tickmarkr 1.87.0 → 1.89.0

package/dist/adapters/catalog.d.ts

@@ -1,11 +1,20 @@
 import { z } from "zod";
-import type { WorkerAdapter } from "./types.js";
+import { type WorkerAdapter } from "./types.js";
 export declare const CLI_NAME_RE: RegExp;
 export declare const MODEL_ID_FIELDS: readonly ["id", "selector", "model"];
 export type ModelIdField = (typeof MODEL_ID_FIELDS)[number];
+export declare const DRIVE_TRUST_DIALOG_MESSAGE = "drive contract must declare trustDialog \u2014 either the workspace-trust prompt this CLI renders, captured verbatim as {fingerprint, key}, or {kind: none, reason}";
 export declare const CliDriveSchema: z.ZodObject<{
     headless: z.ZodString;
     interactive: z.ZodNullable<z.ZodString>;
+    trustDialog: z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodOptional<z.ZodLiteral<"dialog">>;
+        fingerprint: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"none">;
+        reason: z.ZodString;
+    }, z.core.$strict>]>;
     listModels: z.ZodOptional<z.ZodObject<{
         argv: z.ZodArray<z.ZodString>;
         parser: z.ZodEnum<{
@@ -35,6 +44,14 @@ export declare const CliEntrySchema: z.ZodObject<{
     drive: z.ZodOptional<z.ZodObject<{
         headless: z.ZodString;
         interactive: z.ZodNullable<z.ZodString>;
+        trustDialog: z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodOptional<z.ZodLiteral<"dialog">>;
+            fingerprint: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"none">;
+            reason: z.ZodString;
+        }, z.core.$strict>]>;
         listModels: z.ZodOptional<z.ZodObject<{
             argv: z.ZodArray<z.ZodString>;
             parser: z.ZodEnum<{

package/dist/adapters/catalog.js

@@ -10,6 +10,7 @@ import { grok } from "./grok.js";
 import { kimi } from "./kimi.js";
 import { opencode } from "./opencode.js";
 import { pi } from "./pi.js";
+import { TRUST_DIALOG_VARIANTS, TrustDialogSchema } from "./types.js";
 export const CLI_NAME_RE = /^[a-z0-9-]+$/;
 // `field` names the ONE key projected out of an array of objects — a model id and nothing else.
 // `{"models":[{…}]}` is the normal shape of a modern CLI's --json output, and without a selector the
@@ -29,9 +30,19 @@ const ListModelsSchema = z.object({
         ctx.addIssue({ code: "custom", path: ["field"], message: "field is only read by the json parser" });
     }
 });
+// v1.89 T1 / OBS-414: a drive contract declares its trust posture or it is not a drive contract.
+// `declarativeAdapter()` builds every catalog-driven CLI, so a contract without this field would
+// reintroduce the silent opt-out at the one construction site no adapter file covers. Absence gets
+// its own operator sentence; a malformed declaration keeps the union's own diagnosis.
+// Quote-free by construction: a zod issue reaches the operator as a JSON dump, where an embedded
+// double quote is escaped and no longer reads back as the sentence that was written.
+export const DRIVE_TRUST_DIALOG_MESSAGE = "drive contract must declare trustDialog — either the workspace-trust prompt this CLI renders, captured verbatim as {fingerprint, key}, or {kind: none, reason}";
 export const CliDriveSchema = z.object({
     headless: z.string().min(1),
     interactive: z.string().min(1).nullable(),
+    trustDialog: z.union(TRUST_DIALOG_VARIANTS, {
+        error: (issue) => (issue.input === undefined ? DRIVE_TRUST_DIALOG_MESSAGE : undefined),
+    }),
     listModels: ListModelsSchema.optional(),
 }).strict().superRefine((drive, ctx) => {
     for (const [field, template] of [["headless", drive.headless], ["interactive", drive.interactive]]) {
@@ -82,6 +93,14 @@ function validateCliEntry(entry) {
     if (drive.adapter.id !== base.id || drive.adapter.vendor !== base.vendor) {
         throw new Error(`native drive identity mismatch for ${base.id}`);
     }
+    // v1.89 T1 / OBS-414: native adapters carry their declaration in code, so the compiler enforces
+    // PRESENCE — it cannot enforce that the bytes are a real capture. The same schema the drive
+    // contract uses runs here, on the registry's own construction path, so a blank fingerprint or a
+    // prompt that is not a workspace-trust gate is unbuildable from either side of the catalog.
+    const trust = TrustDialogSchema.safeParse(drive.adapter.trustDialog);
+    if (!trust.success) {
+        throw new Error(`invalid trust declaration for ${base.id}: ${trust.error.issues.map((i) => i.message).join("; ")}`);
+    }
     return { ...base, drive };
 }
 // Package-owned, deterministic order. This is the sole shipped definition array: candidate-name
@@ -103,7 +122,31 @@ export const CLI_CATALOG = [
     native(pi, "pi"),
     native(grok, "grok"),
     native(kimi, "kimi"),
-    "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush", "omp",
+    "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush",
+    {
+        id: "omp",
+        binary: "omp",
+        // PROBE-omp-v189.md, re-recorded by hand 2026-08-07: `omp --version` → `omp/17.2.10`.
+        // A prefix match, so a patch bump does not re-open the identity gate.
+        identity: "^omp/",
+        // omp is a multi-provider gateway; a selected model carries its real vendor in its own prefix.
+        vendor: "mixed",
+        drive: {
+            // The same probe recorded -p as the fail-closed print mode (exit 1 on an unknown model).
+            // interactive deliberately omits it: `interactive` is nullable and `headless` is required, so
+            // the invisible configuration is the easier one to write — this one is written visible.
+            headless: "omp -p --model {model} @{promptFile}",
+            interactive: "omp --model {model} @{promptFile}",
+            trustDialog: {
+                kind: "none",
+                reason: "omp 17.2.10 showed no workspace-trust prompt during the recorded interactive probe (PROBE-omp-v189.md, 2026-08-07)",
+            },
+            // The recorded payload is an OBJECT keyed by models: 370 entries, selector prefixed 370/370
+            // and the neighbouring bare `id` prefixed 0/370. Projecting `id` would return 370 plausible
+            // ids that route to nothing, so the selector is the only id key this contract may name.
+            listModels: { argv: ["models", "ls", "--json"], parser: "json", path: "models", field: "selector" },
+        },
+    },
 ].flatMap((entry) => typeof entry === "string"
     ? [{ id: entry, binary: entry, identity: ".+", vendor: null }]
     : [entry]);

