@skrr-ai/cli 0.1.109 → 0.1.110

package/dist/lib/commitments.js

@@ -958,40 +958,38 @@ function describeOperation(operation, reason) {
     };
     return `not running — ${meaning[status] ?? status}`;
 }
-/**
- * What to do about an operation that is not running, from the operating state's
- * first actionable blocker (`withLiveAssessment` carries it onto the view).
- *
- * `show` printed `Operation: blocked — typed_external_blocker` and nothing else,
- * so the one line a reader acts on was a code; the remediation the server
- * already composed sat only in `--json` and `doctor` (OSK-16212). Nothing is
- * printed while the operation is ready or working, where a fix would contradict
- * the line above it.
- *
- * Returns one or two lines. `Fix:` only when the blocker carries an action; a
- * typed blocker an agent returned carries only what happened, which printed
- * under "Fix:" read as a remedy nobody wrote (OSK-16230). That narrative is
- * labelled `Blocker:` instead, and no remedy is made up for it.
- */
 function describeOperationFix(commitment, operation) {
     if (operation === 'ready' || operation === 'working')
         return [];
     const blocker = commitment.firstActionableBlocker;
-    if (!blocker)
-        return [];
-    const remediation = typeof blocker.remediation === 'string' ? blocker.remediation.trim() : '';
-    const detail = typeof blocker.detail === 'string' ? blocker.detail.trim() : '';
-    const who = typeof blocker.ownerLabel === 'string' && blocker.ownerLabel
-        ? blocker.ownerLabel
-        : typeof blocker.owner === 'string' && blocker.owner
-            ? blocker.owner
-            : '';
     const lines = [];
-    // The detail is shown only when the fix does not already say it.
-    if (detail && detail !== remediation)
-        lines.push({ label: 'Blocker', text: `${detail}${!remediation && who ? ` (${who})` : ''}` });
-    if (remediation)
-        lines.push({ label: 'Fix', text: `${remediation}${who ? ` (${who})` : ''}` });
+    let remediation = '';
+    if (blocker) {
+        remediation = typeof blocker.remediation === 'string' ? blocker.remediation.trim() : '';
+        const detail = typeof blocker.detail === 'string' ? blocker.detail.trim() : '';
+        const who = typeof blocker.ownerLabel === 'string' && blocker.ownerLabel
+            ? blocker.ownerLabel
+            : typeof blocker.owner === 'string' && blocker.owner
+                ? blocker.owner
+                : '';
+        // The detail is shown only when the fix does not already say it.
+        if (detail && detail !== remediation)
+            lines.push({ label: 'Blocker', text: `${detail}${!remediation && who ? ` (${who})` : ''}` });
+        if (remediation)
+            lines.push({ label: 'Fix', text: `${remediation}${who ? ` (${who})` : ''}` });
+    }
+    // What refused the last Run is a second fact, not an alternative to the
+    // blocker: a paused Commitment whose Run was refused needs both a resume and
+    // the fix, or resuming only fails again (OSK-15389). The sentence is the
+    // server's, derived on read from the failure code; it is printed whenever it
+    // exists and says something the blocker's fix does not.
+    const liveness = commitment.state?.liveness;
+    const lastRunFix = liveness && liveness.current !== false && typeof liveness.diagnosisFix === 'string'
+        ? liveness.diagnosisFix.trim()
+        : '';
+    if (lastRunFix && lastRunFix !== remediation) {
+        lines.push({ label: lines.length ? 'Last run' : 'Fix', text: lastRunFix });
+    }
     return lines;
 }
 /**
@@ -1293,9 +1291,16 @@ function renderCheckList(checks, log) {
         // meant re-running the command with `--json` (OSK-6175).
         { key: 'id', header: 'ID', verbatim: true },
     ], log);
-    if (checks.some((c) => c.historyDetail)) {
-        log("'-' = not retained: an older check's detailed history was compacted; its stop and retained reason remain.");
-    }
+    // The legend states each distinct reason the server recorded, in the same
+    // words explain and cycles use; it never guesses "compacted" for a Check
+    // whose history is merely missing (OSK-15148).
+    const reasons = [
+        ...new Set(checks
+            .map((c) => (0, data_provider_2.describeCommitmentHistoryDetail)(c.historyDetail))
+            .filter((sentence) => Boolean(sentence))),
+    ];
+    if (reasons.length > 0)
+        log(`'-' = not retained. ${reasons.join(' ')}`);
 }
 function records(value) {
     return Array.isArray(value)
@@ -1663,14 +1668,9 @@ function formatCommitmentCycles(page) {
  */
 function formatCycleLatency(cycle) {
     const latency = cycle.latency;
-    const history = cycle.historyDetail;
-    const disclosure = history?.state === 'compacted'
-        ? [
-            `             Detailed history was compacted${history.at ? ` at ${history.at}` : ''}; available reason and source timestamps were retained.`,
-        ]
-        : history?.state === 'unavailable'
-            ? ['             Detailed history is unavailable; why it is missing was not recorded.']
-            : [];
+    // One sentence for every surface, from the server's own record (OSK-15148).
+    const historySentence = (0, data_provider_2.describeCommitmentHistoryDetail)(cycle.historyDetail);
+    const disclosure = historySentence ? [`             ${historySentence}`] : [];
     // A hop whose inputs were compacted away without a retained projection is
     // "not retained": it may have been measured and shown before (OSK-15148).
     const unretained = new Set(latency?.unretainedStages || []);

