@skrr-ai/cli 0.1.109 → 0.1.111

package/bin/run.js

@@ -33,7 +33,21 @@ try {
     fs.chmodSync(temporary, 0o600);
     fs.renameSync(temporary, bootstrap);
   }
-  require(bootstrap).registerSession(packageRoot);
+  const updateRuntime = require(bootstrap);
+  const admissionDeadline = Date.now() + 60000;
+  while (true) {
+    try {
+      updateRuntime.registerSession(packageRoot, Math.max(0, admissionDeadline - Date.now()));
+      break;
+    } catch (error) {
+      // Protocol-1 bootstraps already cached outside node_modules can time
+      // out their one-second bakery lock while another reader enters. Retry
+      // through that same gate within the normal admission budget: never
+      // load package modules while npm may be replacing them.
+      if (error?.code !== 'CLI_UPDATE_BUSY' || Date.now() >= admissionDeadline) throw error;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+  }
   process.env.SKRR_CLI_UPDATE_SESSION_REGISTERED = String(process.pid);
 } catch (error) {
   if (error && error.code === 'CLI_UPDATE_BUSY') {

package/dist/base-command.d.ts

@@ -1,4 +1,5 @@
 import { Command, Flags, type Interfaces } from '@oclif/core';
+import { type CliOperationOptions } from './lib/json-output';
 export { resolveProfileFromArgv } from './lib/keychain';
 import { dataService } from '@skrr-ai/data-provider';
 import { type WriteTarget } from './lib/write-target';
@@ -7,6 +8,7 @@ import { type CliConfig } from './lib/config';
 import { type OutboxMethod } from './lib/outbox';
 import { type CredentialProvenance, type ResolvedCredential } from './lib/credential-resolver';
 import { type BrokerRefusalDescription } from './lib/daemonBrokerRefusal';
+import { type TaskResourceReferenceCache } from './lib/task-resource-references';
 import { type DefaultAgentResolution } from './lib/tasks';
 export declare function assigneePayloadNeedsResolution(payload: Record<string, unknown>): boolean;
 /**
@@ -79,6 +81,13 @@ export declare abstract class BaseCommand extends Command {
     protected printJsonResult(value: unknown, options?: {
         ok?: boolean;
     }): void;
+    private jsonOperationContext?;
+    /** Opt in at the command boundary, including its existing structured errors. */
+    protected setJsonOperation(options: Partial<CliOperationOptions>): void;
+    /** Decorate an object when a command owns its own JSON/signal serializer. */
+    protected jsonOperationResult(value: unknown, options?: Partial<CliOperationOptions>): unknown;
+    protected printJsonOperation(value: unknown, options?: Partial<CliOperationOptions>): void;
+    private jsonOperationError;
     protected cliConfig: CliConfig;
     /**
      * Resolved credential for this process. Populated in `init()` and
@@ -123,6 +132,12 @@ export declare abstract class BaseCommand extends Command {
      * instead of the resolution being quietly wrong.
      */
     static resolveSpaceFlag: boolean;
+    private taskResourceReferenceCache?;
+    protected resolveTaskResourceReferences(payload: Record<string, unknown>, options?: {
+        existingTask?: Record<string, unknown>;
+        taskId?: string;
+        cache?: TaskResourceReferenceCache;
+    }): Promise<void>;
     /**
      * Turn a space reference into a space id, or fail the command.
      *
@@ -300,7 +315,9 @@ export declare abstract class BaseCommand extends Command {
      * caller that cannot watch: it is checked HERE, before the first write, and a
      * mismatch is a non-retryable usage error.