package/dist/adapters/fake.d.ts

@@ -1,6 +1,6 @@
 import type { TickmarkrConfig } from "../config/config.js";
 import type { Task } from "../graph/schema.js";
-import { type Assignment, type AuthHealth, type BillingChannel, type ContextUsage, type Invocation, type SessionRef, type TokenUsage, type WorkerAdapter, type WorkerResult } from "./types.js";
+import { type Assignment, type AuthHealth, type BillingChannel, type ContextUsage, type Invocation, type SessionRef, type TokenUsage, type TrustDialog, type WorkerAdapter, type WorkerResult } from "./types.js";
 export interface FakeScript {
     tasks: Record<string, Array<{
         shell: string;
@@ -25,6 +25,7 @@ export declare class FakeAdapter implements WorkerAdapter {
     private scriptPath;
     id: string;
     vendor: string;
+    trustDialog: TrustDialog;
     private script;
     private attempts;
     constructor(scriptPath: string);

package/dist/adapters/fake.js

@@ -7,6 +7,13 @@ export class FakeAdapter {
     scriptPath;
     id = "fake";
     vendor = "fake-a";
+    // v1.89 T1 / OBS-414: the scripted adapter runs `bash -c` — it has no TUI, so no prompt of any
+    // kind can render. Daemon tests that exercise the auto-answer seam assign a captured declaration
+    // to this field explicitly; that assignment is the falsifier for the claim made here.
+    trustDialog = {
+        kind: "none",
+        reason: "the zero-token scripted adapter dispatches a bash command and renders no TUI, so no trust prompt exists to capture",
+    };
     script;
     attempts = new Map();
     constructor(scriptPath) {

package/dist/adapters/grok.js

@@ -114,6 +114,17 @@ export const grok = {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },
     parse: parseWorkerResult, // prompt.ts — last-valid-trailer, hard-wrap tolerant. No grok fork.
+    // v1.89 T1 / OBS-414: no capture exists, so none is invented. grok 0.2.93 has never been observed
+    // rendering a workspace/folder-trust prompt: it loads the operator's global Claude-Code-compat
+    // config rather than keeping a per-directory trust store, and no grok dispatch in any recorded run
+    // has stalled before launch (OBS-414's own sweep lists grok's gap as MCP suppression, not trust).
+    // FALSIFIER, and it is cheap: dispatch grok into a never-seen worktree and read the pane. One
+    // capture of a trust prompt replaces this with {fingerprint, key} — the capture is the only
+    // admissible evidence, and a guess here would press a key on whatever it happened to match.
+    trustDialog: {
+        kind: "none",
+        reason: "grok 0.2.93 keeps no per-directory trust store and no recorded pane shows it rendering a workspace-trust prompt; falsified by one capture from a fresh worktree",
+    },
     // v1.5 MODEL-01: fail OPEN to [] (advisory detection, unlike gates). Parses the model LIST only —
     // the auth banner on line 1 is ignored BY CONSTRUCTION (parseGrokModels anchors on the header).
     // Advisory/doctor-only — never in the dispatch or auth path (types.ts:56-60).