package/dist/lib/daemon-machine-identity-copy.d.ts

@@ -0,0 +1,14 @@
+import type { DaemonMachineIdentitySkew } from './daemon-machine-identity';
+/**
+ * What to tell someone whose installed background service would register their
+ * profile on the default profile's machine row (OSK-S-440).
+ *
+ * The consequence is stated before the remedy because the remedy costs something
+ * (updating a service) and the consequence is what justifies it: a second
+ * profile on the default's row replaces its Daemon and its device-key pin, and
+ * the default profile's next refresh is refused until it signs in again.
+ *
+ * Lives here, apart from the comparison, because this is copy and reads
+ * `BRAND.displayName`; the comparison is pure and imports nothing from it.
+ */
+export declare function describeDaemonMachineIdentitySkew(skew: DaemonMachineIdentitySkew): string[];

package/dist/lib/daemon-machine-identity-copy.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeDaemonMachineIdentitySkew = describeDaemonMachineIdentitySkew;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * What to tell someone whose installed background service would register their
+ * profile on the default profile's machine row (OSK-S-440).
+ *
+ * The consequence is stated before the remedy because the remedy costs something
+ * (updating a service) and the consequence is what justifies it: a second
+ * profile on the default's row replaces its Daemon and its device-key pin, and
+ * the default profile's next refresh is refused until it signs in again.
+ *
+ * Lives here, apart from the comparison, because this is copy and reads
+ * `BRAND.displayName`; the comparison is pure and imports nothing from it.
+ */
+function describeDaemonMachineIdentitySkew(skew) {
+    const product = data_provider_1.BRAND.displayName;
+    const said = skew.reported
+        ? `it reports machine identity ${skew.reported}, where profile '${skew.profile}' has ${skew.expected}`
+        : `it does not report a machine identity at all, so ${product} cannot tell which one it would use`;
+    return [
+        `The ${product} background service at ${skew.binary} does not support a separate machine identity per profile: ${said}.`,
+        `Using it for '${skew.profile}' would register that profile on the default profile's machine and could replace the default profile's device-key pin. Nothing was changed.`,
+        `Update the background service (skrr daemon update), or put a current skrrd first on your PATH, then run: skrr login --profile ${skew.profile}`,
+    ];
+}