      */
-    protected assertWriteTarget(expected?: readonly string[]): Promise<WriteTarget>;
+    protected assertWriteTarget(expected?: readonly string[], options?: {
+        preview?: boolean;
+    }): Promise<WriteTarget>;
     /**
      * Turn free-text assignee references ("frank", "frank@example.com", "me",
      * or a raw id) into ids, failing the command if ANY of them can't be pinned
@@ -585,6 +602,32 @@ export declare function isTypedServerRefusal(body: Record<string, unknown> | nul
  */
 export declare function isApplicationCodedUnavailable(status: number | undefined, body: Record<string, unknown> | null): boolean;
 export declare function isRetryableFailure(status: number | undefined, body: Record<string, unknown> | null): boolean;
+/**
+ * The human text of an API error body (OSK-16986). The server's error envelope guarantees
+ * `message`; the legacy `error` string and the nested `{ error: { message } }` (`/v1`) are read
+ * only for a server or a proxy that did not pass that boundary. Same order as
+ * `errorBodyMessage` in `@skrr-ai/data-provider`, kept here because the CLI's specs replace that
+ * package with partial mocks and this runs on every API failure.
+ */
+export declare function errorBodyMessage(body: unknown): string | undefined;
+/**
+ * The `details` of a CLI error envelope, in ONE shape. The server's refusal body becomes the
+ * envelope's details; when that body carries its own `details` object (a typed refusal's
+ * findings, e.g. `signalableNodeKeys`), those fields are lifted to the same level instead of
+ * arriving as `error.details.details`, a depth no other error used (OSK-16494).
+ *
+ * The human text is always `details.message` (OSK-16986): the server's error envelope guarantees
+ * it, and for an older server that wrote only `error` (or the nested `/v1` shape) it is filled
+ * from there, so no caller reads two places. A lifted `details.message` cannot replace it.
+ */
+export declare function envelopeDetails(body: Record<string, unknown> | null | undefined): unknown;
+/**
+ * The hint for a `Nonexistent flags:` refusal, or null. Two cases:
+ *  - a flag retired from THIS command, which this command does not define again: where it went;
+ *  - a flag token holding a space (`"--outcome failed"` passed as one argument): what happened,
+ *    which oclif reports only as an unknown flag.
+ */
+export declare function retiredFlagHint(message: string, commandId?: string, definedFlags?: readonly string[]): string | null;
 /**
  * P6: a parse error used to say what was wrong and drop the remedy that text
  * mode (and every domain error) carries. Adds `fix` (one imperative line an

package/dist/base-command.js

@@ -17,6 +17,9 @@ exports.describeDaemonScopedCredential = describeDaemonScopedCredential;
 exports.isTypedServerRefusal = isTypedServerRefusal;
 exports.isApplicationCodedUnavailable = isApplicationCodedUnavailable;
 exports.isRetryableFailure = isRetryableFailure;
+exports.errorBodyMessage = errorBodyMessage;
+exports.envelopeDetails = envelopeDetails;
+exports.retiredFlagHint = retiredFlagHint;
 exports.parseErrorRemedy = parseErrorRemedy;
 const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
@@ -61,6 +64,7 @@ const step_up_1 = require("./lib/step-up");
 const delegated_cli_1 = require("./lib/delegated-cli");
 const dedicated_guest_1 = require("./lib/dedicated-guest");
 const harness_context_1 = require("./lib/harness-context");
+const task_resource_references_1 = require("./lib/task-resource-references");
 const tasks_1 = require("./lib/tasks");
 function assigneePayloadNeedsResolution(payload) {
     const fields = [
@@ -197,6 +201,26 @@ class BaseCommand extends core_1.Command {
     printJsonResult(value, options = {}) {
         this.log(JSON.stringify((0, json_output_1.withOk)(value, options.ok ?? true), null, 2));
     }
+    jsonOperationContext;
+    /** Opt in at the command boundary, including its existing structured errors. */
+    setJsonOperation(options) {
+        this.jsonOperationContext = { ...this.jsonOperationContext, ...options };
+    }
+    /** Decorate an object when a command owns its own JSON/signal serializer. */
+    jsonOperationResult(value, options = {}) {
+        return (0, json_output_1.withCliOperation)(value, {
+            command: this.id ?? '', mode: 'execute', outcome: 'succeeded',
+            ...this.jsonOperationContext, ...options,
+        });
+    }
+    printJsonOperation(value, options = {}) {
+        this.printJsonResult(this.jsonOperationResult(value, options));
+    }
+    jsonOperationError(value) {
+        return this.jsonOperationContext
+            ? this.jsonOperationResult(value, { outcome: 'failed', writeState: 'unknown' })
+            : value;
+    }
     cliConfig;
     /**
      * Resolved credential for this process. Populated in `init()` and
@@ -614,6 +638,43 @@ class BaseCommand extends core_1.Command {
      * instead of the resolution being quietly wrong.