package/dist/adapters/kimi.d.ts

@@ -1,5 +1,5 @@
 import type { ExecutorDriver, Slot } from "../drivers/types.js";
-import { type Assignment, type WorkerAdapter, type WorkerResult } from "./types.js";
+import { type Assignment, type TrustDialog, type WorkerAdapter, type WorkerResult } from "./types.js";
 export declare function kimiAuthed(credentialsText: string, nowMs: number): boolean;
 export declare function parseKimiModels(raw: string): string[];
 export declare function parseKimiResult(raw: string, nonce: string): WorkerResult;
@@ -32,6 +32,7 @@ export interface KimiInteractiveSeedResult {
     sessionId?: string;
 }
 export declare const KIMI_INPUT_BOX: import("./types.js").InputBox;
+export declare const KIMI_TRUST_DIALOG: TrustDialog;
 export declare function runKimiInteractiveSeed(opts: {
     driver: Pick<ExecutorDriver, "run" | "waitOutput" | "read">;
     slot: Slot;

package/dist/adapters/kimi.js

@@ -234,6 +234,34 @@ const KIMI_SEED = {
             : confirmation;
     },
 };
+// v1.89 T1 / OBS-414: the dialog that cost run …215 thirty minutes. Kimi records trust PER FOLDER
+// (~/.kimi-code/workspaces.json), and tickmarkr recreates a worktree on every attempt, so every kimi
+// dispatch after the first meets a brand-new path and a brand-new prompt. Neither `-y/--yolo` (tool
+// calls) nor `--auto` (agent questions) covers it: the gate is raised before the agent loop.
+//
+// VERBATIM CAPTURES, read off live panes — never composed (v1.79 law). Each is quoted from the
+// record that holds the FULLEST transcription of it, named here so a reviewer reads the same bytes:
+//   OBS-358, pane wW:p2TB, run-20260805-121252 (.overseer/REPAIR-v186/GATE-T28-1.md — five lines;
+//   .planning/OBSERVATIONS.md abridges the same capture to its first three):
+//     Trust this folder?
+//       /Users/…/.tickmarkr/worktrees.noindex/tickmarkr-run-20260805-121252--T29
+//     ❯ Trust this folder     ← highlighted        ("← highlighted" is the observer's annotation)
+//         Enable project MCP servers. Remembered for this folder.
+//       Don't trust
+//   OBS-406, pane wW:p32A, run-20260806-121758-…214 T5:
+//     Kimi Code loads project-level MCP servers (.mcp.json, .kimi-code/mcp.json) only in trusted folders.
+//      ❯ Trust this folder      /      Don't trust
+//
+// The fingerprint carries the SELECTION CURSOR, and that is the load-bearing half: OBS-406's own
+// cursor-less watcher matched bare `Trust this folder` and produced 258 false wakes in 25 minutes —
+// every one of them a supervisor pane with the words on screen as prose. A live modal renders a
+// cursor glyph; prose never does. Enter accepts the highlighted "Trust this folder" option, and the
+// two captures above are the reason the cursor+label pair is the fingerprint rather than either
+// prompt's heading: the same gate ships two different headings.
+export const KIMI_TRUST_DIALOG = {
+    fingerprint: "❯ Trust this folder",
+    key: "Enter",
+};
 // v1.69 T7 / v1.71 T2: thin wrapper over the daemon's generic dispatch path for kimi-only tests.
 export async function runKimiInteractiveSeed(opts) {
     const r = await runInteractiveSeed({ ...opts, adapter: kimi });
@@ -260,6 +288,14 @@ export const kimi = {
     // v1.65 T3: every flag the command builders below hardcode (-S is resumeCommand's) — verified in
     // `kimi --help` 2026-07-22.
     hardcodedFlags: { binary: "kimi", flags: ["-p", "--model", "--output-format", "-S"] },
+    // KNOWN GAP, stated rather than implied: this declaration is consumed by the daemon's trust loop,
+    // which is entered only AFTER runInteractiveSeed returns — and that seed waits for
+    // `readinessMatch` for the whole task timeout, which is exactly the window this prompt blocks in
+    // (run …215). So on a kimi startup pane the declaration is correct and still unreached: the seed
+    // reports `readiness pattern not seen` with zero keypresses. Answering it during the readiness
+    // wait is a change to src/run/interactive-seed.ts — WHEN and HOW OFTEN a declaration is answered
+    // is T19's half of this contract, and src/run may not appear in this task's diff.
+    trustDialog: KIMI_TRUST_DIALOG,
     // KIMI-02 headless. -p prompt mode + explicit model, NO permission flag: kimi 0.26.0 rejects
     // -p combined with -y/--auto at argument parse time ("Cannot combine --prompt with --yolo",
     // OBS-67 — doctor probes all failed on it), and prompt mode is already non-interactive with