package/dist/lib/daemon-machine-identity.d.ts

@@ -0,0 +1,27 @@
+export interface DaemonMachineIdentitySkew {
+    /** The profile being signed in. */
+    profile: string;
+    /** The machine identity this profile has, as decided by the profile's own record. */
+    expected: string;
+    /** What the daemon binary says it will send; null when it said nothing. */
+    reported: string | null;
+    /** The `skrrd` that was asked. */
+    binary: string;
+}
+/**
+ * Null when the daemon will register this profile under the identity it has;
+ * otherwise what disagrees.
+ *
+ * Not applicable to the default profile (its identity is the hardware value in
+ * every version), to a hosted runtime (the control plane issues it), or when no
+ * profile is named.
+ *
+ * A daemon that reports NOTHING is a skew, not a pass: this check exists because
+ * an older binary cannot say, and "could not confirm" must not read as "fine" on
+ * the step that binds a credential to a machine row.
+ */
+export declare function daemonMachineIdentitySkew(opts: {
+    profile: string | null | undefined;
+    binary: string;
+    reported: string | null | undefined;
+}): DaemonMachineIdentitySkew | null;

package/dist/lib/daemon-machine-identity.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.daemonMachineIdentitySkew = daemonMachineIdentitySkew;
+/**
+ * daemon-machine-identity.ts — does the installed daemon give this profile the
+ * machine identity the CLI decided it has?
+ *
+ * Two programs compute one identity: the CLI (and the profile's persisted
+ * `machine-identity.json`) say a profile that started new has its own machine
+ * row, and the DAEMON is what registers. A daemon that predates per-profile
+ * identities (OSK-13845) does not read that file; it sends the hardware value
+ * whatever the profile is. Nothing noticed. The CLI minted the daemon's credential
+ * for what the daemon REPORTED (`accept-handoff --print-id`), so the credential
+ * was bound to the default machine's row, the service registered there, and the
+ * failure OSK-13845 exists to prevent happened anyway: two profiles on one Daemon
+ * row and one device-key pin, the second profile's interactive login re-pinning
+ * the first one's key (OSK-S-440, profile `aapexp`).
+ *
+ * Measured, not inferred: the same new profile, in an empty home, answered by
+ * two `skrrd` binaries. The current one reports `<hardware>:p-<hash>` and writes
+ * `machine-identity.json` and `daemon-identity.json`; the build that was first on
+ * the dogfooder's PATH (a checkout `dist` from before OSK-13845, whose version
+ * string still reads the checkout's package.json) reports the bare hardware value
+ * and writes neither. The profile it left behind had a `machine-identity.json`
+ * (the CLI's) and no `daemon-identity.json` after four daemon starts.
+ *
+ * The fix is to compare, not to guess a version: ask the binary what it will
+ * send, compare with what this profile's decided identity is, and refuse BEFORE
+ * anything is minted or installed when they differ. Comparing the value is the
+ * only test that cannot be wrong about a build that is older than its own
+ * version string says.
+ *
+ * Pure: the I/O (spawning the binary) is in `daemonHandoff.ts`, the copy in
+ * `daemon-machine-identity-copy.ts`.
+ */
+const machine_uuid_1 = require("@skrr-ai/auth-core/machine-uuid");
+const keychain_1 = require("./keychain");
+/**
+ * Null when the daemon will register this profile under the identity it has;
+ * otherwise what disagrees.
+ *
+ * Not applicable to the default profile (its identity is the hardware value in
+ * every version), to a hosted runtime (the control plane issues it), or when no
+ * profile is named.
+ *
+ * A daemon that reports NOTHING is a skew, not a pass: this check exists because
+ * an older binary cannot say, and "could not confirm" must not read as "fine" on
+ * the step that binds a credential to a machine row.
+ */
+function daemonMachineIdentitySkew(opts) {
+    const profile = opts.profile?.trim();
+    if (!profile || profile === keychain_1.DEFAULT_PROFILE)
+        return null;
+    if ((0, machine_uuid_1.hostedRuntimeIdOverride)('OVERSKY_MACHINE_UUID'))
+        return null;
+    const expected = (0, machine_uuid_1.getMachineUuidForProfile)(profile);
+    const reported = opts.reported?.trim() || null;
+    if (reported === expected)
+        return null;
+    return { profile, expected, reported, binary: opts.binary };
+}

