@skrr-ai/cli 0.1.108 → 0.1.110

package/dist/commands/agents/update.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AGENT_FENCE_RETRY_CODES = void 0;
 exports.agentUpdateWarnings = agentUpdateWarnings;
+exports.agentRowFromUpdate = agentRowFromUpdate;
+exports.alwaysOnReceiptLine = alwaysOnReceiptLine;
+exports.writeReceiptWarnings = writeReceiptWarnings;
 exports.retryOnceOnAgentFence = retryOnceOnAgentFence;
 exports.defaultPermissionModePatch = defaultPermissionModePatch;
 exports.defaultPermissionModeNote = defaultPermissionModeNote;
@@ -184,7 +187,9 @@ class AgentsUpdate extends base_command_1.BaseCommand {
             this.error(err.message, { exit: 1 });
         }
         if (Object.keys(payload).length === 0) {
-            this.error('Nothing to update. Pass at least one flag (e.g. --name) or --from-json.', { exit: 1 });
+            this.error('Nothing to update. Pass at least one flag (e.g. --name) or --from-json.', {
+                exit: 1,
+            });
         }
         let updated;
         try {
@@ -209,8 +214,26 @@ class AgentsUpdate extends base_command_1.BaseCommand {
             this.log(JSON.stringify((0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, updated), null, 2));
             return;
         }
-        const a = updated;
-        this.log(`Updated agent ${a.id ?? a._id ?? args.id} — ${a.name ?? '(no name)'}`);
+        // The Always-On control replies with its own envelope, which names no agent.
+        // Name it from the Agent's own row, not "(no name)" (OSK-16477).
+        const a = agentRowFromUpdate(updated) ?? { id: args.id };
+        if (typeof a.name !== 'string') {
+            try {
+                const row = (await data_provider_1.dataService.getAgentById({ agent_id: args.id }));
+                if (row &&
+                    typeof row === 'object' &&
+                    typeof row.name === 'string') {
+                    a.name = row.name;
+                }
+            }
+            catch {
+                // The update already happened; a failed name read only costs the label.
+            }
+        }
+        this.log(`Updated agent ${a.id ?? a._id ?? args.id} — ${typeof a.name === 'string' ? a.name || '(no name)' : '(name unavailable)'}`);
+        const alwaysOnLine = alwaysOnReceiptLine(payload, updated);
+        if (alwaysOnLine)
+            this.log(alwaysOnLine);
         this.log(`URL: ${(0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, { ...a, id: a.id ?? a._id ?? args.id }).url ?? '-'}`);
         const modeNote = defaultPermissionModeNote(flags['default-permission-mode'], a);
         if (modeNote)
@@ -240,9 +263,18 @@ exports.default = AgentsUpdate;
  *   through `--from-json` was reported as "not an agent field" after the server
  *   had cleared it on purpose (OSK-12167).
  *
+ * All of that is the fallback for a server that predates `writeReceipt`. When
+ * the response carries a receipt, the server's own account of each key is used
+ * instead and nothing is inferred from the response's shape (OSK-15070).
+ *
  * Exported for tests.
  */
 function agentUpdateWarnings(payload, updated) {
+    // A server that reports what it did with each key is the authority; the
+    // shape comparison below is only for a server older than the receipt.
+    const receipt = (0, data_provider_1.readAgentWriteReceipt)(updated);
+    if (receipt)
+        return writeReceiptWarnings(payload, receipt);
     const isRecord = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
     const controlReply = isRecord(updated) &&
         typeof updated.agentId === 'string' &&
@@ -273,6 +305,69 @@ function agentUpdateWarnings(payload, updated) {
         ...(unapplied.length > 0 ? [(0, create_1.unappliedPayloadKeysWarning)(unapplied)] : []),
     ];
 }
+/**
+ * The Agent row inside an update reply: the reply itself for an ordinary
+ * PATCH, `agent` inside the Always-On control envelope, or null when the
+ * control reply carries none (a PATCH of `isAlwaysOn` alone). Exported for tests.
+ */
+function agentRowFromUpdate(updated) {
+    if (!updated || typeof updated !== 'object' || Array.isArray(updated))
+        return null;
+    const reply = updated;
+    const isControlReply = typeof reply.agentId === 'string' && reply.state !== null && typeof reply.state === 'object';
+    if (!isControlReply)
+        return { ...reply };
+    const agent = reply.agent;
+    return agent && typeof agent === 'object' && !Array.isArray(agent)
+        ? { ...agent, id: agent.id ?? reply.agentId }
+        : { id: reply.agentId };
+}
+/**
+ * One line for an `isAlwaysOn` write, from the receipt: applied, or already in
+ * that state so nothing changed (OSK-16477). Exported for tests.
+ */
+function alwaysOnReceiptLine(payload, updated) {
+    if (typeof payload.isAlwaysOn !== 'boolean')
+        return null;
+    const receipt = (0, data_provider_1.readAgentWriteReceipt)(updated);
+    if (!receipt)
+        return null;
+    const state = payload.isAlwaysOn ? 'on' : 'off';
+    if (receipt.unchanged.some((entry) => entry.field === 'isAlwaysOn')) {
+        return `Always-On: already ${state}; nothing changed.`;
+    }
+    if (receipt.applied.some((entry) => entry.field === 'isAlwaysOn')) {
+        return `Always-On: turned ${state}.`;
+    }
+    return null;
+}
+/**
+ * Warnings from the server's `writeReceipt` (OSK-15070). The receipt names
+ * every key the write saw as applied (and through which control: the legacy
+ * `isAlwaysOn` goes to the Always-On control and is applied, not "not kept") or
+ * ignored with a reason. A sent key it does not mention never reached the write.
+ *
+ * Exported for tests.
+ */
+function writeReceiptWarnings(payload, receipt) {
+    const explained = receipt.ignored
+        .filter((entry) => entry.reason !== 'not_an_agent_field')
+        .map((entry) => `${entry.field}: ${entry.detail || 'ignored by the server'}`);
+    const notFields = receipt.ignored
+        .filter((entry) => entry.reason === 'not_an_agent_field')
+        .map((entry) => entry.field);
+    const unreported = (0, data_provider_1.unreportedAgentWriteFields)(payload, receipt);
+    const warnings = [...explained];
+    if (notFields.length > 0)
+        warnings.push((0, create_1.unappliedPayloadKeysWarning)(notFields));
+    if (unreported.length > 0) {
+        const one = unreported.length === 1;
+        warnings.push(`The server did not receive ${unreported.join(', ')}: a request filter removed ` +
+            `${one ? 'it' : 'them'} before the write, so nothing was changed for ${one ? 'it' : 'them'}. ` +
+            '`skrr agents show <id> --json` shows what the agent stores.');
+    }
+    return warnings;
+}
 /**
  * The per-Agent mutation fence's "another request holds this right now"
  * refusals. `updateAgent` takes a short lease on the Agent before it writes, so

package/dist/commands/commitments/accounting.js

@@ -4,6 +4,7 @@ exports.formatAccountingReadout = formatAccountingReadout;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const commitments_1 = require("../../lib/commitments");
+const cost_1 = require("./cost");
 /**
  * `skrr commitments accounting <id>` — the allowance-accounting SHADOW readout.
  *
@@ -92,14 +93,18 @@ function formatAccountingReadout(readout) {
     // a priced window and an unpriced one read alike (OSK-10940).
     const costStatus = readout.costStatus ?? 'not_applicable';
     const costCaveat = {
-        reported: 'every run reported a cost',
+        reported: "every run's cost is known",
         partial: 'some runs reported no cost — the total is a FLOOR',
         unavailable: 'no run reported a cost — the total is meaningless',
         not_applicable: 'no closed runs in the window',
     };
     lines.push(`Window cost:     $${(Number(readout.costUsdMicros || 0) / 1_000_000).toFixed(4)}` +
         ` — ${costStatus}: ${costCaveat[costStatus] ?? 'unrecognized cost status'}` +
-        ` (${Number(readout.costReportedRunCount || 0)} of ${Number(readout.costRunCount || 0)} runs priced)`);
+        ` (${Number(readout.costReportedRunCount || 0)} of ${Number(readout.costRunCount || 0)} runs priced` +
+        `, ${Number(readout.costNoSpendRunCount || 0)} refused before starting)`);
+    const noSpendNote = (0, cost_1.noSpendInferenceNote)(Number(readout.costNoSpendRunCount || 0), Number(readout.costNoSpendInferredRunCount || 0));
+    if (noSpendNote)
+        lines.push(noSpendNote);
     const multiplier = readout.recommendedAttemptMultiplier;
     lines.push('');
     lines.push(`Attempt multiplier: ${multiplier == null ? 'not derivable yet' : multiplier}` +