package/dist/adapters/opencode.js

@@ -28,6 +28,23 @@ export const opencode = {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },
     parse: parseWorkerResult,
+    // v1.89 T1 / OBS-414: opencode 1.17.15 renders no workspace-trust gate, and the prompt it DOES
+    // render must never be declared here. A prior attempt at this contract pointed opencode's
+    // fingerprint at its tool-permission modal — captured verbatim as the three lines
+    //     Permission required
+    //     Allow once
+    //     enter confirm
+    // The daemon answers a match with Enter, which selects "Allow once" and silently approves the
+    // first arbitrary tool request in every slot: stall protection converted into auto-approval
+    // (.planning/RULING-v189-T1-reauthor.md:11). Tool approval and workspace trust are different
+    // gates, and no line of that capture — including the keybar hint that slipped past the first
+    // refusal list — can be declared now: the schema requires a fingerprint that names a trust gate.
+    // FALSIFIER: a captured opencode pane showing a folder/workspace-trust prompt — not a permission
+    // prompt — replaces this with {fingerprint, key}.
+    trustDialog: {
+        kind: "none",
+        reason: "opencode 1.17.15 renders no workspace-trust prompt; its only modal is the tool-permission prompt (Permission required / Allow once), a different gate that must never be auto-answered; falsified by a captured opencode pane showing a folder-trust prompt",
+    },
     // v1.5 MODEL-01: fail OPEN to [] (advisory detection, unlike gates). Plain `models` (NOT --refresh):
     // opencode reads its own cache offline; --refresh adds an avoidable network dependency (RESEARCH
     // anti-pattern). Live-verified 2026-07-10, opencode 1.17.15.

package/dist/adapters/pi.js

@@ -62,6 +62,17 @@ export const pi = {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },
     parse: parseWorkerResult,
+    // v1.89 T1 / OBS-414: pi HAS a per-directory trust prompt, and both command builders above already
+    // suppress it with --approve — a global option legal in both modes (pi --help 0.80.3), chosen for
+    // exactly this reason. Live-checked 2026-07-10 in a fresh worktree: no trust prompt reached the
+    // pane, so there is nothing captured, and a fingerprint here would be a guess about a dialog this
+    // adapter never lets render.
+    // FALSIFIER: drop --approve from interactiveCommand, dispatch into a fresh worktree, and capture
+    // the prompt that appears — then this becomes {fingerprint, key} rather than a suppression claim.
+    trustDialog: {
+        kind: "none",
+        reason: "pi 0.80.3's per-directory trust prompt is suppressed before it renders by --approve on both command builders (live-checked 2026-07-10, fresh worktree, no prompt); falsified by removing --approve and capturing the pane",
+    },
     // v1.5 MODEL-01: fail OPEN to [] (detection is advisory — unlike gates' fail-closed posture).
     // spawnSync mirrors probeVersion; 15s timeout. Live-verified 2026-07-10, pi 0.80.3.
     listModels: async () => {

package/dist/adapters/prompt.js

@@ -2,6 +2,13 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { classifyVerdictCause } from "../gates/verdict-cause.js";
+// v1.87 T5: the scope rule states only what the runtime enforces, and no more. What it enforces:
+// `scope.allowDeviations` comes from the operator's config, is snapshotted and frozen when a gate
+// round starts (run-gates.ts `allowDeviations`), and is never written back — so a worker has no
+// reach into it at all, and the round that judges its work judges against one fixed list. The
+// retired "unless the operator's config allowlists that path" advertised an exemption the worker
+// could neither invoke nor influence. Nothing here names a capability a worker can invoke mid-run,
+// and the allowlist stays exactly as immutable during a run as it was before this text changed.
 export function buildTaskPrompt(task, feedback = "", nonce = "") {
     const list = (xs) => xs.map((x) => `- ${x}`).join("\n");
     return `You are an autonomous coding worker dispatched by tickmarkr into an isolated git worktree.
@@ -15,7 +22,7 @@ ${task.files.length ? `\n## File scope — touch ONLY paths matching:\n${list(ta
 ## Rules
 - Work only inside the current directory (your isolated worktree). Never push. Never switch branches.
 - Make small atomic git commits as you go (git add + git commit, conventional messages).
-- Touch ONLY paths matching the file scope. Out-of-scope edits FAIL the scope gate unless the operator's config allowlists that path — declaring a deviation never passes the gate. If you cannot complete the task without an out-of-scope edit, stop and report ok:false explaining why in "summary". List any out-of-scope paths you did touch, each with a reason, in "deviations" (journaled for the operator's audit).
+- Touch ONLY paths matching the file scope. Out-of-scope edits FAIL the scope gate. The operator's allowlist is fixed when the run starts and nothing you do can change it while your work is judged; declaring a deviation never passes the gate either. If you cannot complete the task without an out-of-scope edit, stop and report ok:false explaining why in "summary". List any out-of-scope paths you did touch, each with a reason, in "deviations" (journaled for the operator's audit).
 - Do not ask questions; you are unattended. Make the smallest correct change.
 ${feedback ? `\n## Previous attempt failed gates — fix these specifically\n${feedback}\n` : ""}
 When finished, end your final message with exactly one line (no code fence):