package/dist/lib/daemonHandoff.d.ts

@@ -1,3 +1,4 @@
+import { type DaemonMachineIdentitySkew } from './daemon-machine-identity';
 /**
  * Hand the local daemon a credential of its own, right after `skrr login`.
  *
@@ -40,8 +41,25 @@ export interface DaemonHandoffOutcome {
      * The two absent cases are separated because they need different work — one
      * needs a binary fetched, the other only needs the service registered.
      */
-    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service' | 'foreign-root' | 'mint-refused' | 'platform-managed';
+    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service' | 'foreign-root' | 'mint-refused' | 'platform-managed' | 'machine-identity-skew';
+    /** Set with `reason: 'machine-identity-skew'`; the caller words it. */
+    skew?: DaemonMachineIdentitySkew;
 }
 export declare function handOffToLocalDaemon(env?: NodeJS.ProcessEnv, opts?: {
     loginFlow?: string;
 }): Promise<DaemonHandoffOutcome>;
+/**
+ * Ask the installed daemon which machine identity it will register `profile`
+ * under, and say what disagrees with the profile's own (OSK-S-440).
+ *
+ * For the commands that install or sign in a daemon WITHOUT going through the
+ * credential hand-off (`skrr daemon install`, `skrr daemon login`): the same
+ * question, asked of the binary they are about to run. Null when the daemon
+ * agrees, when the profile is the default one, or when there is no binary to ask
+ * (the caller has its own answer for that).
+ *
+ * A binary that cannot be asked at all - too old to have `accept-handoff`, or
+ * one that fails the probe - is reported as a skew with no identity, because the
+ * point of asking is not to bind a profile to a machine row on a guess.
+ */
+export declare function checkLocalDaemonMachineIdentity(profile: string | null | undefined, binary?: string | null): Promise<DaemonMachineIdentitySkew | null>;

package/dist/lib/daemonHandoff.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handOffToLocalDaemon = handOffToLocalDaemon;
+exports.checkLocalDaemonMachineIdentity = checkLocalDaemonMachineIdentity;
 const node_child_process_1 = require("node:child_process");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const config_1 = require("./config");
 const daemon_handoff_opt_out_1 = require("./daemon-handoff-opt-out");
+const daemon_machine_identity_1 = require("./daemon-machine-identity");
 const dedicated_service_1 = require("./dedicated-service");
 const exec_runtime_binary_1 = require("./exec-runtime-binary");
 const keychain_1 = require("./keychain");
@@ -275,6 +277,26 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
         };
     }
     const { idSource, machineUuid, daemonServer } = parseIdProvenance(printed.stderr);
+    // Before anything is minted or installed: does THIS binary register the profile
+    // under the machine identity the profile has? The mint below binds the
+    // credential to the machine uuid the daemon just REPORTED, so a binary that
+    // reports the hardware value for a profile that has its own would put it on the
+    // default profile's row - and the install that follows would run that same
+    // binary as a service. Nothing about the id or the provenance would look wrong.
+    const skew = (0, daemon_machine_identity_1.daemonMachineIdentitySkew)({
+        profile: (0, keychain_1.getActiveProfile)(),
+        binary,
+        reported: machineUuid,
+    });
+    if (skew) {
+        return {
+            status: 'failed',
+            reason: 'machine-identity-skew',
+            skew,
+            detail: `the installed daemon reports machine identity ${skew.reported ?? '(none)'} ` +
+                `where profile '${skew.profile}' has ${skew.expected}`,
+        };
+    }
     // A well-formed id is not the same as a real daemon. With no service installed
     // the daemon derives one from whatever directory this process is in, so the id
     // above names a daemon that does not exist and will not exist under that id if
@@ -354,3 +376,40 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
         }),
     };
 }
+/**
+ * Ask the installed daemon which machine identity it will register `profile`
+ * under, and say what disagrees with the profile's own (OSK-S-440).
+ *
+ * For the commands that install or sign in a daemon WITHOUT going through the
+ * credential hand-off (`skrr daemon install`, `skrr daemon login`): the same
+ * question, asked of the binary they are about to run. Null when the daemon
+ * agrees, when the profile is the default one, or when there is no binary to ask
+ * (the caller has its own answer for that).
+ *
+ * A binary that cannot be asked at all - too old to have `accept-handoff`, or
+ * one that fails the probe - is reported as a skew with no identity, because the
+ * point of asking is not to bind a profile to a machine row on a guess.
+ */
+async function checkLocalDaemonMachineIdentity(profile, binary = (0, exec_runtime_binary_1.findRuntimeBinary)()) {
+    if (!profile || profile === keychain_1.DEFAULT_PROFILE || !binary)
+        return null;
+    const printed = await runOversky(binary, ['accept-handoff', '--print-id', '--profile', profile], {
+        timeoutMs: PROBE_TIMEOUT_MS,
+    });
+    if (!printed.ok) {
+        // A daemon too old to have `accept-handoff` answers "unknown command": it is
+        // older than per-profile identities too, which is the skew itself.
+        if (/unknown command/i.test(printed.stderr)) {
+            return (0, daemon_machine_identity_1.daemonMachineIdentitySkew)({ profile, binary, reported: null });
+        }
+        // Any other failed probe says nothing about the daemon's identity, and
+        // refusing a sign-in on a flaky probe would be a worse failure than the one
+        // this guards: let the command run and meet whatever the daemon itself says.
+        return null;
+    }
+    return (0, daemon_machine_identity_1.daemonMachineIdentitySkew)({
+        profile,
+        binary,
+        reported: parseIdProvenance(printed.stderr).machineUuid,
+    });
+}

