@skrr-ai/cli 0.1.104 → 0.1.105

package/dist/lib/delegated-cli.js

@@ -50,6 +50,7 @@ const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const auth_core_1 = require("@skrr-ai/auth-core");
+const cli_handoff_wire_1 = require("@skrr-ai/auth-core/cli-handoff-wire");
 const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
 function isDelegatedCliSession(env = process.env) {
     return Boolean(env.OVERSKY_AUTONOMOUS_SESSION === '1' &&
@@ -237,9 +238,17 @@ class DelegatedCliUnavailableError extends Error {
         this.upstreamCode = fields.upstreamCode;
         this.upstreamReason = fields.upstreamReason;
         this.retryAt = fields.retryAt;
+        // OSK-16216 — an older daemon names no remedy. The fallback is the SAME
+        // shared sentence a current daemon sends, with nothing filled in: this
+        // process cannot tell whether the desktop app or a `skrrd install` runs
+        // the daemon, and `skrr daemon login` alone is wrong for the first.
         this.remedy =
             fields.remedy ??
-                (fields.retryable ? undefined : 'run `skrr daemon login` on the machine running the daemon');
+                (fields.retryable
+                    ? undefined
+                    : (0, cli_handoff_wire_1.daemonSignInRemedy)({
+                        repinsDeviceKey: fields.upstreamCode === 'DEVICE_PROOF_PIN_MISMATCH',
+                    }));
     }
 }
 exports.DelegatedCliUnavailableError = DelegatedCliUnavailableError;
@@ -321,7 +330,9 @@ async function fetchDelegatedCliCredential(env = process.env, options = {}) {
                 throw new DelegatedCliUnavailableError(typeof body?.message === 'string' && body.message
                     ? `the daemon's delegated CLI broker could not mint a credential: ${body.message}`
                     : `the skrr server refused the daemon's request for this session's credential (${named}).`, {
-                    ...(typeof body?.upstreamStatus === 'number' ? { upstreamStatus: body.upstreamStatus } : {}),
+                    ...(typeof body?.upstreamStatus === 'number'
+                        ? { upstreamStatus: body.upstreamStatus }
+                        : {}),
                     ...(typeof body?.upstreamCode === 'string' ? { upstreamCode: body.upstreamCode } : {}),
                     ...(typeof body?.upstreamReason === 'string'
                         ? { upstreamReason: body.upstreamReason }

package/dist/lib/followups.d.ts

@@ -1,6 +1,12 @@
 import { withQuery } from './triggers';
 type Query = Parameters<typeof withQuery>[1];
 type Json = Record<string, unknown>;
+/**
+ * Check a `--in` / `--at` value against the bound the server enforces, before the round trip, and
+ * name the FLAG the user typed. The server's message names its own field (`in`, `once.runAt`) and,
+ * for a duration, used to give the bound in raw seconds (OSK-15415). Null when it is acceptable.
+ */
+export declare function whenFlagProblem(flag: 'in' | 'at', value: string | undefined): string | null;
 /**
  * The line a settle verb prints. A follow-up that had already ended is said to
  * have ended, with the terminal it actually has, rather than reported as the