package/dist/adapters/registry.js

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { modelLints, suggestOverlay } from "./model-lints.js";
@@ -281,6 +281,9 @@ function declarativeAdapter(entry) {
             return health;
         },
         channels: (cfg) => channelsFromConfig(entry.id, cfg),
+        // v1.89 T1 / OBS-414: straight from the validated drive contract — no default and no fallback,
+        // which is the only way this factory cannot reintroduce the optionality the type just removed.
+        trustDialog: drive.trustDialog,
         headlessCommand: (promptFile, model) => renderDriveTemplate(drive.headless, promptFile, model),
         interactiveCommand: (promptFile, model) => drive.interactive === null
             ? null
@@ -395,67 +398,83 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
         // Tests inject FakeAdapter; never let an incidental default adapter spend a real token in the suite.
         if (process.env.VITEST && SHIPPED_NATIVE_ADAPTERS.has(a))
             return;
-        const verdicts = {};
         const priorModelAuth = priorHealth?.[a.id]?.modelAuth;
-        const probeRoot = a.probeCwd === "neutral" ? mkdtempSync(join(tmpdir(), "tickmarkr-probe-")) : repoRoot;
-        const store = (model, verdict) => {
-            verdicts[model] = verdict;
-            onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
-        };
-        // One bounded probe call. verdict:null = a first-pass failure that earns the one serial retry
-        // (OBS-72: a failure inside the concurrent batch is indistinguishable from adapter self-contention
-        // until re-probed alone); a retry attempt always returns a final verdict.
-        const attempt = async (model, retry) => {
-            const t0 = Date.now();
-            const probedAt = new Date().toISOString();
-            const v = (authed, reason) => ({ authed, ...(reason !== undefined ? { reason } : {}), probedAt, durationMs: Date.now() - t0 });
-            try {
-                if (typeof a.headlessCommand !== "function")
-                    return { verdict: v(false, "headless probe unavailable"), timedOut: false };
-                const promptFile = join(mkdtempSync(join(tmpdir(), "tickmarkr-auth-")), "probe.md");
-                writeFileSync(promptFile, MODEL_PROBE_PROMPT);
-                const r = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
-                // T2 rule unchanged: a prior doctor.json timeout skips the retry — a persistently dead
-                // model (e.g. opencode glm-5.2) costs one attempt instead of two every run.
-                if (r.timedOut && !retry && priorModelAuth?.[model]?.reason?.includes("timed out") === true) {
-                    return { verdict: v(false, `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`), timedOut: true };
+        const runProbes = async (probeRoot) => {
+            const verdicts = {};
+            const store = (model, verdict) => {
+                verdicts[model] = verdict;
+                onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
+            };
+            // One bounded probe call. verdict:null = a first-pass failure that earns the one serial retry
+            // (OBS-72: a failure inside the concurrent batch is indistinguishable from adapter self-contention
+            // until re-probed alone); a retry attempt always returns a final verdict.
+            const attempt = async (model, retry) => {
+                const t0 = Date.now();
+                const probedAt = new Date().toISOString();
+                const v = (authed, reason) => ({ authed, ...(reason !== undefined ? { reason } : {}), probedAt, durationMs: Date.now() - t0 });
+                try {
+                    if (typeof a.headlessCommand !== "function")
+                        return { verdict: v(false, "headless probe unavailable"), timedOut: false };
+                    const promptDir = mkdtempSync(join(tmpdir(), "tickmarkr-auth-"));
+                    try {
+                        const promptFile = join(promptDir, "probe.md");
+                        writeFileSync(promptFile, MODEL_PROBE_PROMPT);
+                        const r = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
+                        // T2 rule unchanged: a prior doctor.json timeout skips the retry — a persistently dead
+                        // model (e.g. opencode glm-5.2) costs one attempt instead of two every run.
+                        if (r.timedOut && !retry && priorModelAuth?.[model]?.reason?.includes("timed out") === true) {
+                            return { verdict: v(false, `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`), timedOut: true };
+                        }
+                        const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
+                        if (!reason)
+                            return { verdict: v(true), timedOut: false };
+                        if (!retry)
+                            return { verdict: null, timedOut: r.timedOut === true };
+                        return {
+                            verdict: r.timedOut && retry.firstTimedOut ? v(false, `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`) : v(false, reason),
+                            timedOut: r.timedOut === true,
+                        };
+                    }
+                    finally {
+                        rmSync(promptDir, { recursive: true, force: true });
+                    }
                 }
-                const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
-                if (!reason)
-                    return { verdict: v(true), timedOut: false };
-                if (!retry)
-                    return { verdict: null, timedOut: r.timedOut === true };
-                return {
-                    verdict: r.timedOut && retry.firstTimedOut ? v(false, `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`) : v(false, reason),
-                    timedOut: r.timedOut === true,
-                };
-            }
-            catch (e) {
-                return { verdict: retry ? v(false, String(e)) : null, timedOut: false };
+                catch (e) {
+                    return { verdict: retry ? v(false, String(e)) : null, timedOut: false };
+                }
+            };
+            // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
+            // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
+            // Capped at MODEL_PROBE_CONCURRENCY per adapter unless the adapter declares its own cap
+            // (codex: 1 — OBS-72, its concurrent probes self-contend in one repo).
+            const retries = [];
+            await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), a.probeConcurrency ?? MODEL_PROBE_CONCURRENCY, async (model) => {
+                const first = await attempt(model);
+                if (first.verdict)
+                    store(model, first.verdict);
+                else
+                    retries.push({ model, firstTimedOut: first.timedOut });
+            });
+            // OBS-72: re-probe each first-pass failure once with ONE probe in flight, only after the
+            // concurrent batch drained — an in-slot retry still races its concurrency partner. Success here
+            // was contention; a second failure is the real verdict. Successful first-pass probes stored
+            // above and never wait; cost is one extra call per genuinely dead model only.
+            for (const { model, firstTimedOut } of retries) {
+                const second = await attempt(model, { firstTimedOut });
+                if (second.verdict)
+                    store(model, second.verdict);
             }
+            h.modelAuth = verdicts;
         };
-        // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
-        // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
-        // Capped at MODEL_PROBE_CONCURRENCY per adapter unless the adapter declares its own cap
-        // (codex: 1 — OBS-72, its concurrent probes self-contend in one repo).
-        const retries = [];
-        await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), a.probeConcurrency ?? MODEL_PROBE_CONCURRENCY, async (model) => {
-            const first = await attempt(model);
-            if (first.verdict)
-                store(model, first.verdict);
-            else
-                retries.push({ model, firstTimedOut: first.timedOut });
-        });
-        // OBS-72: re-probe each first-pass failure once with ONE probe in flight, only after the
-        // concurrent batch drained — an in-slot retry still races its concurrency partner. Success here
-        // was contention; a second failure is the real verdict. Successful first-pass probes stored
-        // above and never wait; cost is one extra call per genuinely dead model only.
-        for (const { model, firstTimedOut } of retries) {
-            const second = await attempt(model, { firstTimedOut });
-            if (second.verdict)
-                store(model, second.verdict);
+        if (a.probeCwd !== "neutral")
+            return runProbes(repoRoot);
+        const probeRoot = mkdtempSync(join(tmpdir(), "tickmarkr-probe-"));
+        try {
+            await runProbes(probeRoot);
+        }
+        finally {
+            rmSync(probeRoot, { recursive: true, force: true });
         }
-        h.modelAuth = verdicts;
     }));
 }
 // T2: caps concurrent probes per adapter at 2 — v1.33.5 regression, 4 concurrent codex exec in one