package/dist/lib/harnesses.d.ts

@@ -238,6 +238,77 @@ export declare function updateHarness(id: string, patch: Record<string, unknown>
     harness?: Harness;
 }>;
 export declare function forgetHarness(id: string): Promise<unknown>;
+/**
+ * Why a superseded-looking row is KEPT by `harnesses prune`. Declared by the
+ * server (`pruneSupersededHarnesses.js`, `REASONS`) and worded once, in
+ * `harnessPruneReasonSentence`, so the table and `--json` never disagree.
+ */
+export type HarnessPruneReason = 'recent' | 'latest_registration' | 'no_live_sibling' | 'pinned' | 'granted' | 'default' | 'aliased' | 'changed_since_plan';
+export interface HarnessPruneRow {
+    id: string;
+    daemonId: string | null;
+    provider: string | null;
+    name: string | null;
+    lastSeenAt: string | null;
+    machineUuid: string | null;
+    /** The live sibling that replaced a row this call removes (or would). */
+    supersededBy?: {
+        id: string;
+        daemonId: string | null;
+        lastSeenAt: string | null;
+    };
+    /** Set on kept rows. */
+    reason?: HarnessPruneReason;
+    /** For `pinned`: who holds the pin. Other people's agents are a count, never named. */
+    detail?: {
+        agents?: Array<{
+            id: string;
+            name: string | null;
+        }>;
+        moreAgents?: number;
+        otherAuthors?: number;
+    };
+}
+export interface HarnessPruneResult {
+    dryRun: boolean;
+    limit: number;
+    minUnseenMs: number;
+    scan: {
+        rows: number;
+        complete: boolean;
+    };
+    /** Rows this call removes (dry run: would remove). */
+    remove: HarnessPruneRow[];
+    /** Rows this call actually removed; 0 on a dry run. */
+    removedCount: number;
+    /** Removable rows beyond `limit`; the next call takes them. */
+    remaining: number;
+    kept: HarnessPruneRow[];
+    keptTruncated: boolean;
+    counts: Record<string, number>;
+}
+/**
+ * Remove the caller's superseded harness rows - or, by default, say which would go.
+ *
+ * ONE route for both: the server makes the decision once and this only asks for it
+ * to be shown (`dryRun: true`, also its own default) or carried out. The caller
+ * never lists rows and picks, so there is no client-side rule to drift from the
+ * server's. A write, so `apiFetch` gives it an idempotency key and a retried
+ * request replays the recorded answer instead of running again.
+ */
+export declare function pruneHarnesses(options?: {
+    dryRun: boolean;
+    limit?: number;
+    minUnseenMs?: number;
+}): Promise<HarnessPruneResult>;
+/**
+ * `--older-than` takes a whole number with a unit: `90m`, `36h`, `7d`. A bare
+ * number is hours. Returns milliseconds. The server never goes below its offline
+ * window whatever this says.
+ */
+export declare function parseHarnessPruneAge(value: string): number;
+/** One sentence per reason a row was kept. The only place they are worded. */
+export declare function harnessPruneReasonSentence(row: HarnessPruneRow): string;
 /**
  * A per-USER display name. Distinct from `updateHarness({name})`, which renames
  * the harness for everyone it is shared with — this only changes what YOU see,