      */
     static resolveSpaceFlag = true;
+    taskResourceReferenceCache;
+    async resolveTaskResourceReferences(payload, options = {}) {
+        const cache = options.cache ?? (this.taskResourceReferenceCache ??= new Map());
+        let existingTask = options.existingTask;
+        // An ordinary UUID patch must keep its old request count. Only a readable
+        // scoped reference needs a current Task read to discover its Space.
+        const needsScope = ['projectId', 'goalId'].some(field => {
+            const value = payload[field];
+            return typeof value === 'string' && value.trim() &&
+                !/^[\da-f-]{36}$/i.test(value) && !/^[\da-f]{24}$/i.test(value);
+        });
+        try {
+            if (needsScope && !payload.spaceId && !existingTask && options.taskId) {
+                const key = `task:${options.taskId}`;
+                if (!cache.has(key))
+                    cache.set(key, data_provider_1.dataService.getTask(options.taskId, { enrich: false }));
+                existingTask = await cache.get(key);
+            }
+            await (0, task_resource_references_1.resolveTaskResourceReferences)(payload, {
+                existingTask,
+                cache,
+                resolveSpace: value => this.resolveSpaceReference(value),
+            });
+        }
+        catch (error) {
+            if (error instanceof task_resource_references_1.TaskResourceReferenceError) {
+                this.failWithCliError({
+                    message: error.message,
+                    code: error.code,
+                    exit: 2,
+                    retryable: false,
+                    details: { context: { candidates: error.candidates } },
+                });
+            }
+            this.handleApiError(error);
+        }
+    }
     /**
      * Turn a space reference into a space id, or fail the command.
      *
@@ -648,7 +709,14 @@ class BaseCommand extends core_1.Command {
             catch (err) {
                 this.handleApiError(err);
             }
-            const rows = (response?.data ?? []);
+            const envelope = response;
+            if (!Array.isArray(envelope?.data) || envelope?.has_more === true) {
+                this.failWithCliError({
+                    message: 'The Space lookup is incomplete or unavailable, so a unique match cannot be established. Use a canonical Space id, or narrow the search with spaces list --q <name>.',
+                    code: 'SPACE_REF_LOOKUP_INCOMPLETE', exit: 2, retryable: false,
+                });
+            }
+            const rows = envelope.data;
             return rows.map(space_resolver_1.spaceRefFrom).filter((s) => s !== null);
         };
         let outcome = (0, space_resolver_1.resolveSpaceRef)(normalizedQuery, await load(false));
@@ -722,7 +790,7 @@ class BaseCommand extends core_1.Command {
         // both contracts.
         if (!(0, projects_1.looksLikeCanonicalProjectId)(projectRef)) {
             this.failWithCliError({
-                message: 'Name the space: pass --space, or use the qualified ref `<space>/<project>` that `projects list` prints.',
+                message: 'Name the space: pass --space <space-id-or-ref>, or qualify the project ref as <space-id-or-ref>/<project-ref> (for example OSK-S-3/OSK-P-12).',
                 code: 'PROJECT_REF_REQUIRES_SPACE',
                 exit: 2,
                 retryable: false,
@@ -750,7 +818,7 @@ class BaseCommand extends core_1.Command {
                 // A server that predates the lookup. The caller's old remedy still
                 // works there, so the error names it rather than a server upgrade only.