package/dist/lib/followups.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.followupsApi = exports.FOLLOWUP_SUBJECT_FLAG_HELP = exports.FOLLOWUP_SUBJECT_EXTERNAL_KEY_RE = exports.WATCH_WAIT_KINDS = exports.FOLLOWUP_RESOLVE_OUTCOMES = exports.FOLLOWUP_STATES = exports.FOLLOWUP_KINDS = exports.followUpIdArg = void 0;
+exports.whenFlagProblem = whenFlagProblem;
 exports.settledLine = settledLine;
 exports.recipeWatchBoundsRefusal = recipeWatchBoundsRefusal;
 exports.resolveFollowUpAgent = resolveFollowUpAgent;
@@ -28,6 +29,17 @@ const triggers_1 = require("./triggers");
 const agent_resolver_1 = require("./agent-resolver");
 const MOUNT = '/api/followups';
 const base = (id) => `${MOUNT}/${encodeURIComponent(id)}`;
+/**
+ * Check a `--in` / `--at` value against the bound the server enforces, before the round trip, and
+ * name the FLAG the user typed. The server's message names its own field (`in`, `once.runAt`) and,
+ * for a duration, used to give the bound in raw seconds (OSK-15415). Null when it is acceptable.
+ */
+function whenFlagProblem(flag, value) {
+    if (value === undefined)
+        return null;
+    const refusal = (0, data_provider_1.validateFollowUpWhen)(value, `--${flag}`);
+    return refusal ? refusal.message : null;
+}
 /**
  * The line a settle verb prints. A follow-up that had already ended is said to
  * have ended, with the terminal it actually has, rather than reported as the

package/dist/lib/message-content.d.ts

@@ -11,6 +11,12 @@
  * join them with a paragraph break, and non-text parts (tool calls, images,
  * think blocks) are skipped the same way the `--json` response omits them.
  *
+ * A widget part (CSS, HTML and JavaScript an app draws in a frame) is a block of
+ * its fallback sentence: a terminal cannot draw it, the markup is never printed,
+ * and skipping it like the other non-text parts dropped the sentence from every
+ * message that also had text. A cut-off widget contributes nothing, as it does in
+ * the stored `text`.
+ *
  * Falls back to the flattened `text` string when a message carries no
  * structured content — user messages and historical rows never have it.
  */

package/dist/lib/message-content.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.messageTextBlocks = messageTextBlocks;
+const data_provider_1 = require("@skrr-ai/data-provider");
 /**
  * Flatten a conversation message's assistant `content[]` parts into readable
  * display blocks.
@@ -14,6 +15,12 @@ exports.messageTextBlocks = messageTextBlocks;
  * join them with a paragraph break, and non-text parts (tool calls, images,
  * think blocks) are skipped the same way the `--json` response omits them.
  *
+ * A widget part (CSS, HTML and JavaScript an app draws in a frame) is a block of
+ * its fallback sentence: a terminal cannot draw it, the markup is never printed,
+ * and skipping it like the other non-text parts dropped the sentence from every
+ * message that also had text. A cut-off widget contributes nothing, as it does in
+ * the stored `text`.
+ *
  * Falls back to the flattened `text` string when a message carries no
  * structured content — user messages and historical rows never have it.
  */
@@ -43,6 +50,9 @@ function textOfPart(part) {
         return '';
     }
     const p = part;
+    if (p.type === data_provider_1.UI_WIDGET_PART_TYPE) {
+        return widgetFallback(p[data_provider_1.UI_WIDGET_PART_TYPE]);
+    }
     if (typeof p.type === 'string' && p.type !== 'text') {
         return '';
     }
@@ -58,3 +68,17 @@ function textOfPart(part) {
     }
     return '';
 }
+/** The sentence that stands for a complete widget part, or `''` (never any of its markup). */
+function widgetFallback(widget) {
+    if (!widget || typeof widget !== 'object') {
+        return '';
+    }
+    const w = widget;
+    if (w.complete === false) {
+        return '';
+    }
+    return (0, data_provider_1.uiWidgetFallbackText)({
+        title: typeof w.title === 'string' ? w.title : undefined,
+        fallbackText: typeof w.fallbackText === 'string' ? w.fallbackText : undefined,
+    });
+}

package/dist/lib/operating-plan-loops.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The operating plan's planning loops, named (OSK-15416). The text view printed only
+ * "15 existing planning/reflection loops; 0 scheduled work blocks": a count that grew as follow-ups
+ * were armed and did not drop when they were cancelled (a cancelled loop stays in the list, disabled),
+ * and never said which wake was due when. The server already projects `enabled`, `status` and
+ * `nextAt` for each loop; only --json showed them.
+ */
+export declare function planningLoopLines(loops: unknown, todoCount: number): string[];