package/dist/lib/harnesses.js

@@ -13,6 +13,9 @@ exports.listQuotaAccounts = listQuotaAccounts;
 exports.getQuotaHistory = getQuotaHistory;
 exports.updateHarness = updateHarness;
 exports.forgetHarness = forgetHarness;
+exports.pruneHarnesses = pruneHarnesses;
+exports.parseHarnessPruneAge = parseHarnessPruneAge;
+exports.harnessPruneReasonSentence = harnessPruneReasonSentence;
 exports.setHarnessAlias = setHarnessAlias;
 exports.setDefaultHarness = setDefaultHarness;
 exports.mintInstallToken = mintInstallToken;
@@ -173,6 +176,73 @@ async function updateHarness(id, patch) {
 async function forgetHarness(id) {
     return (0, api_fetch_1.apiFetch)(`/api/harnesses/${encodeURIComponent(id)}`, { method: 'DELETE' });
 }
+/**
+ * Remove the caller's superseded harness rows - or, by default, say which would go.
+ *
+ * ONE route for both: the server makes the decision once and this only asks for it
+ * to be shown (`dryRun: true`, also its own default) or carried out. The caller
+ * never lists rows and picks, so there is no client-side rule to drift from the
+ * server's. A write, so `apiFetch` gives it an idempotency key and a retried
+ * request replays the recorded answer instead of running again.
+ */
+async function pruneHarnesses(options = { dryRun: true }) {
+    return (0, api_fetch_1.apiFetch)('/api/harnesses/prune', {
+        method: 'POST',
+        body: {
+            dryRun: options.dryRun,
+            ...(options.limit !== undefined ? { limit: options.limit } : {}),
+            ...(options.minUnseenMs !== undefined ? { minUnseenMs: options.minUnseenMs } : {}),
+        },
+    });
+}
+/**
+ * `--older-than` takes a whole number with a unit: `90m`, `36h`, `7d`. A bare
+ * number is hours. Returns milliseconds. The server never goes below its offline
+ * window whatever this says.
+ */
+function parseHarnessPruneAge(value) {
+    const match = value.trim().match(/^(\d+)\s*(m|h|d)?$/i);
+    if (!match) {
+        throw new Error(`Invalid --older-than value "${value}". Use a number with m, h or d, such as 90m, 36h or 7d.`);
+    }
+    const amount = Number(match[1]);
+    const unit = (match[2] || 'h').toLowerCase();
+    const perUnit = unit === 'd' ? 86_400_000 : unit === 'h' ? 3_600_000 : 60_000;
+    return amount * perUnit;
+}
+/** One sentence per reason a row was kept. The only place they are worded. */
+function harnessPruneReasonSentence(row) {
+    switch (row.reason) {
+        case 'recent':
+            return 'seen too recently to be sure it is gone';
+        case 'latest_registration':
+            return 'the newest registration of its provider on that machine';
+        case 'no_live_sibling':
+            return 'nothing has replaced it - no daemon on that machine is online for this provider';
+        case 'pinned': {
+            const names = (row.detail?.agents ?? []).map((a) => a.name ?? a.id);
+            const more = row.detail?.moreAgents ?? 0;
+            const others = row.detail?.otherAuthors ?? 0;
+            const parts = [];
+            if (names.length > 0) {
+                parts.push(`${names.join(', ')}${more > 0 ? ` and ${more} more` : ''}`);
+            }
+            if (others > 0)
+                parts.push(`${others} agent${others === 1 ? '' : 's'} of other people`);
+            return `agents are pinned to it${parts.length > 0 ? ` (${parts.join('; ')})` : ''}`;
+        }
+        case 'granted':
+            return 'it is lent to a workspace';
+        case 'default':
+            return 'it is your default harness';
+        case 'aliased':
+            return 'you gave it a name';
+        case 'changed_since_plan':
+            return 'it changed while this ran (came back online, or was pinned)';
+        default:
+            return String(row.reason ?? 'kept');
+    }
+}
 /**
  * A per-USER display name. Distinct from `updateHarness({name})`, which renames
  * the harness for everyone it is shared with — this only changes what YOU see,

