@lumoai/cli 1.58.0 → 1.60.0

package/dist/cli/src/lib/hook-runner.js

@@ -68,8 +68,11 @@ function readStdin() {
  *
  * For 'pre-tool-use' the array contains:
  *   [0] (optional) a PreToolUse hookSpecificOutput JSON carrying the parallel-
- *       edit collision warning as additionalContext, when the server returned a
- *       `collisionWarning` (LUM-150 step ③). Empty otherwise.
+ *       edit collision warning (LUM-150 step ③), the one-shot boundary-
+ *       crossing reminder (LUM-542), and the one-shot PR security-scan
+ *       reminder (LUM-737) as additionalContext, when the server returned any
+ *       of `collisionWarning`, `crossingReminder`, `securityReminder`. Empty
+ *       otherwise.
  *
  * The JSON lines conform to Claude Code's hookSpecificOutput envelope so the
  * runtime injects additionalContext into the conversation automatically.
@@ -83,8 +86,9 @@ _now = new Date()) {
         if (responseBody == null || typeof responseBody !== 'object')
             return [];
         const body = responseBody;
-        // Two independent PreToolUse signals (LUM-150 collision, LUM-542 crossing
-        // reminder) share one additionalContext block when both are present.
+        // Three independent PreToolUse signals (LUM-150 collision, LUM-542
+        // crossing reminder, LUM-737 security reminder) share one
+        // additionalContext block when more than one is present.
         const parts = [];
         if (typeof body.collisionWarning === 'string' &&
             body.collisionWarning !== '')
@@ -92,6 +96,9 @@ _now = new Date()) {
         if (typeof body.crossingReminder === 'string' &&
             body.crossingReminder !== '')
             parts.push(body.crossingReminder);
+        if (typeof body.securityReminder === 'string' &&
+            body.securityReminder !== '')
+            parts.push(body.securityReminder);
         if (parts.length === 0)
             return [];
         return [
@@ -121,13 +128,14 @@ _now = new Date()) {
     else if (tb && tb.bound === false) {
         lines.push(unboundPromptLine(sessionId));
     }
-    // Blocker warning + criteria + progress + memory + linked resources +
-    // PR-review todos share one additionalContext block so Claude Code injects a
-    // single coherent context payload at session start. The dependency blocker
-    // warning (LUM-172) slots in first so it stays prominent — it can preempt the
-    // session's work entirely. Then the progressive-disclosure tiers (LUM-500):
-    // Tier-0 acceptance contract → Tier-1 prior-session progress → Tier-2 memory
-    // index → linked resources.
+    // Blocker warning + security findings + criteria + progress + memory +
+    // linked resources + PR-review todos share one additionalContext block so
+    // Claude Code injects a single coherent context payload at session start.
+    // The dependency blocker warning (LUM-172) slots in first so it stays
+    // prominent — it can preempt the session's work entirely. The undispositioned
+    // security findings warning (LUM-737) follows next. Then the
+    // progressive-disclosure tiers (LUM-500): Tier-0 acceptance contract →
+    // Tier-1 prior-session progress → Tier-2 memory index → linked resources.
     //
     // LUM-500: the prior-session recovery is now the server-rendered Tier-1
     // `progressSection`, which REPLACES the CLI-rendered recovery card so progress
@@ -137,6 +145,10 @@ _now = new Date()) {
         // Blocker warning first: it can preempt the session's work entirely (wait
         // for the blocker instead of starting) — LUM-172.
         body.blockerWarningSection,
+        // LUM-737: undispositioned security findings — second, before the
+        // contract: it changes what "done" needs (fix + push, or a human
+        // disposition) but unlike a blocker does not preempt the session.
+        body.securityFindingsSection,
         // Tier-0 acceptance contract: what the session's work is judged against
         // (LUM-342).
         body.criteriaSection,

package/dist/cli/src/lib/open-crossings.js

@@ -28,9 +28,9 @@ function normalizeSeverity(s) {
  * first, via the EXISTING LUM-435 read endpoint — `GET …/boundary-crossings`
  * returns every crossing (open and dispositioned); we keep only the
  * undispositioned ones (`disposition == null`). This is the **read/awareness**
- * half of the acceptance loop: there is no new query and, by construction, no
- * way to clear a crossing — disposition stays web + human-only
- * (LUM-426/435/422).