                 this.failWithCliError({
-                    message: 'This skrr server cannot look a project up by id — name the space: pass --space, or use the qualified ref `<space>/<project>` that `projects list` prints.',
+                    message: 'This skrr server cannot look a project up by id — name the space: pass --space <space-id-or-ref>, or qualify the project as <space-id-or-ref>/<project-id>.',
                     code: 'PROJECT_REF_REQUIRES_SPACE',
                     exit: 2,
                     retryable: false,
@@ -822,7 +890,14 @@ class BaseCommand extends core_1.Command {
         catch (err) {
             this.handleApiError(err);
         }
-        const rows = (response?.data ?? []);
+        const envelope = response;
+        if (!Array.isArray(envelope?.data) || envelope?.has_more === true) {
+            this.failWithCliError({
+                message: 'The Task-title lookup is incomplete or unavailable, so a unique match cannot be established. Use a Task id/ref from tasks list --q <title>.',
+                code: 'TASK_REF_LOOKUP_INCOMPLETE', exit: 2, retryable: false,
+            });
+        }
+        const rows = envelope.data;
         const candidates = rows.map(task_ref_resolver_1.taskRefFrom).filter((t) => t !== null);
         const outcome = (0, task_ref_resolver_1.resolveTaskRef)(query, candidates);
         if (outcome.ok)
@@ -1074,7 +1149,7 @@ class BaseCommand extends core_1.Command {
      * caller that cannot watch: it is checked HERE, before the first write, and a
      * mismatch is a non-retryable usage error.
      */
-    async assertWriteTarget(expected) {
+    async assertWriteTarget(expected, options = {}) {
         const target = await this.describeWriteTarget();
         const unmet = (0, write_target_1.firstUnmetExpectation)(target, expected);
         if (unmet !== undefined) {
@@ -1091,7 +1166,7 @@ class BaseCommand extends core_1.Command {
             });
         }
         if (process.stderr.isTTY) {
-            process.stderr.write(`Writing to ${(0, write_target_1.formatWriteTarget)(target)}\n`);
+            process.stderr.write(`${options.preview ? 'Dry run target:' : 'Writing to'} ${(0, write_target_1.formatWriteTarget)(target)}\n`);
         }
         return target;
     }
@@ -1191,7 +1266,7 @@ class BaseCommand extends core_1.Command {
         // so a caller following older instructions — including the managed block the
         // platform itself installed — got a bare `Nonexistent flags:` with no hint
         // that the capability moved rather than vanished. Name where each went.
-        const retiredHint = retiredFlagHint(err.message || '');
+        const retiredHint = retiredFlagHint(err.message || '', this.id, Object.keys(this.constructor.flags ?? {}));
         if (retiredHint) {
             err.message = `${err.message}\n\n${retiredHint}`;
         }
@@ -1223,7 +1298,7 @@ class BaseCommand extends core_1.Command {
             const exit = err.exitCode ?? err.oclif?.exit ?? 1;
             process.exitCode = exit;
             const details = detailsFromCaughtError(err) ?? httpBody;
-            this.log(JSON.stringify({
+            this.log(JSON.stringify(this.jsonOperationError({
                 ok: false,
                 error: {
                     code: err.code ?? parseCliErrorCode(err),
@@ -1234,7 +1309,7 @@ class BaseCommand extends core_1.Command {
                     ...parseErrorRemedy(err, this.id, this.config?.bin),
                     ...(details ? { details } : {}),
                 },
-            }, null, 2));
+            }), null, 2));
             return;
         }
         return super.catch(err);
@@ -1308,7 +1383,9 @@ class BaseCommand extends core_1.Command {
             const body = parseErrorBody(e.body);
             const bodyCode = stringProp(body, 'code') || stringProp(body, 'errorType');
             // A body path the person never typed is read back as the flag that wrote it (OSK-15313).
-            const bodyMessage = (0, request_field_flags_1.translateRequestFieldPaths)(stringProp(body, 'message') || stringProp(body, 'error'), this.requestFieldFlags);
+            // The server answers every error with `message` (OSK-16986); `errorBodyMessage` keeps the
+            // older `error` string and the nested `/v1` shape as fallbacks for a server without it.
+            const bodyMessage = (0, request_field_flags_1.translateRequestFieldPaths)(errorBodyMessage(body), this.requestFieldFlags);
             // `requireAuth()` catches this before requests for normal commands, but
             // keep the API-error check too: a handful of commands make a direct
             // request and a supplied `--token` can bypass their normal preflight.