package/dist/commands/commitments/cost.d.ts

@@ -60,3 +60,14 @@ export default class CommitmentsCost extends BaseCommand {
  * formed a belief by the time they reach the caveat.
  */
 export declare function formatCostWindow(data: CommitmentCostWindow): string[];
+/**
+ * The line that says when "cost nothing" rests on inference (OSK-15500).
+ *
+ * A Run refused before any model turn records that fact when it is refused.
+ * Runs written before the fact was recorded are judged by the platform's legacy
+ * inference (admission-denied status, a pre-start refusal code, cancelled before
+ * any claim). Both are counted as $0 by the live budget, the spend ledger and
+ * this read alike — but a reader must be able to tell a recorded fact from an
+ * inferred one, so an inferred share is always printed, never folded in.
+ */
+export declare function noSpendInferenceNote(noSpend: number, inferred: number): string | null;

package/dist/commands/commitments/cost.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveCostWindow = resolveCostWindow;
 exports.formatCostWindow = formatCostWindow;
+exports.noSpendInferenceNote = noSpendInferenceNote;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const commitments_1 = require("../../lib/commitments");
@@ -113,18 +114,40 @@ function formatCostWindow(data) {
     const micros = Number(data.costUsdMicros || 0);
     const runs = Number(data.runCount || 0);
     const unattributed = Number(data.unavailableRunCount || 0);
+    const noSpend = Number(data.noSpendRunCount || 0);
     const status = data.costStatus ?? 'not_applicable';
     const caveat = {
-        reported: 'every run in the window reported a cost',
+        reported: "every run's cost in the window is known",
         partial: 'some runs reported no cost — the total below is a FLOOR',
         unavailable: 'no run in the window reported a cost — the total below is meaningless',
         not_applicable: 'no closed runs in the window',
     };
-    return [
+    const lines = [
         `Cost for ${data.commitmentId ?? '-'}`,
         `Window:      ${data.from ?? '-'} → ${data.to ?? '-'} (${Number(data.dayCount || 0)} closed day(s))`,
         `Attribution: ${status} — ${caveat[status] ?? 'unrecognized cost status'}`,
         `Cost:        $${(micros / 1_000_000).toFixed(4)}`,
-        `Runs:        ${runs} (${Number(data.reportedRunCount || 0)} with cost, ${unattributed} without)`,
+        `Runs:        ${runs} (${Number(data.reportedRunCount || 0)} with cost, ` +
+            `${noSpend} refused before starting, ${unattributed} without)`,
     ];
+    const note = noSpendInferenceNote(noSpend, Number(data.noSpendInferredRunCount || 0));
+    if (note)
+        lines.push(note);
+    return lines;
+}
+/**
+ * The line that says when "cost nothing" rests on inference (OSK-15500).
+ *
+ * A Run refused before any model turn records that fact when it is refused.
+ * Runs written before the fact was recorded are judged by the platform's legacy
+ * inference (admission-denied status, a pre-start refusal code, cancelled before
+ * any claim). Both are counted as $0 by the live budget, the spend ledger and
+ * this read alike — but a reader must be able to tell a recorded fact from an
+ * inferred one, so an inferred share is always printed, never folded in.
+ */
+function noSpendInferenceNote(noSpend, inferred) {
+    if (!(inferred > 0))
+        return null;
+    return (`Note:        ${inferred} of the ${noSpend} run(s) refused before starting are counted ` +
+        'as $0 by inference (recorded before refusals were stored), not from a recorded refusal');
 }