+ * half of the acceptance loop: there is no new query and this helper cannot
+ * clear anything — a ruling goes through `lumo crossing disposition` (exit-4
+ * user approval, LUM-769) or the web panel.
  *
  * Fails *closed*, not open (LUM-480): any transport / non-ok HTTP / parse
  * failure returns `{ status: 'error', reason }` so the caller can say "check
@@ -75,9 +75,9 @@ async function fetchOpenCrossings(apiUrl, token, taskIdentifier) {
     return { status: 'ok', crossings };
 }
 /**
- * The web deep link where a HUMAN dispositions crossings. Disposition is
- * web-only and human-only (LUM-426/435/422); the terminal only ever points
- * here, it never clears anything itself. Built from the workspace slug +
+ * The web deep link where a human dispositions crossings in the panel — the
+ * counterpart of `lumo crossing disposition` (LUM-769); the awareness surfaces
+ * (task status, DONE_BLOCKED) point here. Built from the workspace slug +
  * identifier alone (the `/my-tasks/<id>` route needs no project slug), so no
  * extra fetch is required.
  */

package/dist/shared/src/referent-kind.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REFERENT_KIND_DECLARABLE = void 0;
+exports.TASK_REFERENT_KIND_DECLARABLE = exports.REFERENT_KIND_DECLARABLE = void 0;
 exports.classifyCheckpointerGrounding = classifyCheckpointerGrounding;
 exports.effectiveReferentKind = effectiveReferentKind;
+exports.deriveReferentKind = deriveReferentKind;
 /**
  * referentKind (LUM-602): what a criterion anchors — the only dimension that
  * determines independence. Dependency-light (no @prisma/client) so both the
@@ -14,6 +15,15 @@ exports.REFERENT_KIND_DECLARABLE = [
     'AGENT_CONSTRUCTED_STATE',
     'PENDING_OUTCOME',
 ];
+/**
+ * LUM-733: the kinds a TASK criterion may still carry. PENDING_OUTCOME is no
+ * longer accepted on task criteria (it had no check and no reader); it remains
+ * declarable on milestone exit criteria only.
+ */
+exports.TASK_REFERENT_KIND_DECLARABLE = [
+    'EXTERNAL_FACT',
+    'AGENT_CONSTRUCTED_STATE',
+];
 /** Tools whose output the agent cannot author — external facts. */
 const EXTERNAL_TOOLS = [
     'git',
@@ -319,3 +329,23 @@ function effectiveReferentKind(args) {
     }
     return declared;
 }
+/**
+ * LUM-733: the referent kind is DERIVED by the system, not declared by the
+ * agent. A MACHINE criterion's kind follows its checkpointer — EXTERNAL_FACT
+ * only when the check actually consumes an external tool (git/gh/curl/psql/…),
+ * AGENT_CONSTRUCTED_STATE otherwise — so any declaration on a MACHINE criterion
+ * is ignored (there is nothing to mis-declare and nothing to catch). A HUMAN
+ * criterion has no checkpointer to read, so an optional declaration is kept
+ * as-is; absent, it stays null (unclassified).
+ */
+function deriveReferentKind(args) {
+    const { verifierType, checkpointer, declared } = args;
+    if (verifierType === 'MACHINE') {
+        return classifyCheckpointerGrounding(checkpointer) === 'EXTERNAL'
+            ? 'EXTERNAL_FACT'
+            : 'AGENT_CONSTRUCTED_STATE';
+    }
+    return declared === 'EXTERNAL_FACT' || declared === 'AGENT_CONSTRUCTED_STATE'
+        ? declared
+        : null;
+}

package/dist/shared/src/security-scan.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_DOWNGRADE_LABELS = exports.SCAN_STAGE_STATE_LABELS = exports.SCAN_STAGE_LABELS = exports.SCAN_STAGE_STATES = exports.SCAN_STAGE_KEYS = exports.EXTERNAL_ERROR_PREFIX = void 0;
+exports.externalFailureReason = externalFailureReason;
+exports.scanStageLabel = scanStageLabel;
+exports.scanStageStateLabel = scanStageStateLabel;
+exports.secretDowngradeNote = secretDowngradeNote;
+/**
+ * PR security scan — the one `PrSecurityScan.error` shape that may be shown
+ * as an external-scanner reason (spec P8). Shared by the web panel, the PR
+ * summary (both via `lib/security-scan/stages.ts`, which re-exports this)
+ * and the CLI (`cli/src/commands/task-status.ts`), so the three renderers
+ * cannot drift apart (LUM-756).
