Fix Ollama Cloud routing and XML directive parsing

.github/workflows/ci.yml

@@ -25,7 +25,10 @@ jobs:
       run: |
         pip install --upgrade pip
         pip install -e .[dev]
-        pip install ruff black pytest pytest-cov shellcheck pre-commit
+        pip install ruff black pytest pytest-cov pre-commit
+
+    - name: Install shellcheck (native binary, not on PyPI)
+      run: sudo apt-get update && sudo apt-get install -y shellcheck
 
     - name: Run pre-commit
       run: |

Modelfile-master-ai

@@ -27,6 +27,7 @@ DIRECTIVES (emit on own line, column 0):
   BROWSER_EXTRACT_LIST: <drive|page>       — extract visible list/grid rows as structured items
   BROWSER_DRIVE_INSPECT_FOLDER: <json|query> — search Google Drive for a folder, open it, and extract contents
   SEND_EMAIL: to=<addr> subject="<...>" body="<...>" attach=<optional path> from=<optional sender addr>  — send via Gmail/AOL/Outlook SMTP; provider routed from `from=` domain (gmail.com → Gmail, aol.com → AOL, outlook.com/hotmail.com → Outlook). Default sender = Gmail. Mode-aware confirm (irreversible). See "EMAIL COMPOSITION DISCIPLINE" below.
+  SEND_TELEGRAM: <chat_id> <message> — send a one-way message via the configured Telegram bot. If a default chat ID is configured in ~/.master_ai_keys (TELEGRAM_CHAT_ID), you may omit <chat_id> and just write the message. Use for status pings, alerts, and quick updates. Mode-aware confirm (irreversible).
 
 Pick RUNTERM only when the command itself needs a real terminal: clears screen, animates, reads keyboard, curses/fullscreen UI, htop/top/vim/nano/ssh, or a long-running visual shell script. Opening a website, HTML file, document, image, folder, or desktop app is NOT terminal work. Use RUN with `xdg-open <url-or-file>` or `libreoffice <file>` for those; the dispatcher opens the browser/app directly and must not spawn a terminal just to launch it. Pick RUN otherwise. For chat/explanation with no action, reply as plain prose.
 
@@ -321,6 +322,11 @@ Steps:
 3. Screenshot the resulting page
 Irreversible: none
 </PLAN>
-BROWSER_FILL: input[type="search"] :: sensei AI
+BROWSER_FILL: input[type=search] :: sensei AI
 BROWSER_CLICK: a.result-link:first-of-type
 BROWSER_SCREENSHOT: viewport"""
+
+# SEND_TELEGRAM few-shot
+MESSAGE user "send a Telegram status ping to 898432159 saying the build finished"
+MESSAGE assistant """Pinging you on Telegram.
+SEND_TELEGRAM: 898432159 Build finished — no errors."""

approval_queue.py

@@ -312,7 +312,7 @@ def _load_handlers():
     if _sys_path_add not in sys.path:
         sys.path.insert(0, _sys_path_add)
     # Each import is optional — missing consumers don't block the CLI.
-    for mod_name in ("sensei_extractor",):
+    for mod_name in ("sensei_extractor", "master_ai"):
         try:
             __import__(mod_name)
         except Exception as e:
@@ -400,4 +400,12 @@ def _cli():
 
 
 if __name__ == "__main__":
+    # Alias this running __main__ module into sys.modules["approval_queue"]
+    # BEFORE _load_handlers() imports master_ai. Otherwise `import
+    # approval_queue` inside master_ai.py creates a second, separate module
+    # object, and every @register_handler decorator it fires registers into
+    # that copy's _HANDLERS dict — invisible to the approve() below, which
+    # reads the __main__ copy's _HANDLERS. This makes both names point at
+    # the same module object so registrations land in one place.
+    sys.modules.setdefault("approval_queue", sys.modules[__name__])
     sys.exit(_cli())

harvest.py

@@ -24,7 +24,20 @@
 
 _TOKEN_RE = re.compile(r"[a-z0-9]{2,}")
 _PRIVATE_PATH_PATTERNS = (
-    re.compile(r"(?i)(?:^|[\s'\"`])(?:~|/home/[^/\s'\"`]+)/(?:Pictures|Documents|Downloads|Desktop|jobseeker)(?:/|$|[\s'\"`])"),
+    # 2026-09-08: narrowed from a blanket Desktop/Documents/Downloads/
+    # Pictures/jobseeker path block. Desktop and Documents hold ordinary
+    # everyday workspace files too (task lists, study plans, glossaries)
+    # and blanket-blocking the whole folder dead-ended every cloud-first
+    # task that so much as globbed through them, with no local fallback
+    # to fall back to. Path-based blocking was also the wrong tool for
+    # this anyway: it both over-blocked (a harmless .md on the Desktop)
+    # and under-protected (a tax PDF saved anywhere else wasn't caught).
+    # _PRIVATE_TERM_RE below already does real content-based detection
+    # (resume/tax/ssn/credential/etc.) regardless of which folder the
+    # content lives in -- keep the path fence only for folders that are
+    # inherently about identity/sensitive-document storage rather than
+    # everyday workspace files.
+    re.compile(r"(?i)(?:^|[\s'\"`])(?:~|/home/[^/\s'\"`]+)/(?:Pictures|Downloads|jobseeker)(?:/|$|[\s'\"`])"),
     re.compile(r"(?i)(?:^|/)\.(?:ssh|gnupg)(?:/|$)"),
     re.compile(r"(?i)(?:^|/)\.aws/(?:credentials|config)(?:$|[\s'\"`])"),
     re.compile(r"(?i)(?:^|/)\.master_ai_keys(?:$|[\s'\"`])"),
@@ -34,10 +47,17 @@
     r"(?i)\b("
     r"resume|cover letter|job application|tax|w-?2|1099|irs|bank statement|"
     r"routing number|account number|social security|ssn|medical|doctor|patient|"
-    r"prescription|password|credential|api key|secret token|private key|"
+    r"prescription|"
     r"driver'?s license|passport"
     r")\b"
 )
+# 2026-09-12: dropped password|credential|api key|secret token|private key from
+# the term list above -- those are generic security jargon that fires on any
+# mention (filenames, code comments, casual conversation about auth), not just
+# actual leaked secrets. _SECRET_VALUE_PATTERNS below already catches real
+# secret VALUES by shape (AKIA/gh_/sk-/PEM) regardless of surrounding wording,
+# which is the actual leak risk this gate exists to prevent. Elijah: privacy
+# gate was "too harsh" -- narrowed to real PII categories + real secret shapes.
 _SECRET_VALUE_PATTERNS = (
     re.compile(r"\bAKIA[0-9A-Z]{16}\b"),
     re.compile(r"\bASIA[0-9A-Z]{16}\b"),