package/dist/lib/operating-plan-loops.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * The operating plan's planning loops, named (OSK-15416). The text view printed only
+ * "15 existing planning/reflection loops; 0 scheduled work blocks": a count that grew as follow-ups
+ * were armed and did not drop when they were cancelled (a cancelled loop stays in the list, disabled),
+ * and never said which wake was due when. The server already projects `enabled`, `status` and
+ * `nextAt` for each loop; only --json showed them.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.planningLoopLines = planningLoopLines;
+const SHOWN = 10;
+function planningLoopLines(loops, todoCount) {
+    const all = (Array.isArray(loops) ? loops : []);
+    const armed = all.filter((loop) => loop.enabled !== false);
+    const disabled = all.length - armed.length;
+    const lines = [
+        '',
+        `${armed.length} armed planning/reflection loop${armed.length === 1 ? '' : 's'}` +
+            `${disabled > 0 ? ` (${disabled} more disabled or cancelled, not counted)` : ''}; ` +
+            `${todoCount} scheduled work block${todoCount === 1 ? '' : 's'}.`,
+    ];
+    // Soonest first; a loop with no due time (an event wait, unknown) after the dated ones.
+    const ordered = [...armed].sort((a, b) => (a.nextAt || '9999').localeCompare(b.nextAt || '9999'));
+    for (const loop of ordered.slice(0, SHOWN)) {
+        lines.push(`  ${loop.nextAt ?? '(no due time)'} · ${loop.label ?? 'Scheduled work'} · ` +
+            `${loop.kind ?? '-'} · ${loop.status ?? '-'} · ${loop.id ?? '-'}`);
+    }
+    if (ordered.length > SHOWN) {
+        lines.push(`  … and ${ordered.length - SHOWN} more armed (all of them in --json).`);
+    }
+    return lines;
+}

package/dist/lib/preflight-copy.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Plain-words sentences for two preflight gates whose verdicts used to be a bare `warn` (OSK-15425).
+ *
+ * "When is silence a problem?" printed only that freshness is advisory, with the reason
+ * (`evidence_unconfigured`) left in --json, so a reader could not tell whether silence would ever be
+ * flagged. "Where does its access come from?" printed no sentence at all. A credential whose expiry
+ * had passed read `stale`.
+ */
+type GateLike = {
+    id?: string;
+    verdict?: string;
+    reason?: string | null;
+    detail?: Record<string, unknown> | null;
+};
+/** The refusal as `code: words`, or the bare code when it is not one this knows. */
+export declare function sourceRefusalWords(code: string): string;
+/** Extra lines under a gate, or none. The gate's own note is printed by the caller. */
+export declare function gateExplanationLines(gate: GateLike): string[];
+/**
+ * The status word for a capability. A credential whose expiry has passed is `expired`, not the
+ * storage word `stale`, which gave no sign that time had run out.
+ */
+export declare function capabilityStatusLabel(capability: {
+    status?: string;
+    expiresAt?: string | null;
+}, now?: Date): string;
+export {};