package/dist/commands/commitments/create.js

@@ -156,7 +156,8 @@ function createCadenceFromFlags({ eventDriven, cadence: cadenceInput, cadenceMod
  * For a natural-language draft instead of flags, use `skrr commitments plan`.
  */
 class CommitmentsCreate extends base_command_1.BaseCommand {
-    static description = 'Create a commitment (a durable agent contract)';
+    static description = 'Create a commitment (a durable agent contract). Its cadence is manual, an interval or daily clock times; ' +
+        'it has no weekday, holiday, business-day or trading-calendar fields';
     static examples = [
         '<%= config.bin %> commitments create --agent <agent-id> --title "Ship v2" --outcome "v2 is live for all users" --cadence 6h',
         '<%= config.bin %> commitments create --agent <agent-id> --title "Hiring loop" --outcome "Every candidate hears back in 48h" --watch tasks --watch email --cadence 12h',

package/dist/commands/commitments/operating-review.d.ts

@@ -1,5 +1,7 @@
+import type { CommitmentLoopStatus } from '@skrr-ai/data-provider';
 import { BaseCommand } from '../../base-command';
 type SystemCommitmentRow = {
+    id?: string;
     systemRole?: string;
     status?: string;
     lastCheckedAt?: string;
@@ -13,6 +15,19 @@ type SystemCommitmentRow = {
  * (OSK-15438): an Agent that cannot run cannot have asked.
  */
 export declare function noQuestionsSentence(alwaysOn: boolean, roles: SystemCommitmentRow[]): string;
+/**
+ * What the roster said about this Agent's loops, or why it could not be read. The review's own rows
+ * carry only the stored lifecycle status; whether a loop is armed, when it next wakes, why it last
+ * stopped and whether it can read its sources come from the roster (OSK-15438, OSK-15412).
+ */
+export type OperatingReviewLoops = {
+    rows: Map<string, CommitmentLoopStatus>;
+    truncated: boolean;
+} | {
+    error: string;
+};
+/** The review as text. Pure, so the whole output can be pinned. */
+export declare function formatOperatingReview(review: Record<string, unknown>, loops: OperatingReviewLoops): string[];
 export default class CommitmentsOperatingReview extends BaseCommand {
     static description: string;
     static args: {

package/dist/commands/commitments/operating-review.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noQuestionsSentence = noQuestionsSentence;
+exports.formatOperatingReview = formatOperatingReview;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
+const commitment_loop_status_1 = require("../../lib/commitment-loop-status");
 const commitments_1 = require("../../lib/commitments");
 /** What each silent loop is for, in the owner's terms rather than the role key. */
 const ROLE_PURPOSE = {
@@ -39,6 +41,79 @@ function noQuestionsSentence(alwaysOn, roles) {
         ? 'None. It has not told you anything is missing.'
         : 'None recorded yet. None of its loops has checked, so this says nothing about whether anything is missing.';
 }
+/** The review as text. Pure, so the whole output can be pinned. */
+function formatOperatingReview(review, loops) {
+    const lines = [];
+    const roles = review.systemCommitments || [];
+    const alwaysOn = review.alwaysOn === true;
+    const questions = review.openQuestions || [];
+    const portfolio = review.portfolio || {};
+    const metrics = review.metrics || {};
+    lines.push(`Agent ${review.agentId}`);
+    lines.push('');
+    // A loop's own status says `active`, but a system-managed loop is only
+    // given a scheduling trigger while the Agent is Always-On. Printing
+    // `active` beside "last checked never" without saying that read as
+    // "nothing has happened yet" rather than "this cannot happen", and nothing
+    // led the owner to the switch that decides it.
+    if (!alwaysOn) {
+        lines.push('Always-On is OFF — these loops are provisioned but will not run.');
+        lines.push(`  skrr agents always-on enable ${review.agentId}`);
+        lines.push('');
+    }
+    lines.push('Background loops');
+    if (roles.length === 0) {
+        lines.push('  (none provisioned)');
+    }
+    if ('error' in loops) {
+        // "Cannot see" must not read as "nothing to report": say what is missing and what it hides.
+        lines.push(`  Loop detail unavailable (${loops.error}). The states below are the stored lifecycle only; ` +
+            'they do not say whether a loop is armed, what it can read, or why it last stopped.');
+    }
+    for (const role of roles) {
+        const key = role.systemRole || '?';
+        const purpose = ROLE_PURPOSE[key] ? ` — ${ROLE_PURPOSE[key]}` : '';
+        const contact = role.maxUserNudgesPerDay && role.maxUserNudgesPerDay > 0
+            ? `may contact you ${role.maxUserNudgesPerDay}/day`
+            : 'never contacts you';
+        // `idle` replaces `active` only. A paused loop is paused for its own
+        // reason — Relationship Pulse ships paused as a separate consent
+        // decision — and collapsing that into `idle` would hide a distinction
+        // the owner needs when they do turn Always-On on.
+        const state = !alwaysOn && role.status === 'active' ? 'idle' : role.status || '?';
+        lines.push(`  ${state.padEnd(7)} ${key}${purpose}`);
+        lines.push(`          last checked ${ago(role.lastCheckedAt)} · ${contact}`);
+        if ('rows' in loops) {
+            const row = role.id ? loops.rows.get(role.id) : undefined;
+            if (row) {
+                for (const line of (0, commitment_loop_status_1.formatLoopSummary)(row))
+                    lines.push(`          ${line}`);
+            }
+            else {
+                lines.push(`          loop detail: not in the roster read${loops.truncated ? ' (the roster is bounded and this Agent holds more)' : ''}; run \`skrr commitments status ${role.id ?? '<id>'}\``);
+            }
+        }
+    }
+    lines.push('');
+    lines.push(`Open questions from this agent (${questions.length})`);
+    if (questions.length === 0) {
+        lines.push(`  ${noQuestionsSentence(alwaysOn, roles)}`);
+    }
+    for (const q of questions) {
+        lines.push(`  • ${q.question}`);
+        if (q.whyItMatters)
+            lines.push(`    why: ${q.whyItMatters}`);
+        lines.push(`    asked ${ago(q.askedAt)}`);
+    }
+    lines.push('');
+    const drafts = portfolio.draftCommitmentCount ?? 0;
+    lines.push(`Business commitments: ${portfolio.activeCommitmentCount ?? 0} active, ${portfolio.pausedCommitmentCount ?? 0} paused${drafts > 0 ? `, ${drafts} draft` : ''}`);
+    if (typeof metrics.awaitingApproval === 'number') {
+        lines.push(`Proposals awaiting your approval: ${metrics.awaitingApproval}`);
+    }
+    lines.push(`Every commitment it holds, loop by loop: skrr commitments roster --agent ${review.agentId}`);
+    return lines;
+}
 class CommitmentsOperatingReview extends base_command_1.BaseCommand {
     static description = 'Read an agent’s system-managed commitment operating review';
     static args = {
@@ -60,61 +135,39 @@ class CommitmentsOperatingReview extends base_command_1.BaseCommand {
         catch (error) {
             this.handleApiError(error);
         }
+        // The roster is a second read; its failure must not take the review down with it, and must not
+        // pass for "nothing to report" either.
+        let loops;
+        try {
+            const roster = await commitments_1.commitmentApi.roster(args.agentId);
+            loops = {
+                rows: new Map((Array.isArray(roster.commitments) ? roster.commitments : []).map((row) => [
+                    row.commitmentId,
+                    row,
+                ])),
+                truncated: roster.truncated === true,
+            };
+        }
+        catch (error) {
+            loops = { error: error instanceof Error ? error.message : String(error) };
+        }
         if (flags.json) {
-            this.log(JSON.stringify(result, null, 2));
+            const review = result;
+            const roles = review.systemCommitments || [];
+            this.log(JSON.stringify('error' in loops
+                ? { ...review, loopStatusError: loops.error }
+                : {
+                    ...review,
+                    loopStatus: roles
+                        .map((role) => (role.id ? loops.rows.get(role.id) : undefined))
+                        .filter((row) => row !== undefined),
+                }, null, 2));
             return;
         }
         // Without this the command printed raw JSON in both modes, which is why the
         // meta loops read as machinery rather than as something an owner supervises.
-        const review = result;
-        const roles = review.systemCommitments || [];
-        const alwaysOn = review.alwaysOn === true;
-        const questions = review.openQuestions || [];
-        const portfolio = review.portfolio || {};
-        this.log(`Agent ${review.agentId}`);
-        this.log('');
-        // A loop's own status says `active`, but a system-managed loop is only
-        // given a scheduling trigger while the Agent is Always-On. Printing
-        // `active` beside "last checked never" without saying that read as
-        // "nothing has happened yet" rather than "this cannot happen", and nothing
-        // led the owner to the switch that decides it.
-        if (!alwaysOn) {
-            this.log('Always-On is OFF — these loops are provisioned but will not run.');
-            this.log(`  skrr agents always-on enable ${review.agentId}`);
-            this.log('');
-        }
-        this.log('Background loops');
-        if (roles.length === 0) {
-            this.log('  (none provisioned)');
-        }
-        for (const role of roles) {
-            const key = role.systemRole || '?';
-            const purpose = ROLE_PURPOSE[key] ? ` — ${ROLE_PURPOSE[key]}` : '';
-            const contact = role.maxUserNudgesPerDay && role.maxUserNudgesPerDay > 0
-                ? `may contact you ${role.maxUserNudgesPerDay}/day`
-                : 'never contacts you';
-            // `idle` replaces `active` only. A paused loop is paused for its own
-            // reason — Relationship Pulse ships paused as a separate consent
-            // decision — and collapsing that into `idle` would hide a distinction
-            // the owner needs when they do turn Always-On on.
-            const state = !alwaysOn && role.status === 'active' ? 'idle' : role.status || '?';
-            this.log(`  ${state.padEnd(7)} ${key}${purpose}`);
-            this.log(`          last checked ${ago(role.lastCheckedAt)} · ${contact}`);
-        }
-        this.log('');
-        this.log(`Open questions from this agent (${questions.length})`);
-        if (questions.length === 0) {
-            this.log(`  ${noQuestionsSentence(alwaysOn, roles)}`);
-        }
-        for (const q of questions) {
-            this.log(`  • ${q.question}`);
-            if (q.whyItMatters)
-                this.log(`    why: ${q.whyItMatters}`);
-            this.log(`    asked ${ago(q.askedAt)}`);
-        }
-        this.log('');
-        const drafts = portfolio.draftCommitmentCount ?? 0;
-        this.log(`Business commitments: ${portfolio.activeCommitmentCount ?? 0} active, ${portfolio.pausedCommitmentCount ?? 0} paused${drafts > 0 ? `, ${drafts} draft` : ''}`);
+        for (const line of formatOperatingReview(result, loops))
+            this.log(line);
     }
 }
 exports.default = CommitmentsOperatingReview;

package/dist/commands/commitments/update.js

@@ -31,7 +31,8 @@ const commitments_1 = require("../../lib/commitments");
  * the contract untouched.
  */
 class CommitmentsUpdate extends base_command_1.BaseCommand {
-    static description = "Update a commitment's contract (title, target, cadence, sources)";
+    static description = "Update a commitment's contract (title, target, cadence, sources). A cadence is manual, an interval or daily clock times; " +
+        'it has no weekday, holiday, business-day or trading-calendar fields';
     static examples = [
         '<%= config.bin %> commitments update <commitment-id> --cadence 12h',
         '<%= config.bin %> commitments update <commitment-id> --title "Ship v2 (Q3)" --outcome "v2 is live for all users"',
@@ -275,9 +276,13 @@ JSON
                 // only for a binding it still names; explicit JSON is the authored base.
                 const declarations = Array.isArray(payload.watchedSources)
                     ? (0, commitments_1.normalizeWatchedSourceDeclarations)(payload.watchedSources)
-                    : current?.watchedSources ?? [];
+                    : (current?.watchedSources ?? []);
                 payload.watchedSources = built.map((next) => {
-                    const scopeKey = next.source === 'space' ? 'spaceId' : next.source === 'monitor' ? 'monitorId' : undefined;
+                    const scopeKey = next.source === 'space'
+                        ? 'spaceId'
+                        : next.source === 'monitor'
+                            ? 'monitorId'
+                            : undefined;
                     const nextConfig = next.config;
                     const prior = declarations.find((binding) => binding?.source === next.source &&
                         (!scopeKey || binding.config?.[scopeKey] === nextConfig?.[scopeKey]));
@@ -301,7 +306,9 @@ JSON
                         storedCadence[key] = existing[key];
                 }
                 if (payload.cadence !== undefined) {
-                    if (!payload.cadence || typeof payload.cadence !== 'object' || Array.isArray(payload.cadence)) {
+                    if (!payload.cadence ||
+                        typeof payload.cadence !== 'object' ||
+                        Array.isArray(payload.cadence)) {
                         this.error('cadence must be a JSON object when using cadence flags.', { exit: 1 });
                     }
                 }
@@ -403,7 +410,7 @@ JSON
             this.log(JSON.stringify((0, web_url_1.withCommitmentUrl)(this.cliConfig.baseURL, commitment), null, 2));
             return;
         }
-        this.log('Updated commitment:');
+        this.log((0, commitments_1.describeCommitmentRevision)(commitment?.revision));
         (0, commitments_1.renderCommitmentSummary)(commitment, (line) => this.log(line));
     }
 }

package/dist/commands/daemon/install.js

@@ -5,6 +5,9 @@ const exec_runtime_binary_1 = require("../../lib/exec-runtime-binary");
 const daemon_binding_1 = require("../../lib/daemon-binding");
 const daemon_installer_1 = require("../../lib/daemon-installer");
 const daemon_setup_1 = require("../../lib/daemon-setup");
+const daemonHandoff_1 = require("../../lib/daemonHandoff");
+const daemon_machine_identity_copy_1 = require("../../lib/daemon-machine-identity-copy");
+const live_runtime_binary_1 = require("../../lib/live-runtime-binary");
 /**
  * `skrr daemon install` — install the local runtime's OS service.
  *
@@ -83,7 +86,20 @@ class DaemonInstall extends core_1.Command {
             // moment the binding is chosen, and leaving it to a separate command
             // is how a CLI and its daemon end up on different deployments
             // (OSK-279) without anyone doing anything wrong.
-            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['install', ...(0, daemon_binding_1.bindToCliSession)(argv)]);
+            const installArgs = (0, daemon_binding_1.bindToCliSession)(argv);
+            // A service installed from a daemon that predates per-profile machine
+            // identities runs that daemon for good, and registers the profile on the
+            // default profile's machine row (OSK-S-440). Ask the binary about to run.
+            // `--help` and `--json` are not installs.
+            if (!installArgs.some((arg) => ['--help', '-h'].includes(arg))) {
+                const skew = await (0, daemonHandoff_1.checkLocalDaemonMachineIdentity)((0, live_runtime_binary_1.profileFromArgs)(installArgs));
+                if (skew) {
+                    for (const line of (0, daemon_machine_identity_copy_1.describeDaemonMachineIdentitySkew)(skew))
+                        this.logToStderr(line);
+                    this.exit(78);
+                }
+            }
+            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['install', ...installArgs]);
             if (code === 0 &&
                 !argv.some((arg) => ['--json', '--help', '-h'].includes(arg))) {
                 this.log('Coding-agent instructions: sign in with `skrr login`, or review installation choices with `skrr instructions setup`.');

package/dist/commands/daemon/login.js

@@ -4,6 +4,8 @@ const core_1 = require("@oclif/core");
 const daemon_binding_1 = require("../../lib/daemon-binding");
 const exec_runtime_binary_1 = require("../../lib/exec-runtime-binary");
 const live_runtime_binary_1 = require("../../lib/live-runtime-binary");
+const daemonHandoff_1 = require("../../lib/daemonHandoff");
+const daemon_machine_identity_copy_1 = require("../../lib/daemon-machine-identity-copy");
 /**
  * `skrr daemon login` — authenticate the local runtime.
  *
@@ -53,6 +55,18 @@ class DaemonLogin extends core_1.Command {
             if (decision?.kind === 'forward-live') {
                 this.warn(`Signing in with the live daemon binary ${decision.binary}.`);
             }
+            // The binary about to sign this profile in must register it under the
+            // machine identity the profile has (OSK-S-440): a daemon that predates
+            // per-profile identities would bind this login to the default profile's
+            // machine row. `--help` is not a login.
+            if (!boundArgv.some((arg) => ['--help', '-h'].includes(arg))) {
+                const skew = await (0, daemonHandoff_1.checkLocalDaemonMachineIdentity)((0, live_runtime_binary_1.profileFromArgs)(boundArgv), decision?.binary ?? pathBinary);
+                if (skew) {
+                    for (const line of (0, daemon_machine_identity_copy_1.describeDaemonMachineIdentitySkew)(skew))
+                        this.logToStderr(line);
+                    this.exit(78);
+                }
+            }
             // `--cwd` is deliberately NOT defaulted here. `skrrd login` resolves it
             // from the installed service definition, which is the only authoritative
             // answer; guessing it from the CLI's cwd is exactly the mistake that made

package/dist/commands/doctor.js

@@ -49,6 +49,7 @@ const cli_runtime_1 = require("../lib/cli-runtime");
 const command_manifest_1 = require("../lib/command-manifest");
 const completion_index_1 = require("../lib/completion-index");
 const runtime_context_1 = require("../lib/runtime-context");
+const deployed_build_1 = require("../lib/deployed-build");
 const outbox_1 = require("../lib/outbox");
 /**
  * What each check actually verifies, in the words a reader thinks in.
@@ -230,6 +231,9 @@ class Doctor extends base_command_1.BaseCommand {
                 }
             }
         }
+        // OSK-15497 — which code the server is running, API and web separately.
+        // Public reads, no credential; a failure is reported, never an issue.
+        const deployed = await (0, deployed_build_1.readDeployedBuild)(this.cliConfig.baseURL);
         const now = Date.now();
         const jwtExp = this.resolvedCredential?.token
             ? (0, auth_core_1.decodeJwtExpiry)(this.resolvedCredential.token)
@@ -287,6 +291,9 @@ class Doctor extends base_command_1.BaseCommand {
                 command: process.argv.slice(1).join(' '),
             },
             server: this.cliConfig.baseURL,
+            // The commit the server's API image and its published web shell were
+            // each built from. They differ whenever a release changed only one.
+            deployed,
             profile: (0, keychain_1.getActiveProfile)(),
             config: {
                 path: (0, config_1.getConfigPath)(),
@@ -351,6 +358,8 @@ class Doctor extends base_command_1.BaseCommand {
         }
         this.log(`skrr CLI ${payload.cli.version} at ${root}`);
         this.log(`Server: ${payload.server}`);
+        for (const line of (0, deployed_build_1.deployedBuildLines)(deployed))
+            this.log(line);
         this.log(`Auth:   ${payload.auth.signedIn
             ? `${account?.email ?? account?.id}`
             : serverReachability === 'unavailable'

package/dist/commands/goals/list.js

@@ -5,6 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const web_url_1 = require("../../lib/web-url");
 const format_1 = require("../../lib/format");
+const list_output_1 = require("../../lib/list-output");
 class GoalsList extends base_command_1.BaseCommand {
     static description = 'List goals';
     static examples = [
@@ -72,7 +73,11 @@ class GoalsList extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify((0, web_url_1.withDataUrls)(this.cliConfig.baseURL, response, web_url_1.goalUrlFrom), null, 2));
+            // The one list envelope (`{object:'list', data, has_more, next_cursor}`), so
+            // a script reads `.data` here exactly as it does for tasks and projects. The
+            // space-scoped endpoint is not paginated and answers a bare `{data}`; filling
+            // the missing fields is additive, so nothing that read `.data` changes.
+            this.log(JSON.stringify((0, web_url_1.withDataUrls)(this.cliConfig.baseURL, (0, list_output_1.toListEnvelope)(response) ?? response, web_url_1.goalUrlFrom), null, 2));
             return;
         }
         // Both listGoals and listSpaceGoals return { data: Goal[] }. The general

package/dist/commands/grants/rotate.js

@@ -51,6 +51,10 @@ class GrantsRotate extends base_command_1.BaseCommand {
         }
         this.log(`Rotated grant ${grant.id}.`);
         this.log(`  variables: ${grant.credential?.envKeys.join(', ') || '—'}`);
+        // When the server recorded the new value: the proof the rotation landed,
+        // without anything derived from the value itself (OSK-15358).
+        if (grant.credential?.setAt)
+            this.log(`  value set: ${grant.credential.setAt}`);
         if (!grant.access) {
             this.log('  access: not declared (rotation clears the declared class; use --access to re-declare)');
         }