+ *
+ * The column has two writers: the ingest / managed-scan workflow, which
+ * scrubs its reason and stamps this prefix on it (the prefix is the proof of
+ * provenance), and stage A's own catch-all, which writes a RAW, unscrubbed
+ * `error.message` with no prefix. Renderers therefore check the prefix first
+ * and print only what follows it; unprefixed text is never published.
+ */
+exports.EXTERNAL_ERROR_PREFIX = 'external: ';
+/**
+ * The scanner's reason, or null when there is none to show: a missing /
+ * empty error, an unprefixed (stage A raw) error, or a prefix with nothing
+ * after it.
+ */
+function externalFailureReason(error) {
+    if (!error || !error.startsWith(exports.EXTERNAL_ERROR_PREFIX))
+        return null;
+    const reason = error.slice(exports.EXTERNAL_ERROR_PREFIX.length);
+    return reason.length > 0 ? reason : null;
+}
+/**
+ * LUM-763 — the scan's five layers, as stored.
+ *
+ * These keys are a persisted contract, not a display choice: they sit in
+ * `PrSecurityScan.stages` on every historical row, travel over the
+ * task-status API, and are read by CLIs older than this change. They do not
+ * get renamed; only what a reader is shown does.
+ */
+exports.SCAN_STAGE_KEYS = [
+    'secrets',
+    'external',
+    'supplyChain',
+    'judge',
+    'hunt',
+];
+/** The states a layer can be in. `ScanStageState` in `lib/security-scan/types.ts` derives from this. */
+exports.SCAN_STAGE_STATES = [
+    'RAN',
+    'FAILED',
+    'SKIPPED',
+    'NOT_CONFIGURED',
+    'PENDING',
+    'PARTIAL',
+    'SUPERSEDED',
+];
+/**
+ * What each layer is called where a person reads it — the PR comment and
+ * `lumo task status`, which share this map so the two cannot drift (the web
+ * panel renders the same wording through `securityScan.stage.*` in i18n).
+ *
+ * Named for what the layer checks, never for who runs it or which model it
+ * uses: `external` was accurate only while the scanners were the customer's,
+ * and stopped being true the moment Lumo started running them itself.
+ */
+exports.SCAN_STAGE_LABELS = {
+    secrets: 'Secrets',
+    external: 'Code scan',
+    supplyChain: 'Dependencies',
+    judge: 'AI review',
+    hunt: 'Exploit paths',
+};
+/**
+ * What each state is called. `RAN` deliberately reads as "checked", not as a
+ * tick or "clean": it means the layer completed, and a layer that completed
+ * may well have found something — the findings are counted on their own
+ * lines. Only the states that leave the scan incomplete carry a glyph, so
+ * attention is drawn to "do not trust this line" and never to "this is fine"
+ * (spec P9 — a security signal never claims safety it did not establish).
+ */
+exports.SCAN_STAGE_STATE_LABELS = {
+    RAN: 'checked',
+    FAILED: '✗ failed',
+    SKIPPED: 'skipped',
+    NOT_CONFIGURED: 'off',
+    PENDING: 'scanning',
+    PARTIAL: '⚠ incomplete',
+    SUPERSEDED: '⚠ superseded',
+};
+/** The layer's display name; an unrecognised key renders as itself rather than vanishing. */
+function scanStageLabel(key) {
+    return exports.SCAN_STAGE_LABELS[key] ?? key;
+}
+/** The state's display name; an unrecognised state renders as itself. */
+function scanStageStateLabel(state) {
+    return exports.SCAN_STAGE_STATE_LABELS[state] ?? state;
+}
+/**
+ * LUM-758 follow-up — why a deterministic secret hit was lowered to LOW.
+ *
+ * Downgrading is not suppression: the row is still reported, deliberately, so
+ * that a human decides. But a reported row with no stated cause reads as an
+ * unexplained credential, which is how a test fixture the scanner *already
+ * recognised* as a placeholder ends up looking like an open risk. These say
+ * which rule fired, in the same words on every surface.