package/dist/lib/preflight-copy.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * Plain-words sentences for two preflight gates whose verdicts used to be a bare `warn` (OSK-15425).
+ *
+ * "When is silence a problem?" printed only that freshness is advisory, with the reason
+ * (`evidence_unconfigured`) left in --json, so a reader could not tell whether silence would ever be
+ * flagged. "Where does its access come from?" printed no sentence at all. A credential whose expiry
+ * had passed read `stale`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sourceRefusalWords = sourceRefusalWords;
+exports.gateExplanationLines = gateExplanationLines;
+exports.capabilityStatusLabel = capabilityStatusLabel;
+/** What a refused event-source code means, in words. An unknown code is printed as it is. */
+const SOURCE_REFUSAL_WORDS = {
+    source_authorization_descriptor_invalid: 'authorization record incomplete (it names no id to check access against)',
+    source_binding_detached: 'no longer matches a source attached to this Commitment',
+    source_access_revoked: 'access refused',
+    source_access_unavailable: 'access could not be checked just now',
+};
+/** The refusal as `code: words`, or the bare code when it is not one this knows. */
+function sourceRefusalWords(code) {
+    const words = SOURCE_REFUSAL_WORDS[code];
+    return words ? `${code}: ${words}` : code;
+}
+function sourceRefusalLine(row) {
+    const id = row.refId
+        ? `${row.selector ?? 'id'} ${row.refId}`
+        : `no ${row.selector ?? 'id'} given`;
+    const why = row.reason ? (SOURCE_REFUSAL_WORDS[row.reason] ?? row.reason) : 'access was refused';
+    return `Source ${row.source ?? 'unknown'} (${id}): ${why}.`;
+}
+/** Extra lines under a gate, or none. The gate's own note is printed by the caller. */
+function gateExplanationLines(gate) {
+    if (gate.verdict === 'pass')
+        return [];
+    if (gate.id === 'freshness') {
+        switch (gate.reason) {
+            case 'evidence_unconfigured':
+                return [
+                    'No freshness expectation is set, so nothing will flag this Commitment’s evidence as stale or silent.',
+                ];
+            case 'evidence_stale': {
+                const criteria = Array.isArray(gate.detail?.criteria)
+                    ? gate.detail.criteria
+                    : [];
+                const observed = criteria
+                    .filter((item) => item.evidence === 'stale' && item.observedAt)
+                    .map((item) => String(item.observedAt))
+                    .sort();
+                return [
+                    observed.length > 0
+                        ? `Its evidence is stale; the oldest reading is from ${observed[0]}.`
+                        : 'Its evidence is stale.',
+                ];
+            }
+            case 'evidence_partial':
+                return ['Only part of its evidence is current.'];
+            case 'evidence_unavailable':
+                return ['No evidence could be read just now, so freshness cannot be judged.'];
+            default:
+                return [];
+        }
+    }
+    // The gate carries the sources it checked; its reason alone is a bare code naming none of them.
+    if (gate.id === 'source_access') {
+        const rows = Array.isArray(gate.detail?.sources) ? gate.detail.sources : [];
+        return rows.filter((row) => row.access && row.access !== 'authorized').map(sourceRefusalLine);
+    }
+    if (gate.id === 'access' && gate.reason === 'capability_access_unverified') {
+        return [
+            'No access beyond an identity check is verified as available yet (see “Where access comes from” below).',
+        ];
+    }
+    return [];
+}
+/**
+ * The status word for a capability. A credential whose expiry has passed is `expired`, not the
+ * storage word `stale`, which gave no sign that time had run out.
+ */
+function capabilityStatusLabel(capability, now = new Date()) {
+    const status = capability.status ?? 'unknown';
+    if (status === 'stale' && capability.expiresAt) {
+        const expires = Date.parse(capability.expiresAt);
+        if (!Number.isNaN(expires) && expires <= now.getTime())
+            return 'expired';
+    }
+    return status;
+}

package/dist/lib/proposal-decision-command.d.ts

@@ -6,7 +6,7 @@ export declare abstract class ProposalDecisionCommand extends BaseCommand {
     static decision: ProposalDecision;
     static args: {
         kind: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
-        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        id: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
     };
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/lib/proposal-decision-command.js

@@ -9,9 +9,15 @@ const proposals_1 = require("./proposals");
  * before an old decision would approve content the caller never reviewed. */
 class ProposalDecisionCommand extends base_command_1.BaseCommand {
     static decision;
+    // The kind is validated in `resolveProposalRef`, not by oclif, so the KIND:ID that `proposals list`
+    // prints can be pasted whole (OSK-15371).
     static args = {
-        kind: core_1.Args.string({ required: true, options: [...data_provider_1.PROPOSAL_KINDS], ignoreStdin: true }),
-        id: core_1.Args.string({ required: true, ignoreStdin: true }),
+        kind: core_1.Args.string({
+            required: true,
+            description: 'Proposal kind, or the KIND:ID that `proposals list` prints',
+            ignoreStdin: true,
+        }),
+        id: core_1.Args.string({ required: false, description: 'Proposal id', ignoreStdin: true }),
     };
     static flags = {
         json: core_1.Flags.boolean(),
@@ -45,9 +51,18 @@ class ProposalDecisionCommand extends base_command_1.BaseCommand {
             if (until > Date.now() + data_provider_1.PROPOSAL_SNOOZE_MAX_DAYS * 86400000)
                 this.error(`--until may be at most ${data_provider_1.PROPOSAL_SNOOZE_MAX_DAYS} days ahead.`);
         }
+        const ref = (0, proposals_1.resolveProposalRef)(args.kind, args.id, this.config?.bin);
+        if ('error' in ref) {
+            this.failWithCliError({
+                message: ref.error,
+                code: 'PROPOSAL_REF_INVALID',
+                exit: 2,
+                retryable: false,
+            });
+        }
         let result;
         try {
-            result = await proposals_1.proposalApi.decide(args.kind, args.id, {
+            result = await proposals_1.proposalApi.decide(ref.kind, ref.id, {
                 decision,
                 expected,
                 reason: flags.reason,
@@ -56,6 +71,15 @@ class ProposalDecisionCommand extends base_command_1.BaseCommand {
             });
         }
         catch (error) {
+            if (error?.status === 404) {
+                this.failWithCliError({
+                    message: (0, proposals_1.describeProposalNotFound)(ref.kind, ref.id, this.config?.bin),
+                    code: 'PROPOSAL_NOT_FOUND',
+                    status: 404,
+                    exit: 4,
+                    retryable: false,
+                });
+            }
             this.handleApiError(error);
         }
         this.log(flags.json ? JSON.stringify(result, null, 2) : `Proposal ${decision} decision recorded.`);

package/dist/lib/proposals.d.ts

@@ -6,3 +6,20 @@ export declare const proposalApi: {
     show(kind: ProposalKind, id: string): Promise<ProposalView>;
     decide(kind: ProposalKind, id: string, input: ProposalDecisionParams): Promise<ProposalDecisionResponse>;
 };
+/**
+ * The proposal a person pointed at, from what they typed or pasted (OSK-15371, OSK-15354).
+ *
+ * `proposals list` prints one token, `KIND:ID`, and `show`/`keep`/`discard`/`snooze` wanted two
+ * arguments, so pasting the list's own output failed with a message listing six kinds that never
+ * said the id belonged in a second argument. Both spellings are accepted now. The kind never
+ * contains a colon, so the FIRST one splits (a Northstar intent's id is itself
+ * `<review-id>:<intent-id>`), and `KIND KIND:ID` is accepted too.
+ */
+export declare function resolveProposalRef(kindArg: string | undefined, idArg: string | undefined, bin?: string): {
+    kind: ProposalKind;
+    id: string;
+} | {
+    error: string;
+};
+/** A 404 here means no such proposal under THIS kind: the id is looked up under the kind given. */
+export declare function describeProposalNotFound(kind: string, id: string, bin?: string): string;

package/dist/lib/proposals.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.proposalApi = void 0;
+exports.resolveProposalRef = resolveProposalRef;
+exports.describeProposalNotFound = describeProposalNotFound;
 const data_provider_1 = require("@skrr-ai/data-provider");
+const data_provider_2 = require("@skrr-ai/data-provider");
 const triggers_1 = require("./triggers");
 const MOUNT = '/api/proposals';
 /** The unified, read-time proposal inbox. Decisions are routed by the server to
@@ -20,3 +23,41 @@ exports.proposalApi = {
         });
     },
 };
+/**
+ * The proposal a person pointed at, from what they typed or pasted (OSK-15371, OSK-15354).
+ *
+ * `proposals list` prints one token, `KIND:ID`, and `show`/`keep`/`discard`/`snooze` wanted two
+ * arguments, so pasting the list's own output failed with a message listing six kinds that never
+ * said the id belonged in a second argument. Both spellings are accepted now. The kind never
+ * contains a colon, so the FIRST one splits (a Northstar intent's id is itself
+ * `<review-id>:<intent-id>`), and `KIND KIND:ID` is accepted too.
+ */
+function resolveProposalRef(kindArg, idArg, bin = 'skrr') {
+    const kinds = [...data_provider_2.PROPOSAL_KINDS].join(', ');
+    const usage = `Pass KIND and ID (\`${bin} proposals show request <id>\`) or the KIND:ID that \`${bin} proposals list\` prints.`;
+    let kind = (kindArg ?? '').trim();
+    let id = (idArg ?? '').trim();
+    if (!id) {
+        const colon = kind.indexOf(':');
+        if (colon < 0) {
+            return { error: `Missing the proposal id. ${usage}` };
+        }
+        id = kind.slice(colon + 1);
+        kind = kind.slice(0, colon);
+    }
+    else if (id.startsWith(`${kind}:`)) {
+        id = id.slice(kind.length + 1);
+    }
+    if (!data_provider_2.PROPOSAL_KINDS.includes(kind)) {
+        return { error: `Unknown proposal kind "${kind}". Kinds: ${kinds}. ${usage}` };
+    }
+    if (!id) {
+        return { error: `Missing the proposal id after "${kind}". ${usage}` };
+    }
+    return { kind: kind, id };
+}
+/** A 404 here means no such proposal under THIS kind: the id is looked up under the kind given. */
+function describeProposalNotFound(kind, id, bin = 'skrr') {
+    return (`No ${kind} proposal ${id} is visible to you. A proposal is looked up under its kind, so an id ` +
+        `that exists under another kind is not found here; \`${bin} proposals list\` prints each as KIND:ID.`);
+}

package/dist/lib/stewardship-output.js

@@ -9,10 +9,26 @@ function printStewardshipCoverage(report, log) {
         log('Coverage: complete within the bounded sources.');
         return;
     }
-    const unreadable = report.coverage.sources.some((source) => source.status === 'unavailable' || source.truncated);
-    log(unreadable
-        ? 'Coverage: incomplete. Unreadable sources do not confirm absence.'
-        : 'Coverage: incomplete. Some Grants are not attributed to this workspace and are not listed.');
+    const unavailable = report.coverage.sources.some((source) => source.status === 'unavailable');
+    // A list cut at the row cap is READABLE and partial; calling it "unreadable" sent the reader looking
+    // for a permission problem (OSK-15355). `unattributedGrants` has its own line below.
+    const cut = report.coverage.sources.some((source) => source.status !== 'unavailable' && source.truncated && source.name !== 'unattributedGrants');
+    const unlistedGrants = report.coverage.sources.some((source) => source.unlisted);
+    if (unavailable || cut) {
+        log(`Coverage: incomplete. ${[
+            unavailable ? 'Unreadable sources do not confirm absence.' : null,
+            cut
+                ? 'Lists cut at the row cap are partial, so a row missing from them is not shown absent; this command has no paging.'
+                : null,
+        ]
+            .filter(Boolean)
+            .join(' ')}`);
+    }
+    else {
+        log(unlistedGrants
+            ? 'Coverage: incomplete. Some Grants are not attributed to this workspace and are not listed.'
+            : 'Coverage: incomplete.');
+    }
     for (const source of report.coverage.sources) {
         if (source.status === 'unavailable')
             log(`${source.name}: unavailable`);
@@ -25,6 +41,18 @@ function printStewardshipCoverage(report, log) {
         }
     }
 }
+/** Who holds the Grant, in the same `kind id` words `skrr grants list` uses. */
+function principalText(principal) {
+    const value = principal;
+    if (!value?.kind)
+        return '—';
+    const id = value.agentId ?? value.commitmentId;
+    return id ? `${value.kind} ${id}` : value.kind;
+}
+/** What the Grant allows: its capability names, or an honest dash when it lists none. */
+function accessText(capabilities) {
+    return Array.isArray(capabilities) && capabilities.length ? capabilities.join(', ') : '—';
+}
 function printWorkspaceGrants(report, log) {
     printStewardshipCoverage(report, log);
     printGrantRows(report, log);
@@ -44,16 +72,23 @@ function printGrantRows(report, log) {
     (0, format_1.renderTable)(report.grants.map((row) => ({
         id: row.id,
         label: row.label,
+        provider: row.provider || '—',
+        principal: principalText(row.principal),
+        access: accessText(row.capabilities),
         owner: row.ownerUserId,
         active: row.active ? 'yes' : 'no',
-        expires: row.expiresAt ?? '',
-        envKeys: row.credential?.envKeys.join(', ') ?? '',
+        // No expiry is a fact about the Grant; a blank cell read as "not readable" (OSK-15357).
+        expires: row.expiresAt ?? 'never',
+        envKeys: row.credential?.envKeys.length ? row.credential.envKeys.join(', ') : '—',
         referencedBy: row.referencedBy === null
             ? 'unavailable'
             : `${row.referencedBy.join(', ')}${row.referencesTruncated ? ' (truncated)' : ''}`,
     })), [
         { key: 'id', header: 'ID' },
         { key: 'label', header: 'LABEL' },
+        { key: 'provider', header: 'PROVIDER' },
+        { key: 'principal', header: 'HELD BY' },
+        { key: 'access', header: 'ACCESS' },
         { key: 'owner', header: 'OWNER' },
         { key: 'active', header: 'ACTIVE' },
         { key: 'expires', header: 'EXPIRES' },
@@ -63,12 +98,22 @@ function printGrantRows(report, log) {
 }
 function printWorkspaceStewardship(report, log) {
     printStewardshipCoverage(report, log);
-    log(`Membership: ${report.membership.status}${report.membership.role ? ` (${report.membership.role})` : ''}`);
-    for (const [name, rows] of [
-        ['Commitments', report.commitments],
-        ['Approver seats', report.approverSeats],
+    log(`Membership: ${report.membership.status}${report.membership.role ? ` (${report.membership.role})` : ''}${
+    // "Absent" is all the report knows: a removed member and an id that never existed read alike (OSK-15356).
+    report.membership.status === 'absent'
+        ? ' — not a current member; this report cannot tell a removed member from an id that never existed'
+        : ''}`);
+    const isCut = (source) => report.coverage.sources.some((entry) => entry.name === source && entry.truncated);
+    const count = (rows, source) => rows === null
+        ? 'unavailable'
+        : isCut(source)
+            ? `${rows.length} shown, cut at the row cap (there are more)`
+            : String(rows.length);
+    for (const [name, source, rows] of [
+        ['Commitments', 'commitments', report.commitments],
+        ['Approver seats', 'approverSeats', report.approverSeats],
     ]) {
-        log(`${name}: ${rows === null ? 'unavailable' : rows.length}`);
+        log(`${name}: ${count(rows, source)}`);
         if (rows?.length)
             (0, format_1.renderTable)(rows.map((row) => ({
                 id: row.id,
@@ -82,7 +127,7 @@ function printWorkspaceStewardship(report, log) {
                 { key: 'agentId', header: 'EXECUTOR' },
             ], log);
     }
-    log(`Authored Agents: ${report.agents === null ? 'unavailable' : report.agents.length}`);
+    log(`Authored Agents: ${count(report.agents, 'agents')}`);
     if (report.agents?.length)
         (0, format_1.renderTable)(report.agents.map((row) => ({ id: row.id, name: row.name ?? '' })), [
             { key: 'id', header: 'ID' },

package/dist/lib/task-economics-line.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The Task's stored economic claim as one line for `tasks show` (OSK-15363).
+ *
+ * The detail view printed no savings, effort, risk, basis or confirmer at all: only `--json` carried
+ * them, with the confirmer as a raw user id, though `docs/cli/SKRR_TASKS.md` sends a reader to "ordinary
+ * task detail" for the claim. A claim is not a measurement, so the basis is part of the line.
+ */
+type Economics = {
+    savings?: {
+        amount?: number;
+        currency?: string;
+        per?: string;
+    };
+    effortHours?: number;
+    risk?: string;
+    confidence?: string;
+    rationale?: string;
+    basis?: string;
+    confirmedBy?: string;
+    confirmedAt?: string;
+    revision?: number;
+};
+/** Null when the Task carries no claim at all. `confirmerName` is the resolved name, if there is one. */
+export declare function economicsLine(economics: Economics | null | undefined, confirmerName?: string): string | null;
+/**
+ * The claim's rationale on its own line, or null. It is kept when a later edit changes the figures, so
+ * it is shown beside the basis it now carries rather than left to `--json`.
+ */
+export declare function economicsRationaleLine(economics: Economics | null | undefined): string | null;
+export {};

package/dist/lib/task-economics-line.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * The Task's stored economic claim as one line for `tasks show` (OSK-15363).
+ *
+ * The detail view printed no savings, effort, risk, basis or confirmer at all: only `--json` carried
+ * them, with the confirmer as a raw user id, though `docs/cli/SKRR_TASKS.md` sends a reader to "ordinary
+ * task detail" for the claim. A claim is not a measurement, so the basis is part of the line.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.economicsLine = economicsLine;
+exports.economicsRationaleLine = economicsRationaleLine;
+const format_1 = require("./format");
+const BASIS = {
+    agent_estimate: 'Agent estimate',
+    human_confirmed: 'Human confirmed',
+    measured: 'Measured',
+};
+/** Null when the Task carries no claim at all. `confirmerName` is the resolved name, if there is one. */
+function economicsLine(economics, confirmerName) {
+    if (!economics || typeof economics !== 'object')
+        return null;
+    const parts = [];
+    const savings = economics.savings;
+    if (savings && typeof savings.amount === 'number') {
+        parts.push(`${savings.currency ?? 'USD'} ${savings.amount}${savings.per ? `/${savings.per}` : ''} saved`);
+    }
+    if (typeof economics.effortHours === 'number')
+        parts.push(`${economics.effortHours}h effort`);
+    if (economics.risk)
+        parts.push(`risk ${economics.risk}`);
+    if (parts.length === 0)
+        return null;
+    // Part of the claim, and kept across a later re-estimate: a reader must see what the label covers (OSK-15372).
+    if (economics.confidence)
+        parts.push(`confidence ${economics.confidence}`);
+    const basis = economics.basis ? (BASIS[economics.basis] ?? economics.basis) : 'basis not stated';
+    const who = economics.confirmedBy ? ` by ${confirmerName || economics.confirmedBy}` : '';
+    const when = economics.confirmedAt ? ` on ${String(economics.confirmedAt).slice(0, 10)}` : '';
+    const revision = typeof economics.revision === 'number' ? ` (claim revision ${economics.revision})` : '';
+    return `${parts.join(' · ')} · ${basis}${who}${when}${revision} — a claim, not a measurement`;
+}
+/**
+ * The claim's rationale on its own line, or null. It is kept when a later edit changes the figures, so
+ * it is shown beside the basis it now carries rather than left to `--json`.
+ */
+function economicsRationaleLine(economics) {
+    const rationale = economics?.rationale;
+    return typeof rationale === 'string' && rationale.trim() ? (0, format_1.collapseWhitespace)(rationale) : null;
+}