package/dist/adapters/types.d.ts

@@ -77,11 +77,42 @@ export type TrustVerdict = {
     status: "action-required";
     command: string;
 };
-export interface TrustDialog {
+export interface CapturedTrustDialog {
+    kind?: "dialog";
     fingerprint: string;
     key: string;
 }
-export declare function matchesTrustDialog(paneText: string, dialog: TrustDialog): boolean;
+export interface NoTrustDialog {
+    kind: "none";
+    reason: string;
+}
+export type TrustDialog = CapturedTrustDialog | NoTrustDialog;
+export declare const TRUST_DIALOG_BLANK_MESSAGE = "trust-dialog fingerprint must be verbatim bytes captured from a workspace-trust prompt \u2014 a blank or whitespace-only fingerprint matches every pane";
+export declare const CLAUDE_TRUST_PANE: string;
+export declare const CODEX_TRUST_PANE: string;
+export declare const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
+export declare const KIMI_TRUST_PANE: string;
+export declare const KIMI_MCP_TRUST_PANE: string;
+export declare const RECORDED_TRUST_PANES: readonly string[];
+export declare const APPROVED_TRUST_FINGERPRINTS: readonly string[];
+export declare const TRUST_DIALOG_UNRECORDED_MESSAGE = "trust-dialog fingerprint is not one of the approved workspace-trust captures \u2014 it must be exactly an entry of APPROVED_TRUST_FINGERPRINTS in src/adapters/types.ts (each the distinctive bytes of a recorded pane), not a prefix of one, a substring of one, or a sentence describing the prompt; declare {kind: none, reason} if the CLI renders none";
+export declare const TRUST_DIALOG_VARIANTS: readonly [z.ZodObject<{
+    kind: z.ZodOptional<z.ZodLiteral<"dialog">>;
+    fingerprint: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"none">;
+    reason: z.ZodString;
+}, z.core.$strict>];
+export declare const TrustDialogSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodOptional<z.ZodLiteral<"dialog">>;
+    fingerprint: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"none">;
+    reason: z.ZodString;
+}, z.core.$strict>]>;
+export declare function matchesTrustDialog(paneText: string, dialog: TrustDialog): dialog is CapturedTrustDialog;
 export interface InputBox {
     fingerprint: string;
     match?(paneText: string): boolean;
@@ -118,7 +149,7 @@ export interface WorkerAdapter {
     collectUsage?(cwd: string, sinceMs: number): TokenUsage | undefined;
     contextUsage?(session: SessionRef): ContextUsage | null;
     trust?(repoRoot: string): TrustVerdict;
-    trustDialog?: TrustDialog;
+    trustDialog: TrustDialog;
     inputBox?: InputBox;
     hardcodedFlags?: {
         binary: string;