+ *
+ * Phrased as a property of the value or the path, never as a verdict: the
+ * scanner knows the string looks like a placeholder, not that it is harmless.
+ */
+exports.SECRET_DOWNGRADE_LABELS = {
+    PLACEHOLDER_VALUE: 'placeholder value',
+    DOWNGRADED_PATH: 'test/fixture/doc path',
+};
+/**
+ * The parenthesised note appended to a rendered finding line, or `''` when the
+ * row carries no downgrade — an unrecognised reason renders as itself rather
+ * than vanishing, so a value added server-side is never silently dropped by an
+ * older CLI.
+ */
+function secretDowngradeNote(reason) {
+    if (!reason)
+        return '';
+    return ` — ${exports.SECRET_DOWNGRADE_LABELS[reason] ?? reason}, downgraded`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.58.0",
+  "version": "1.60.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",

package/assets/skill/references/fidelity.md

@@ -1,32 +0,0 @@
-# Fidelity read-outs (mechanical change-pattern)
-
-`lumo fidelity` is the fidelity-axis read surface — pure, read-only analytics over what the acceptance loop already records, in the same family as `lumo criteria audit` and `lumo outcome rate`. It adds **no storage and no write path**; it only reads the LUM-609 delivery snapshots and the `CRITERION_CHANGED` audit trail.
-
-## `lumo fidelity show <task>`
-
-```bash
-lumo fidelity show LUM-42
-lumo fidelity show LUM-42 --json
-```
-
-For **each delivery** of the task (one append-only `TaskCriteriaSnapshot` per fresh IN_REVIEW entry — a reopen→re-deliver appends another), it discloses two compositions and deliberately stops there. There is **no single fidelity score and no good/bad direction verdict** — the read-out is purely mechanical (timing + op + checkpointer grounding; it never reads statement or diff semantics).
-
-### 1. Grounding composition
-
-Runs the same `effectiveReferentKind` classifier the LUM-605 verify gate uses over the **frozen** contract (delivery-time truth, not the since-edited `latest`), rolled into three buckets plus the full per-kind tally:
-
-- **grounded** — `EXTERNAL_FACT` (anchored on a fact the agent cannot author: a git SHA/diff, CI status, a DB row). This count is a **machine-checkable _upper bound_** — the checkpointer heuristic can over-count external grounding, never under-count it.
-- **self-confirming** — `AGENT_CONSTRUCTED_STATE` + `UNVERIFIED_ASSERTION` (passes by checking the agent's own output, incl. a declared-EXTERNAL_FACT checkpointer that doesn't truly ground external).
-- **inconclusive** — `PENDING_OUTCOME` + `UNCLASSIFIED` (not mechanically resolvable here). **Surfaced, never silently swallowed.**
-
-### 2. Independence signal
-
-A criterion is a **backward-inference suspect** when it is both (a) in this delivery's frozen contract and (b) was `ADDED`/`UPDATED` at **round>0** (after work started) at or before the freeze — i.e. the contract the delivery rode on was bent after the work began rather than fixed up front. round-0 (initial-draft) criteria are clean; `DELETED` ops and edits recorded after the freeze (a later cycle) don't count. Each suspect shows its `op`, `round`, and `causeTag`. The read-out **counts and discloses — it does not judge** whether a given edit was legitimate sharpening or tampering (that direction call is left to a human / a later axis).
-
-### Caveat (printed on every report)
-
-The time anchor is the **work-start boundary** (`Task.workStartedAt`), so the independence signal detects a contract edited _after work started_ — not specifically _after output was produced_. A task with **no delivery snapshot** (never entered IN_REVIEW, or predates the LUM-609 freeze) is reported explicitly — "nothing to read yet", which is **not** a pass.
-
-`--json` emits the full report (`taskId`, `workStartedAt`, `hasSnapshots`, `deliveries[]` with `grounding`/`independence`, `caveat`) for scripting.
-
-**When to suggest**: when the user wants to see how externally-grounded a task's delivered acceptance contract actually was, or whether criteria were added/changed after work began (independence). It's a disclosure tool, not a gate — it never blocks DONE and emits no verdict.

package/dist/cli/src/commands/fidelity.js

@@ -1,108 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fidelityShow = fidelityShow;
-const config_1 = require("../lib/config");
-const api_1 = require("../lib/api");
-const sanitize_1 = require("../lib/sanitize");
-/**
- * `lumo fidelity show <task>` — the LUM-610 mechanical change-pattern read-out
- * (fidelity axis, second block, on the LUM-609 delivery-snapshot foundation).
- *
- * Per delivery snapshot it discloses two compositions and NOTHING else — no
- * single score, no good/bad verdict (approach (a): purely mechanical):
- *   • grounding — how much of the FROZEN contract is externally grounded
- *     (EXTERNAL_FACT) vs self-confirming (agent-authored) vs inconclusive.
- *     `grounded` is a machine-checkable UPPER BOUND.
- *   • independence — criteria ADDED/UPDATED after work started (round>0) that
- *     the delivery rode on: backward-inference suspects. Direction left blank.
- */
-const EFFECTIVE_KINDS = [
-    'EXTERNAL_FACT',
-    'AGENT_CONSTRUCTED_STATE',
-    'UNVERIFIED_ASSERTION',
-    'PENDING_OUTCOME',
-    'UNCLASSIFIED',
-];
-function authBase() {
-    const creds = (0, config_1.readCredentials)();
-    if (!creds)
-        return { error: 'not logged in. Run `lumo auth login` first.' };
-    const base = (0, api_1.trimTrailingSlash)((0, api_1.resolveAuthedApiUrl)(creds.apiUrl));
-    const headers = {
-        Authorization: `Bearer ${creds.token}`,
-    };
-    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
-    if (sessionId)
-        headers['X-Lumo-Session-Id'] = sessionId;
-    return { base, headers };
-}
-function formatReport(report, taskId) {
-    const lines = [];
-    lines.push(`Fidelity change-pattern — ${(0, sanitize_1.sanitizeField)(taskId)}`);
-    if (!report.hasSnapshots) {
-        lines.push('  No delivery snapshot on record (task never entered IN_REVIEW, or ' +
-            'predates the LUM-609 freeze). Nothing to read yet — not a pass.');
-        lines.push('');
-        lines.push(`  ${report.caveat}`);
-        return lines.join('\n') + '\n';
-    }
-    report.deliveries.forEach((d, i) => {
-        const when = d.frozenAt.slice(0, 19).replace('T', ' ');
-        lines.push('');
-        lines.push(`  Delivery ${i + 1}/${report.deliveries.length} · frozen ${when}Z · ${(0, sanitize_1.sanitizeField)(d.trigger)} · ${d.total} criteria`);
-        const g = d.grounding;
-        lines.push(`    grounding:    grounded ${g.grounded}  ·  self-confirming ${g.selfConfirming}  ·  inconclusive ${g.inconclusive}   (grounded = machine-checkable upper bound)`);
-        const kinds = EFFECTIVE_KINDS.filter(k => g.byEffectiveKind[k] > 0)
-            .map(k => `${k} ${g.byEffectiveKind[k]}`)
-            .join(', ');
-        lines.push(`      effective kinds: ${kinds || '(none)'}`);
-        const ind = d.independence;
-        lines.push(`    independence: ${ind.postStartChanges}/${ind.total} criteria ADDED/UPDATED after work started (backward-inference suspects; direction not judged)`);
-        for (const s of ind.suspects) {
-            const cause = s.causeTag ? ` · ${(0, sanitize_1.sanitizeField)(s.causeTag)}` : '';
-            lines.push(`      ↳ ${(0, sanitize_1.sanitizeField)(s.criterionId)}  ${s.op}@round${s.round}${cause}  (${s.at.slice(0, 10)})`);
-        }
-    });
-    lines.push('');
-    lines.push(`  ${report.caveat}`);
-    return lines.join('\n') + '\n';
-}
-async function fidelityShow(taskId, options = {}) {
-    if (!taskId || taskId.trim() === '') {
-        console.error('Error: a task is required: lumo fidelity show <task>');
-        return 1;
-    }
-    const auth = authBase();
-    if ('error' in auth) {
-        console.error(`Error: ${auth.error}`);
-        return 1;
-    }
-    let res;
-    try {
-        res = await fetch(`${auth.base}/api/tasks/${encodeURIComponent(taskId)}/fidelity`, { headers: auth.headers });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`Error: could not reach Lumo API (${msg})`);
-        return 1;
-    }
-    if (res.status === 401) {
-        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
-        return 1;
-    }
-    if (res.status === 404) {