package/dist/lib/list-output.d.ts

@@ -18,7 +18,7 @@ export type ListEnvelope = {
  * Documented in docs/cli/SKRR_TASKS.md (List output for agents).
  */
 export declare const COMPACT_FIELDS: {
-    readonly task: readonly ["id", "identifier", "ref", "title", "status", "statusType", "priority", "estimate", "assigneeAgentIds", "assigneeUserIds", "parentId", "spaceId", "projectId", "goalId", "dueDate", "scheduledFor", "labelIds", "tags", "externalKey", "version", "executionMode", "nextAction", "createdAt", "updatedAt", "url"];
+    readonly task: readonly ["id", "identifier", "ref", "title", "status", "statusType", "priority", "estimate", "assigneeAgentIds", "assigneeUserIds", "parentId", "spaceId", "projectId", "goalId", "dueDate", "scheduledFor", "labelIds", "tags", "externalKey", "version", "executionMode", "nextAction", "economicsRank", "createdAt", "updatedAt", "url"];
     readonly space: readonly ["id", "identifier", "title", "status", "parentSpaceId", "leadAgentId", "labelIds", "archivedAt", "createdAt", "updatedAt", "url"];
     readonly project: readonly ["id", "identifier", "title", "spaceId", "externalKey", "taskCounts", "archivedAt", "createdAt", "updatedAt", "url"];
 };

package/dist/lib/list-output.js

@@ -61,6 +61,8 @@ exports.COMPACT_FIELDS = {
         'version',
         'executionMode',
         'nextAction',
+        // Present only on a `--rank economics` page: the score the row was sorted by (OSK-16476).
+        'economicsRank',
         'createdAt',
         'updatedAt',
         'url',

package/dist/lib/profile-machine-identity-guard.js

@@ -32,9 +32,19 @@ function legacyProfileSharesDefaultMachine() {
  */
 function describeLegacySharedProfile(profile) {
     const next = `${profile}-2`;
+    // WHY this profile is on the shared row, from the record that decided it: which
+    // file made it "already hold credentials", and when. Absent rather than guessed
+    // when the record cannot be read.
+    let why = '';
+    try {
+        why = `${(0, machine_uuid_1.describeMachineIdentity)().sentence} `;
+    }
+    catch {
+        why = '';
+    }
     return [
         `Profile '${profile}' was set up by an older ${data_provider_1.BRAND.displayName} version that gave every profile on this ` +
-            'computer the same machine identity, and it still has it. Signing in here would replace the default ' +
+            `computer the same machine identity, and it still has it. ${why}Signing in here would replace the default ` +
             "profile's device-key pin and sign the default daemon out. Nothing was changed.",
         `Use a new profile name instead: skrr login --profile ${next}`,
         `(For the background service alone: skrrd --profile ${next} login)`,

package/dist/lib/task-economics.d.ts

@@ -29,6 +29,16 @@ export declare function describeEstimate(economics: unknown): string;
  * scored and sorts after every row that is.
  */
 export declare function economicsScoreText(economics: unknown): string;
+/** A rank's score as the table prints it: rounded, or `—` when the row is not scored. */
+export declare function scoreText(score: number | null | undefined): string;
+/**
+ * What `tasks update` should say about the estimate, read from the server's `economicsChange`
+ * (OSK-16476): `null` means the write changed nothing (an identical re-send, or a retraction of
+ * an estimate that is not there). `undefined` (an older server, or no estimate in the request) says
+ * nothing, so the CLI never guesses. When the estimate was the whole request the caller prints this
+ * line INSTEAD of "Updated task"; otherwise it follows it.
+ */
+export declare function estimateUnchangedLine(sent: unknown, updated: Record<string, unknown> | undefined): string | null;
 /**
  * One line for a `task.economics.*` Activity event (OSK-15365): the revision, the claim after the
  * change and the claim it replaced, so `tasks activity` shows from-what-to-what without `--json`.