package/dist/adapters/types.js

@@ -27,8 +27,106 @@ export function modelAuthed(health, model, allowUnverifiedModels = false) {
     const authed = health?.modelAuth?.[model]?.authed;
     return authed === true || (authed === undefined && allowUnverifiedModels);
 }
+export const TRUST_DIALOG_BLANK_MESSAGE = "trust-dialog fingerprint must be verbatim bytes captured from a workspace-trust prompt — a blank or whitespace-only fingerprint matches every pane";
+// v1.89 T1 / OBS-414 round 3 — THE EVIDENCE. The word "trust" is not evidence of a capture: codex's
+// real recorded gate is "Do you trust the contents of this directory?" and the handwritten prose
+// "Do you trust this command?" is one word away, so no regex separates them — only the record does.
+// Round 2 accepted the prose, and the daemon presses Enter on a match, which is auto-approval of an
+// arbitrary tool call. So a fingerprint must be an ENUMERATED capture (APPROVED_TRUST_FINGERPRINTS
+// below), and every pane here is VERBATIM, quoted from the record named beside it — the panes are the
+// evidence each approved entry is checked against, never the acceptance rule themselves.
+//
+// Cost of the posture, stated plainly: an operator adding a CLI through the YAML drive contract
+// cannot declare a trust dialog whose capture is not enumerated here — they declare {kind:"none",
+// reason} and page a human, or contribute the capture. That is deliberate. The alternative is a stall
+// protection that any plausible sentence can turn into a permission auto-approver.
+// v1.75 T2 / OBS-137, claude-code 2.1.218 startup gate.
+export const CLAUDE_TRUST_PANE = [
+    "Accessing workspace:",
+    "/tmp/untrusted-project",
+    "Quick safety check: Is this a project you created or one you trust? (Like your own code, a well-known open source project, or work from your team).",
+    "Yes, I trust this folder",
+].join("\n");
+// v1.75 T2 / OBS-137, codex 0.144.6 startup gate.
+export const CODEX_TRUST_PANE = [
+    "Do you trust the contents of this directory?",
+    "Working with untrusted contents comes with higher risk of prompt injection.",
+    "Trusting the directory allows project-local config, hooks, and exec policies to load.",
+    "› 1. Yes, continue",
+    "Press enter to continue",
+].join("\n");
+// v1.22 T5 / OBS-19, cursor-agent's per-worktree dialog.
+export const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
+// OBS-358, live pane wW:p2TB of run-20260805-121252 — the dialog that cost 30 minutes — quoted from
+// the record holding all five lines, .overseer/REPAIR-v186/GATE-T28-1.md (OBSERVATIONS.md abridges
+// it to the first three). "← highlighted" is the observer's annotation of the selected row, kept
+// exactly as recorded rather than tidied away.
+export const KIMI_TRUST_PANE = [
+    "Trust this folder?",
+    "  /Users/…/.tickmarkr/worktrees.noindex/tickmarkr-run-20260805-121252--T29",
+    "❯ Trust this folder     ← highlighted",
+    "    Enable project MCP servers. Remembered for this folder.",
+    "  Don't trust",
+].join("\n");
+// OBS-406, live pane wW:p32A of run-20260806-121758-…214 T5 — the same gate in its MCP-trust
+// wording, which is why kimi's fingerprint is the cursor+option row both headings share.
+export const KIMI_MCP_TRUST_PANE = [
+    "Kimi Code loads project-level MCP servers (.mcp.json, .kimi-code/mcp.json) only in trusted folders.",
+    " ❯ Trust this folder      /      Don't trust",
+].join("\n");
+export const RECORDED_TRUST_PANES = [
+    CLAUDE_TRUST_PANE, CODEX_TRUST_PANE, CURSOR_TRUST_PANE, KIMI_TRUST_PANE, KIMI_MCP_TRUST_PANE,
+];
+// v1.89 T1 / OBS-414 round 4 — EXACT, not "leading bytes of a recorded line". Round 3 accepted any