-        console.error(`Error: task ${(0, sanitize_1.sanitizeField)(taskId)} not found.`);
-        return 1;
-    }
-    if (!res.ok) {
-        console.error(`Error: could not read the fidelity change-pattern (HTTP ${res.status}).`);
-        return 1;
-    }
-    const report = (await res.json());
-    if (options.json) {
-        process.stdout.write(JSON.stringify(report, null, 2) + '\n');
-        return;
-    }
-    process.stdout.write(formatReport(report, taskId));
-    return;
-}

package/dist/cli/src/commands/verdict.js

@@ -1,189 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.collectCriterion = collectCriterion;
-exports.verdict = verdict;
-const config_1 = require("../lib/config");
-const api_1 = require("../lib/api");
-const sanitize_1 = require("../lib/sanitize");
-const browser_1 = require("../lib/browser");
-/**
- * Rejection-reason vocabulary (mirrors the server's VerificationRejectionReason
- * enum). Required on the agent --fail path — the agent pays the structured tax
- * a human is spared (LUM-422 ①).
- */
-const FAIL_REASONS = [
-    'CRITERION_UNMET',
-    'EVIDENCE_INSUFFICIENT',
-    'CHECK_EXECUTION_ERROR',
-    'SCOPE_MISMATCH',
-    'OTHER',
-];
-/** Collect repeatable `--criterion <id>` flags into an array (commander idiom). */
-function collectCriterion(value, prev = []) {
-    return [...prev, value];
-}
-/**
- * `lumo verdict [task]` — human + agent acceptance verdicts (LUM-422).
- *
- * Two modes, exactly one required:
- *   --pass  opens the browser to the task's verdict bar, focused on Pass (a deep
- *       link — writes NOTHING; a passing data row is only ever produced by a
- *       human's own click, red line).
- *   --fail --reason <enum> [--note] [--criterion …]  records an AGENT send-back
- *       (verdict hard-coded FAIL server-side) and bounces the task to
- *       IN_PROGRESS. Bearer-authed.
- *
- * Defaults to the session-bound task; an explicit identifier overrides.
- */
-async function verdict(identifier, options = {}) {
-    const modes = [options.pass && 'pass', options.fail && 'fail'].filter(Boolean);
-    if (modes.length === 0) {
-        console.error('Error: choose a verdict mode — --pass or --fail.');
-        return 1;
-    }
-    if (modes.length > 1) {
-        console.error(`Error: pick exactly one verdict mode (got ${modes.join(', ')}).`);
-        return 1;
-    }
-    const creds = (0, config_1.readCredentials)();
-    if (!creds) {
-        console.error('Error: not logged in. Run `lumo auth login` first.');
-        return 1;
-    }
-    const base = (0, api_1.trimTrailingSlash)((0, api_1.resolveAuthedApiUrl)(creds.apiUrl));
-    const headers = {
-        Authorization: `Bearer ${creds.token}`,
-    };
-    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
-    if (sessionId)
-        headers['X-Lumo-Session-Id'] = sessionId;
-    // ── Resolve the task: explicit identifier or the session binding ──────────
-    let taskId = identifier;
-    if (!taskId) {
-        if (!sessionId) {
-            console.error('Error: no task given and $CLAUDE_CODE_SESSION_ID is not set.\n' +
-                'Run `lumo verdict <LUM-N> …` or run inside a session bound via `lumo session attach`.');
-            return 1;
-        }
-        let res;
-        try {
-            res = await fetch(`${base}/api/sessions/${encodeURIComponent(sessionId)}`, { headers });
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.error(`Error: could not reach Lumo API (${msg})`);
-            return 1;
-        }
-        const data = res.ok
-            ? (await res.json())
-            : null;
-        if (!data?.taskIdentifier) {
-            console.error('Error: this session is not bound to a task. Run `lumo session attach <LUM-N>` first, or pass the task explicitly.');
-            return 1;
-        }
-        taskId = data.taskIdentifier;
-    }
-    if (options.fail) {
-        return failVerdict(base, headers, taskId, options, creds.workspaceSlug);
-    }
-    return passDeepLink(base, headers, taskId, creds.workspaceSlug);
-}
-/**
- * --pass: open the human's verdict bar pre-focused on Pass. The CLI never writes
- * the verdict — it only carries the human to the one click that does (red line:
- * no agent-produced passing row).
- */
-async function passDeepLink(base, headers, taskId, workspaceSlug) {
-    let res;
-    try {
-        res = await fetch(`${base}/api/tasks/by-identifier/${encodeURIComponent(taskId)}`, { headers });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`Error: could not reach Lumo API (${msg})`);
-        return 1;
-    }
-    if (res.status === 401) {
-        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
-        return 1;
-    }
-    if (res.status === 404) {
-        console.error(`Error: task ${taskId} not found in workspace ${workspaceSlug}`);
-        return 1;
-    }
-    if (!res.ok) {
-        console.error(`Error: could not load task (HTTP ${res.status})`);
-        return 1;
-    }
-    const { task } = (await res.json());
-    if (!task?.url) {
-        console.error('Error: server did not return a task URL to open.');
-        return 1;
-    }
-    const sep = task.url.includes('?') ? '&' : '?';
-    const deepLink = `${task.url}${sep}verdict=pass`;
-    process.stdout.write(`Opening ${taskId} for a human "Pass" verdict (nothing is recorded until they click):\n` +
-        `  ${(0, sanitize_1.sanitizeField)(deepLink)}\n`);
-    (0, browser_1.openBrowser)(deepLink);
-    return;
-}
-/**
- * --fail: record an AGENT send-back. The server hard-codes verdict=FAIL and
- * verifierType=AGENT — there is no passing verdict the CLI can express.
- */
-async function failVerdict(base, headers, taskId, options, workspaceSlug) {
-    if (!options.reason) {
-        console.error(`Error: --fail requires --reason <${FAIL_REASONS.join('|')}>.`);
-        return 1;
-    }
-    // Case-insensitive like every other CLI enum flag (LUM-420): fold to the
-    // canonical upper-case enum before validating and sending.
-    const reason = options.reason.toUpperCase();
-    if (!FAIL_REASONS.includes(reason)) {
-        console.error(`Error: invalid --reason "${options.reason}". Allowed: ${FAIL_REASONS.join(', ')}.`);
-        return 1;
-    }
-    const body = { rejectionReasonEnum: reason };
-    if (options.note)
-        body.note = options.note;
-    if (options.criterion && options.criterion.length > 0) {
-        body.criterionIds = options.criterion;
-    }
-    let res;
-    try {
-        res = await fetch(`${base}/api/tasks/${encodeURIComponent(taskId)}/agent-verdict`, {
-            method: 'POST',
-            headers: { ...headers, 'Content-Type': 'application/json' },
-            body: JSON.stringify(body),
-        });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`Error: could not reach Lumo API (${msg})`);
-        return 1;
-    }
-    if (res.status === 401) {
-        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
-        return 1;
-    }
-    if (res.status === 404) {
-        console.error(`Error: task ${taskId} not found in workspace ${workspaceSlug}`);
-        return 1;
-    }
-    if (!res.ok) {
-        const errBody = (await res.json().catch(() => null));
-        const detail = errBody && typeof errBody.error === 'string'
-            ? (0, sanitize_1.sanitizeField)(errBody.error)
-            : '';
-        console.error(`Error: send-back rejected (HTTP ${res.status})${detail ? ` — ${detail}` : ''}`);
-        return 1;
-    }
-    const outcome = (await res.json());
-    process.stdout.write(`✗ Sent ${taskId} back (AGENT FAIL, reason ${reason}) — ` +
-        `${outcome.criterionIds.length} ${outcome.criterionIds.length === 1 ? 'criterion' : 'criteria'} at round ${outcome.round}; task is now ${outcome.taskStatus}.\n`);
-    if (outcome.commentId) {
-        process.stdout.write('  A send-back note was posted as a task comment.\n');
-    }
-    process.stdout.write('Address the unmet criteria (see `lumo task status`), then re-verify.\n');
-    return;
-}