@@ -1336,7 +1413,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 2,
                     retryable: false,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (bodyCode === 'AGENT_RUNTIME_UNAVAILABLE') {
@@ -1350,7 +1427,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 1,
                     retryable: false,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (bodyCode === 'GITHUB_APP_NOT_CONFIGURED') {
@@ -1360,7 +1437,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 2,
                     retryable: false,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (bodyCode === 'GITHUB_UNAVAILABLE') {
@@ -1376,7 +1453,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 5,
                     retryable: true,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (bodyCode === 'LABEL_SUGGESTION_UNAVAILABLE') {
@@ -1390,7 +1467,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 1,
                     retryable: false,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (bodyCode === 'ASSIGNEE_NOT_IN_SPACE') {
@@ -1403,7 +1480,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 2,
                     retryable: false,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (e.status === 401) {
@@ -1432,7 +1509,7 @@ class BaseCommand extends core_1.Command {
                 // latched refresh refusal names the half the reader can act on.
                 const refreshRefusal = presentedCiToken || presentedPat
                     ? null
-                    : (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
+                    : (0, auth_failure_1.describeRefreshRefusal)((0, auth_failure_1.refusalFromResponse)(body, readRefreshRefusal()), {
                         bin: this.config.bin,
                         cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
                     });
@@ -1552,6 +1629,10 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 4,
                     retryable: false,
+                    // A typed 404 carries what the server found (a workflow signal names the nodes it CAN
+                    // resolve); dropping the body here made the 404 the one refusal with no machine-readable
+                    // details while every 409 kept them (OSK-16473).
+                    ...(body ? { details: envelopeDetails(body) } : {}),
                 });
             }
             else if (e.code === 'ECONNREFUSED' ||
@@ -1584,7 +1665,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 1,
                     retryable: isRetryableFailure(e.status, body),
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                     requestId: stringProp(body, 'requestId') || e.requestId,
                 });
             }
@@ -1623,7 +1704,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: retryable ? 5 : 1,
                     retryable,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                     ...(requestId ? { requestId } : {}),
                 });
             }
@@ -1661,7 +1742,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 5,
                     retryable: true,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (typeof e.status === 'number' && e.status >= 500) {
@@ -1689,7 +1770,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 1,
                     retryable: isRetryableFailure(e.status, body),
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else {
@@ -1699,7 +1780,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 1,
                     retryable: isRetryableFailure(e.status, body),
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
         }
@@ -1802,7 +1883,7 @@ class BaseCommand extends core_1.Command {
         // that. Lead with the sign-in, name the refused refresh when one is latched,
         // and give the order the fix has to happen in: sign in, THEN replay.
         if (e.status === 401) {
-            const refusal = (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
+            const refusal = (0, auth_failure_1.describeRefreshRefusal)((0, auth_failure_1.refusalFromResponse)(parseErrorBody(err.body), readRefreshRefusal()), {
                 bin: this.config.bin,
                 cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
             });
@@ -1897,7 +1978,7 @@ class BaseCommand extends core_1.Command {
     /** E6: the server's `Retry-After` for the refused call, when it was a 429. */
     lastRetryAfterMs;
     writeJsonCliError({ message, code, status, exit, retryable, details, requestId, }) {
-        this.log(JSON.stringify({
+        this.log(JSON.stringify(this.jsonOperationError({
             ok: false,
             error: {
                 code,
@@ -1916,7 +1997,7 @@ class BaseCommand extends core_1.Command {
                 ...(this.lastRetryAfterMs !== undefined ? { retryAfterMs: this.lastRetryAfterMs } : {}),
                 ...(details ? { details } : {}),
             },
-        }, null, 2));
+        }), null, 2));
         this.exit(exit);
     }
     /**
@@ -1982,7 +2063,13 @@ function parseGlobalFlags(argv) {
 function readRefreshRefusal() {
     try {
         const state = (0, auth_core_1.needsReauthState)();
-        return state.needed ? { reason: state.reason, message: state.message } : null;
+        return state.needed
+            ? {
+                reason: state.reason,
+                message: state.message,
+                ...(state.revocationReason ? { revocationReason: state.revocationReason } : {}),
+            }
+            : null;
     }
     catch {
         return null;
@@ -2016,7 +2103,7 @@ function apiRefusal(err) {
     const body = parseErrorBody(err.body);
     return {
         code: stringProp(body, 'code') || stringProp(body, 'errorType'),
-        message: stringProp(body, 'message') || stringProp(body, 'error'),
+        message: errorBodyMessage(body),
         ...(body ? { body } : {}),
     };
 }
@@ -2454,13 +2541,78 @@ const RETIRED_FLAG_REPLACEMENTS = {
         '`tasks deliverable add`.',
     '--supersede': '--supersede is implicit: submitting again creates a new Result version.',
 };
-function retiredFlagHint(message) {
+/**
+ * The human text of an API error body (OSK-16986). The server's error envelope guarantees
+ * `message`; the legacy `error` string and the nested `{ error: { message } }` (`/v1`) are read
+ * only for a server or a proxy that did not pass that boundary. Same order as
+ * `errorBodyMessage` in `@skrr-ai/data-provider`, kept here because the CLI's specs replace that
+ * package with partial mocks and this runs on every API failure.