+// prefix of a captured line, and every prefix of a trust prompt is also a substring of unrelated
+// panes: `{fingerprint: "Trust"}` passed, then matched a tool-permission pane reading
+// "Trust this command?" and handed the daemon an Enter to press on it — the auto-approval defect,
+// reopened by the check meant to close it. `"Trust this folder"` (kimi's row minus its cursor glyph)
+// passed the same way, and that exact string is the one OBS-406 measured producing 258 false wakes
+// in 25 minutes on supervisor panes with the words on screen as prose.
+//
+// So the approved fingerprints are ENUMERATED, one per shipped capture, each the distinctive bytes
+// of its own pane and nothing shorter. Kimi's carries the selection cursor because a live modal
+// renders one and prose never does. Membership is exact; the corpus check below it keeps a list
+// entry from drifting away from the pane it claims to quote.
+export const APPROVED_TRUST_FINGERPRINTS = [
+    "Quick safety check: Is this a project you created or one you trust?", // claude-code 2.1.218, OBS-137
+    "Do you trust the contents of this directory?", // codex 0.144.6, OBS-137
+    "Workspace Trust Required", // cursor-agent, OBS-19
+    "❯ Trust this folder", // kimi 0.29.0, OBS-358 + OBS-406 — the cursor glyph is load-bearing
+];
+const isApprovedFingerprint = (fingerprint) => APPROVED_TRUST_FINGERPRINTS.includes(fingerprint)
+    && RECORDED_TRUST_PANES.some((pane) => pane.includes(fingerprint));
+export const TRUST_DIALOG_UNRECORDED_MESSAGE = "trust-dialog fingerprint is not one of the approved workspace-trust captures — it must be exactly an entry of APPROVED_TRUST_FINGERPRINTS in src/adapters/types.ts (each the distinctive bytes of a recorded pane), not a prefix of one, a substring of one, or a sentence describing the prompt; declare {kind: none, reason} if the CLI renders none";
+// The two variants, exported as one tuple so every schema that embeds a trust declaration (the
+// drive contract in catalog.ts) is built from these bytes rather than restating them.
+export const TRUST_DIALOG_VARIANTS = [
+    z.object({
+        kind: z.literal("dialog").optional(),
+        // superRefine, not chained refine(): one failure yields ONE diagnosis, so the operator reads the
+        // reason their declaration was refused instead of every rule it happened to trip.
+        fingerprint: z.string().superRefine((fingerprint, ctx) => {
+            const message = fingerprint.trim().length === 0 ? TRUST_DIALOG_BLANK_MESSAGE
+                : isApprovedFingerprint(fingerprint) ? undefined
+                    : TRUST_DIALOG_UNRECORDED_MESSAGE;
+            if (message)
+                ctx.addIssue({ code: "custom", message });
+        }),
+        key: z.string().min(1),
+    }).strict(),
+    z.object({
+        kind: z.literal("none"),
+        reason: z.string().refine((r) => r.trim().length > 0, "a no-dialog declaration must state a falsifiable reason"),
+    }).strict(),
+];
+export const TrustDialogSchema = z.union(TRUST_DIALOG_VARIANTS);
+// The discrimination lives HERE, at the keypress boundary every caller crosses: a no-dialog
+// declaration never matches, so sendKey is unreachable for it without editing this function. The
+// blank guard is the same fail-closed posture one layer below the schema.
 export function matchesTrustDialog(paneText, dialog) {
-    return paneText.includes(dialog.fingerprint);
+    if (dialog.kind === "none")
+        return false;
+    return dialog.fingerprint.trim().length > 0 && paneText.includes(dialog.fingerprint);
 }
 const inputBoxes = new Map();
 export function declareInputBox(adapterId, inputBox) {