package/dist/lib/task-economics.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.economicsFromFlags = economicsFromFlags;
 exports.describeEstimate = describeEstimate;
 exports.economicsScoreText = economicsScoreText;
+exports.scoreText = scoreText;
+exports.estimateUnchangedLine = estimateUnchangedLine;
 exports.describeEconomicsChange = describeEconomicsChange;
 const data_provider_1 = require("@skrr-ai/data-provider");
 /**
@@ -83,8 +85,28 @@ function describeEstimate(economics) {
  * scored and sorts after every row that is.
  */
 function economicsScoreText(economics) {
-    const score = (0, data_provider_1.proposalEconomicsRank)(economics).score;
-    return score === null || !Number.isFinite(score) ? '—' : String(Math.round(score));
+    return scoreText((0, data_provider_1.proposalEconomicsRank)(economics).score);
+}
+/** A rank's score as the table prints it: rounded, or `—` when the row is not scored. */
+function scoreText(score) {
+    return score === null || score === undefined || !Number.isFinite(score)
+        ? '—'
+        : String(Math.round(score));
+}
+/**
+ * What `tasks update` should say about the estimate, read from the server's `economicsChange`
+ * (OSK-16476): `null` means the write changed nothing (an identical re-send, or a retraction of
+ * an estimate that is not there). `undefined` (an older server, or no estimate in the request) says
+ * nothing, so the CLI never guesses. When the estimate was the whole request the caller prints this
+ * line INSTEAD of "Updated task"; otherwise it follows it.
+ */
+function estimateUnchangedLine(sent, updated) {
+    if (sent === undefined || !updated || updated.economicsChange !== null)
+        return null;
+    if (sent === null)
+        return 'No estimate to retract; nothing changed.';
+    const revision = updated.economics?.revision;
+    return `Estimate unchanged${revision ? ` (revision ${revision})` : ''}: it already reads ${describeEstimate(updated.economics)}.`;
 }
 /**
  * One line for a `task.economics.*` Activity event (OSK-15365): the revision, the claim after the

package/dist/lib/triggers.d.ts

@@ -232,6 +232,10 @@ export interface SpaceAssistantResponse {
 export declare const SCOPE_IMPLIED_REF_KEY: Partial<Record<TriggerScopeKind, string>>;
 export declare function parseKeyValueFlags(values: string[] | undefined, flagName: string, scopeKind?: string): Record<string, string>;
 export declare function parseJsonObject(raw: string | undefined, flagName: string): Record<string, unknown> | undefined;
+/**
+ * A JSON-array flag value: inline JSON, `@path` (a file), or a bare path to an existing file. A
+ * path used to reach `JSON.parse` and fail with "Unexpected token '/'" (OSK-15402).
+ */
 export declare function parseJsonArray(raw: string | undefined, flagName: string): unknown[] | undefined;
 export declare function buildBuiltinActionPayload(input: {
     builtinAction?: string;
@@ -332,6 +336,13 @@ export declare function describeScheduledFire(result: Record<string, unknown>):
  * about `in_progress` once). Only these are success for `triggers fire --strict`.
  */
 export declare function fireWasAccepted(result: Record<string, unknown>): boolean;
+/**
+ * Why `triggers fire --strict` failed. A strict failure used to print exactly what the exit-0 run
+ * printed and then exit 1, so nothing said what the flag had judged (OSK-16474). It names the
+ * outcome it refused, the reason, the server's sentence when there is one, and what --strict
+ * accepts.
+ */
+export declare function describeStrictFireRefusal(result: Record<string, unknown>): string;
 /**
  * The lines a fire or replay owes beyond `outcome=… reason=…` (OSK-15494): the sentence the
  * server wrote ("Replayed fire … resolved a step that was not waiting when that fire ran: