation-time filter — refuse there).
+
+## [0.8.0] - 2026-11-04
+
+Core notices: a per-user notice system for extensions. An extension posts a short notice
+(title, body, tone, up to 3 actions) to ONE directory user; only that user ever sees it,
+by route or by event; it clears on dismiss, the user's own next prompt in the conversation,
+acting on it, clear-all, eviction past the caps, or deleting the user (the file is removed
+and a re-created username starts empty). Notices are transient by design — nothing expires
+on a timer.
+
+### Core
+
+- `host.notices` (`post`/`clear`/`list`, extension-scoped keys, capped 10 per extension and
+  50 per user), the `noticeActions` factory field (handlers run with the clicker's
+  principal, idempotent, 10s timeout, dedup + rate limit reusing the surface-action
+  primitives), `/v1/notices` routes (404-never-403 for foreign ids; `GET` prunes notices
+  whose conversation share was revoked), and the user-only `notice.changed` event.
+- Storage: one stamped, atomically-written `notices.json` per user under
+  `<dataDir>/users/<user>/` (backup-archived by the existing `data` section); invalid
+  entries are dropped on load; the agent sandbox cannot write it.
+- Ambient `navigate`/`open` buttons work in the web UI (the no-op dispatcher is gone;
+  `open` uses `noopener noreferrer`).
+
+### Web UI
+
+- Bell with a count (rail on desktop, every tab's header on phones), a notices pane
+  (docked right panel on Chats, overlay on other tabs, full-height sheet on phones),
+  inline notices above the composer (max 3, then "N more"), and a 6s peek (pause on
+  hover, arrivals merge, none for an on-screen conversation's notice or while the tab
+  is hidden).
+
+### TUI
+
+- Inline notice line above the editor, `notices:N` in the status bar, and an overlay
+  with dismiss, Clear-all-free navigation, and the buttons (`open` prints the URL; no
+  peek — the count is the announcement).
+
+### Companions
+
+- ext-curator 0.3.0 (published first): the "Learned: …" review notice moved onto core
+  notices with Undo as an extension action on the notice; ext-gateway 0.1.16 widened its
+  `@sigrun/shared` peer to the 0.8.0 line (0.1.15 is a dead scar — tagged before its fake
+  host carried `SigrunHost.notices`, CI failed against core main).
+
 ## [0.7.0] - 2026-11-04
 
 The polish pass: three waves of behaviour fixes, the full deferred-minors sweep, and a
@@ -48,65 +126,6 @@ fresh-eyes clean-room install verification.
 
 - Release-pin bump to 0.6.1 (root, shared, tui, sandbox platform packages, chart appVersion, compose defaults).
 
-## [Unreleased]
-
-### Added
-- **Views are tabs (webui).** The webui shell registers views as rail
-  tabs with remembered routes; the chat view keeps the conversation
-  list and right panel to itself. Below the tablet breakpoint a phone
-  bottom tab bar (with a More sheet) replaces the rail.
-- **`page.selection`** — a server-declared, presentation-only
-  list-first drill-in for compact widths (`{selected, back}` on a
-  `page`; webui and TUI render it, `toText` ignores it).
-- **Core views.** Core attaches its own view surfaces under the
-  reserved `core` slug and lists them as `coreViews` (one
-  `CoreViewInfo {id, title, icon, refreshMs?}` per view) on
-  `/v1/extensions` and `/v1/meta`; they are never `extensions[]` rows,
-  so the health dot is unaffected. `job.changed` now bumps every
-  rendered core/jobs instance.
-- **The Jobs tab** (`core/jobs`): the jobs surface as a core blocks
-  view — sidebar of the caller-visible jobs, drill-in with summary,
-  paged runs and revisions (a selected revision diffs its spec JSON
-  against the previous one), Run now / Reset state for write access,
-  and per-row navigation into a run's conversation. The Jobs panel is
-  gone.
-- **The Skills tab** (`core/skills`): every skill root the deployment
-  serves — Workspace / Learned / Config dir (the deployment-wide
-  `<config-dir>/skills/`, read-only) / one group per installed package
-  (`· <pkg>`, with a per-row package badge) / Deleted — with shadowing visible, owned-skill CRUD, per-skill git
-  history (25 entries per page, per-file diffs, restore), deleted-skill
-  restore, and per-user overlays as the only write to the read-only
-  shared roots. Some surface actions return `navigate`; the webui
-  applies that navigation, the TUI does not yet (a known channel gap).
-- **Every-root skill discovery** (`src/skills/roots.ts`): workspace,
-  learned, user dir, and every installed package's skills listed in one
-  pass, with precedence/shadowing resolution and symlink-safe reads.
-- **GitHistory** (`src/history/git.ts`) — isolated local git for
-  sigrun-owned history stores: execFile with explicit `--git-dir` /
-  `--work-tree`, a hermetic git env, per-repo locking, and fail-soft
-  writes (a broken repo is quarantined aside and re-initialized;
-  mutations never fail because history did).
-- **Curation stores on git** (Task 9): each user's learned skills,
-  overlays, and curator state live in a per-user git history repo; the
-  change feed's `actor` widens to `"outside"` and its `id`/`before`/
-  `after` are commit SHAs. A once-per-process migration imports the
-  pre-git store (the legacy files are left read-only, outside the
-  repo's pathspec).
-- **Workspace skills history** (Task 10): the workspace `skills/`
-  tree gets its own per-user repo (git dir outside the work tree),
-  caught up on settled runs and tab opens; ownerless conversations
-  skip it.
-
-### Changed
-- **The curation seal**: workspaces and grants that sit inside or
-  contain a user's `curation/` tree are rejected; boot revalidates
-  stored records and names each failing one loudly. A user whose
-  workspace was the bare user area loses agent tools until an admin
-  re-points it: `PATCH /v1/users/<u> {"workspace": "<userArea>/workspace"}`.
-  History tamper-resistance holds under active sandbox isolation; a
-  single-user install without isolation runs the agent unsandboxed
-  (the existing trust model).
-
 ## [0.6.0] - 2026-11-02
 
 ### Added

package/README.md

@@ -1299,6 +1299,34 @@ curl -X PATCH localhost:3000/v1/users/<u> \
   -d '{"workspace": "<userArea>/workspace"}'
 ```
 
+## Notices
+
+A **notice** is a short message from an extension aimed at you alone:
+a title, a line or two of text, and up to three buttons (open a view,
+open a link, or run an action such as Undo) — the curator's
+"Learned: …" line is the first one you will see. Notices are per-user,
+never shared, and never copied into a fork. The **bell** —
+at the top of the rail on desktop, in the tab header on phones, and as
+a count in the TUI's status bar — opens the **notices pane**: a docked
+panel on the Chats tab and a slide-over on every other tab, newest
+first, with ✕ per notice and a Clear all. A conversation's own notices
+appear inline above the composer, and a new one **peeks** by the bell
+for six seconds (not when its conversation is already on screen),
+staying put while you hover it — several arriving
+together merge into "N new notices". In the TUI the newest notice for
+the open conversation (else the newest app-wide one) is a line above
+the editor (`alt+d` standard, `gx` vim, `M-d` emacs dismisses it), the
+status bar carries the count, and the overlay opens with `ctrl+g`
+(standard), `gN` (vim), or `M-N` (emacs).
+
+What clears a notice: its ✕, **your next prompt in that conversation**,
+a button that navigates or opens a link, an extension button that
+succeeds, Clear all, the extension that posted it, or — when the pile
+outgrows 10 notices from one extension or 50 in total — eviction of the
+oldest. Nothing expires on a timer, and another user's prompt never
+clears yours. A revoked share drops that conversation's notices on
+your next read; an archived conversation keeps its own.
+
 ## Jobs
 
 A job is a schedule plus an action, durable by construction — one
@@ -1440,6 +1468,10 @@ curl -X POST -H "Authorization: Bearer $TOKEN" \
   (SSE streaming views included). A submission body is
   `{"input": "..."}` (or a `{"input": [parts]}` array of
   text/image/file content parts).
+- `GET /v1/notices`, `POST /v1/notices/{id}/dismiss`,
+  `POST /v1/notices/dismiss-all`,
+  `POST /v1/notices/{id}/actions/{actionId}` — the caller's own notices
+  (see [Notices](#notices)); a foreign id answers 404.
 - `GET /v1/providers` — per-provider readiness, statuses only (never
   credentials); `GET /v1/auth/check` is the deprecated alias.
 - `GET /v1/onboarding`, `POST /v1/onboarding/claim` — the unclaimed

package/dist/config.js

@@ -20,6 +20,28 @@ import { deriveUsername, isUsernameKey } from "@sigrun/shared/usernames";
 export const DEFAULT_MODEL_ENV = "SIGRUN_DEFAULT_MODEL";
 /** Deprecated alias for {@link DEFAULT_MODEL_ENV} (warns once per boot). */
 export const DEPRECATED_MODEL_ENV = "SIGRUN_MODEL";
+/**
+ * The published-hook call deadline (knowledge C7, Task 2):
+ * `SIGRUN_PUBLISHED_HOOK_DEADLINE`, over the file's
+ * `server.publishedHookDeadlineMs`, default 30000 ms. Its own knob, NOT
+ * the memory-seam `SIGRUN_HOOK_DEADLINE` (hook calls can sit on the
+ * reply path; the memory knob tunes background handlers). A positive
+ * integer; `parseMemorySeamCount`'s posture (fail loud, `""` is unset).
+ */
+export const PUBLISHED_HOOK_DEADLINE_ENV = "SIGRUN_PUBLISHED_HOOK_DEADLINE";
+/** The published-hook deadline default (30 s). */
+export const DEFAULT_PUBLISHED_HOOK_DEADLINE_MS = 30_000;
+/**
+ * The decision-provider call timeout (warden Task 6):
+ * `SIGRUN_DECISION_TIMEOUT_MS`, over the file's
+ * `server.decisions.timeoutMs`, default 15000 ms — both the default AND
+ * the cap for one `host.decisions.evaluate` call (`min(timeoutMs, cap)`).
+ * A positive integer; `parseMemorySeamCount`'s posture (fail loud,
+ * `""` is unset).
+ */
+export const DECISION_TIMEOUT_ENV = "SIGRUN_DECISION_TIMEOUT_MS";
+/** The decision timeout default (15 s). */
+export const DEFAULT_DECISION_TIMEOUT_MS = 15_000;
 /** The provider id used when the model spec carries no `provider/` prefix. */
 export const DEFAULT_PROVIDER = "openai";
 /**
@@ -820,6 +842,8 @@ export function resolvedServerSection(config) {
         ...(webui === undefined ? {} : { webui }),
         compaction: { ...config.compaction },
         memorySeam: { ...config.memorySeam },
+        publishedHookDeadlineMs: config.publishedHookDeadlineMs,
+        decisions: { ...config.decisions },
         isolation: { ...config.isolation },
         providers: { ...config.providers },
         ...(auth === undefined ? {} : { auth }),
@@ -860,6 +884,8 @@ export function resolvedServerSection(config) {
  * | `SIGRUN_IDLE_THRESHOLD` | `memorySeam.idleThresholdMs` |
  * | `SIGRUN_WORKER_DEADLINE` | `memorySeam.workerDeadlineMs` |
  * | `SIGRUN_QUEUE_MAX` | `memorySeam.queueMax` |
+ * | `SIGRUN_PUBLISHED_HOOK_DEADLINE` | `publishedHookDeadlineMs` |
+ * | `SIGRUN_DECISION_TIMEOUT_MS` | `decisions.timeoutMs` |
  * | `SIGRUN_ISOLATION` | `isolation.mode` |
  * | `SIGRUN_PROVIDER_REFRESH_MINUTES` | `providers.refreshIntervalMinutes` |
  * | `SIGRUN_BACKUP_*` | `backup` |
@@ -917,6 +943,14 @@ export function envServerSection(env) {
     });
     if (memorySeam !== undefined)
         section.memorySeam = memorySeam;
+    const publishedHookDeadlineMs = parseMemorySeamCount(env, PUBLISHED_HOOK_DEADLINE_ENV);
+    if (publishedHookDeadlineMs !== undefined) {
+        section.publishedHookDeadlineMs = publishedHookDeadlineMs;
+    }
+    const decisionTimeoutMs = parseMemorySeamCount(env, DECISION_TIMEOUT_ENV);
+    if (decisionTimeoutMs !== undefined) {
+        section.decisions = { timeoutMs: decisionTimeoutMs };
+    }
     const isolationMode = parseIsolationMode(env);
     if (isolationMode !== undefined)
         section.isolation = { mode: isolationMode };
@@ -1020,6 +1054,11 @@ export function effectiveServerSection(env, fileServer, config) {
         "memorySeam",
         "queueMax",
     ]);
+    emit("publishedHookDeadlineMs", config.publishedHookDeadlineMs, ["publishedHookDeadlineMs"]);
+    emit("decisions.timeoutMs", config.decisions.timeoutMs, [
+        "decisions",
+        "timeoutMs",
+    ]);
     emit("auth.sessionDays", config.auth.sessionDays, ["auth", "sessionDays"]);
     emit("isolation.mode", config.isolation.mode, ["isolation", "mode"]);
     emit("isolation.osUsers", config.isolation.osUsers, ["isolation", "osUsers"]);
@@ -1173,6 +1212,14 @@ export function loadConfig(env, settingsFile) {
         backupStaleAfterHours: server?.backup?.staleAfterHours ?? DEFAULT_BACKUP_STALE_AFTER_HOURS,
         compaction: parseCompaction(env, server?.compaction),
         memorySeam: parseMemorySeam(env, server?.memorySeam),
+        publishedHookDeadlineMs: parseMemorySeamCount(env, PUBLISHED_HOOK_DEADLINE_ENV) ??
+            server?.publishedHookDeadlineMs ??
+            DEFAULT_PUBLISHED_HOOK_DEADLINE_MS,
+        decisions: {
+            timeoutMs: parseMemorySeamCount(env, DECISION_TIMEOUT_ENV) ??
+                server?.decisions?.timeoutMs ??
+                DEFAULT_DECISION_TIMEOUT_MS,
+        },
         isolation: parseIsolation(env, server?.isolation),
         providers: {
             refreshIntervalMinutes: parseRefreshIntervalMinutes(env, server?.providers?.refreshIntervalMinutes),

package/dist/curation/host.js

@@ -25,6 +25,8 @@ import { digestRunRun, forkReviewRun, setChangeTargetResolver } from "./runs.js"
 import { resolveUpstream } from "./overlays.js";
 import { jobSkillRefs } from "../jobs/skills-refs.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
+/** Per-target bound for one `wantsReview` answer (C5). */
+const WANTS_REVIEW_BOUND_MS = 2000;
 /** modelCallsSince's entry-page size (cursor-walked, never a cap). */
 const MODEL_CALLS_PAGE = 500;
 /** Scan bound for the cursor walk: a broken cursor loops, a count does not. */
@@ -62,7 +64,14 @@ export function createCurationHost(deps) {
      */
     const digestFor = async (user, input, tools, deadline) => {
         const remaining = Math.max(1, deadline - Date.now());
-        return await digestRunRun({ harness, registry }, user, {
+        const runDeps = {
+            harness,
+            registry,
+            ...(deps.interactiveTools === undefined
+                ? {}
+                : { interactiveTools: deps.interactiveTools }),
+        };
+        return await digestRunRun(runDeps, user, {
             instruction: input,
             allow: tools,
             maxToolCalls: 8,
@@ -151,37 +160,83 @@ export function createCurationHost(deps) {
             return await takeHints(conversation, BACKGROUND_CONTEXT);
         },
         async targets(user, id) {
-            // The selection filter: a target is served for a conversation
-            // only when EVERY listed tool is model-visible in that
-            // conversation's resolved agent. No id: every target.
-            const visible = id === undefined ? undefined : await modelVisibleTools(id);
-            const result = [];
-            for (const target of curation.targets()) {
-                if (visible !== undefined) {
-                    if (target.tools.some((tool) => !visible.has(tool)))
-                        continue;
+            // The projection drops the C5 callbacks (the info is data —
+            // readTools rides only when the target declared it).
+            return (await servedTargets(user, id)).map((target) => ({
+                id: target.id,
+                tools: target.tools,
+                ...(target.readTools.length === 0
+                    ? {}
+                    : { readTools: target.readTools }),
+                guidance: target.guidance,
+                maintain: target.maintain,
+            }));
+        },
+        async wantsReview(user, id) {
+            // C5: any ONE served target requesting a review is enough. Each
+            // target's answer is bounded — a throw or a slow target counts
+            // as `false` with one log line naming the target (the review
+            // loop must never stall on one target's clock).
+            for (const target of await servedTargets(user, id)) {
+                if (target.wantsReview === undefined)
+                    continue;
+                let wants = false;
+                try {
+                    wants = await bounded(Promise.resolve(target.wantsReview(user, id)));
                 }
-                const guidance = await target.guidance(user);
-                if (guidance.length === 0)
+                catch (error) {
+                    console.warn(`curation: wantsReview of ${target.id} failed: ${error instanceof Error ? error.message : String(error)}`);
                     continue;
-                result.push({
-                    id: target.id,
-                    tools: [...target.tools],
-                    guidance: [...guidance],
-                    maintain: target.maintain !== undefined,
-                });
+                }
+                if (wants === true)
+                    return true;
             }
-            return result;
+            return false;
         },
         async tools(id) {
             const visible = await modelVisibleTools(id);
             return [...visible];
         },
         async forkReview(id, opts) {
-            return await forkReviewRun({ harness, registry }, id, opts);
+            const result = await forkReviewRun({
+                harness,
+                registry,
+                ...(deps.interactiveTools === undefined
+                    ? {}
+                    : { interactiveTools: deps.interactiveTools }),
+            }, id, opts);
+            // C5: after a COMPLETED review, tell every served target the
+            // review consumed its hints — the target's signal to retire
+            // them (errors caught and logged; a target never blocks the
+            // result). Owner read from the conversation's SessionMetaDoc,
+            // as the run driver does; other statuses and an ownerless
+            // conversation fire nothing.
+            if (result.status !== "completed")
+                return result;
+            const meta = await harness.snapshot(SessionMetaDoc, id, BACKGROUND_CONTEXT);
+            const owner = meta?.owner;
+            if (owner === undefined)
+                return result;
+            for (const target of await servedTargets(owner, id)) {
+                if (target.reviewed === undefined)
+                    continue;
+                try {
+                    await target.reviewed(owner, id);
+                }
+                catch (error) {
+                    console.warn(`curation: reviewed of ${target.id} failed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            return result;
         },
         async digestRun(user, opts) {
-            return await digestRunRun({ harness, registry }, user, opts, deps.defaultModel, deps.defaultAgent);
+            return await digestRunRun({
+                harness,
+                registry,
+                ...(deps.interactiveTools === undefined
+                    ? {}
+                    : { interactiveTools: deps.interactiveTools }),
+            }, user, opts, deps.defaultModel, deps.defaultAgent);
         },
         async maintain(user, targetId, budget) {
             const target = curation
@@ -280,6 +335,55 @@ export function createCurationHost(deps) {
         const agent = await conversation.agent(BACKGROUND_CONTEXT);
         return new Set(agent.tools.map((tool) => tool.name));
     }
+    /**
+     * The targets served for `(user, id)`: the selection filter (every
+     * listed tool — `tools` AND `readTools` — model-visible) and the
+     * guidance filter (`[]` = unavailable for the user), projected for
+     * the caller. No id: every target (selection-independent).
+     */
+    async function servedTargets(user, id) {
+        const visible = id === undefined ? undefined : await modelVisibleTools(id);
+        const result = [];
+        for (const target of curation.targets()) {
+            if (visible !== undefined) {
+                if (target.tools.some((tool) => !visible.has(tool)))
+                    continue;
+                if ((target.readTools ?? []).some((tool) => !visible.has(tool))) {
+                    continue;
+                }
+            }
+            const guidance = await target.guidance(user);
+            if (guidance.length === 0)
+                continue;
+            result.push({
+                id: target.id,
+                tools: [...target.tools],
+                readTools: [...(target.readTools ?? [])],
+                guidance: [...guidance],
+                maintain: target.maintain !== undefined,
+                ...(target.wantsReview === undefined
+                    ? {}
+                    : { wantsReview: target.wantsReview }),
+                ...(target.reviewed === undefined
+                    ? {}
+                    : { reviewed: target.reviewed }),
+            });
+        }
+        return result;
+    }
+    /** Bound one target answer at the C5 deadline; rejects past it. */
+    async function bounded(answer) {
+        return await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => reject(new Error("wantsReview timed out")), WANTS_REVIEW_BOUND_MS);
+            answer.then((value) => {
+                clearTimeout(timer);
+                resolve(value === true);
+            }, (error) => {
+                clearTimeout(timer);
+                reject(error instanceof Error ? error : new Error(String(error)));
+            });
+        });
+    }
     /** The feed entries one review caused (newest-first walk). */
     async function feedOf(store, reviewId) {
         const found = [];

package/dist/curation/runs.js

@@ -42,6 +42,7 @@ import { ensureRequestId, recordAuthor } from "./attribution.js";
 import { isInternal, markInternal } from "./internal.js";
 import { curationRun, CurationRunDoc } from "./run-doc.js";
 import { CURATION_GATE_EXTENSION } from "./gate.js";
+import { excludeInteractiveTools, withoutInteractive, } from "../harness/interactive-tools.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
 /** The target-id resolver for collected changes (the host installs it). */
 let targetOfTool = (tool) => tool === "skill_manage" ? "sigrun.skills" : `tool:${tool}`;
@@ -495,7 +496,12 @@ async function answerText(conversation, answer) {
  * when the parent refuses.
  */
 export async function forkReviewRun(deps, id, opts) {
-    checkRunOpts(opts);
+    // Ask-user Task 3: the allow list loses interactive tools BEFORE the
+    // non-empty check (an all-interactive list still fails loudly, with
+    // the strip warning logged first). Fork reviews KEEP them listed
+    // (cache parity) — the gate blocks a call instead.
+    const allow = withoutInteractive(opts.allow, deps.interactiveTools ?? new Set(), console.warn, "fork review");
+    checkRunOpts({ ...opts, allow });
     const { harness } = deps;
     const parent = await harness.conversation(id, BACKGROUND_CONTEXT);
     if (parent === undefined) {
@@ -537,7 +543,7 @@ export async function forkReviewRun(deps, id, opts) {
             const doc = await tx.doc(CurationRunDoc, forkId);
             doc.user = owner;
             doc.reviewId = opts.reviewId;
-            doc.allow = [...opts.allow];
+            doc.allow = [...allow];
             doc.parent = id;
             // The fork's copied meta carries the parent's sharing; an
             // internal run is nobody's shared copy (A2's invisibility
@@ -561,7 +567,8 @@ export async function forkReviewRun(deps, id, opts) {
  * default + gate, same run doc and driver.
  */
 export async function digestRunRun(deps, user, opts, defaultModel, defaultAgent) {
-    checkRunOpts(opts);
+    const allow = withoutInteractive(opts.allow, deps.interactiveTools ?? new Set(), console.warn, "digest run");
+    checkRunOpts({ ...opts, allow });
     const { harness } = deps;
     const conversation = await harness.createConversation({
         ownership: { kind: "ownerless" },
@@ -576,10 +583,14 @@ export async function digestRunRun(deps, user, opts, defaultModel, defaultAgent)
         },
         init: async (tx, id) => {
             await markInternal(tx, id, user);
+            // Ask-user Task 3: the digest conversation's fresh agent
+            // selection loses the interactive tools (the tool is never
+            // listed, so the model never tries).
+            await excludeInteractiveTools(tx, id, deps.interactiveTools ?? new Set());
             const doc = await tx.doc(CurationRunDoc, id);
             doc.user = user;
             doc.reviewId = opts.reviewId;
-            doc.allow = [...opts.allow];
+            doc.allow = [...allow];
         },
     }, BACKGROUND_CONTEXT);
     return await driveRun(deps, async () => conversation, { ...opts, instruction: opts.input });