+ */
+function errorBodyMessage(body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return undefined;
+    const record = body;
+    const text = (value) => typeof value === 'string' && value.trim() !== '' ? value : undefined;
+    const nested = record.error && typeof record.error === 'object' && !Array.isArray(record.error)
+        ? record.error.message
+        : undefined;
+    return text(record.message) ?? text(record.error) ?? text(nested);
+}
+/**
+ * The `details` of a CLI error envelope, in ONE shape. The server's refusal body becomes the
+ * envelope's details; when that body carries its own `details` object (a typed refusal's
+ * findings, e.g. `signalableNodeKeys`), those fields are lifted to the same level instead of
+ * arriving as `error.details.details`, a depth no other error used (OSK-16494).
+ *
+ * The human text is always `details.message` (OSK-16986): the server's error envelope guarantees
+ * it, and for an older server that wrote only `error` (or the nested `/v1` shape) it is filled
+ * from there, so no caller reads two places. A lifted `details.message` cannot replace it.
+ */
+function envelopeDetails(body) {
+    if (!body)
+        return undefined;
+    const message = errorBodyMessage(body);
+    const nested = body.details;
+    const lifted = !nested || typeof nested !== 'object' || Array.isArray(nested)
+        ? body
+        : (() => {
+            const { details: _nested, ...rest } = body;
+            return { ...rest, ...nested };
+        })();
+    return message === undefined ? lifted : { ...lifted, message };
+}
+/**
+ * The commands those flags were retired FROM. The table was applied to every command, so a
+ * mis-quoted `"--outcome failed"` on `triggers audit` (where --outcome is a live flag) was told
+ * "--outcome is now --summary" (OSK-16494). A rename is a fact about one command.
+ */
+const RETIRED_FLAG_COMMANDS = new Set(['tasks:complete', 'tasks:result:submit']);
+/**
+ * The hint for a `Nonexistent flags:` refusal, or null. Two cases:
+ *  - a flag retired from THIS command, which this command does not define again: where it went;
+ *  - a flag token holding a space (`"--outcome failed"` passed as one argument): what happened,
+ *    which oclif reports only as an unknown flag.
+ */
+function retiredFlagHint(message, commandId, definedFlags = []) {
     if (!/nonexistent flag/i.test(message))
         return null;
-    const hits = Object.keys(RETIRED_FLAG_REPLACEMENTS).filter((flag) => new RegExp(`${flag}(?![\\w-])`).test(message));
-    if (hits.length === 0)
-        return null;
-    return hits.map((flag) => `  ${RETIRED_FLAG_REPLACEMENTS[flag]}`).join('\n');
+    const lines = [];
+    const quoted = /(?:^|[\s,:])(--[a-z][\w-]*)[ =]([^\s,][^,\n]*)/i.exec(message.slice(message.search(/nonexistent flag/i)));
+    const quotedFlag = quoted?.[1];
+    if (quotedFlag && definedFlags.includes(quotedFlag.replace(/^--/, ''))) {
+        lines.push(`  "${quoted[0].trim()}" reached the command as ONE argument, so it was read as a flag named ` +
+            `"${quoted[0].trim()}". Pass the flag and its value separately: ${quotedFlag} ${quoted[2].trim()}`);
+    }
+    if (commandId && RETIRED_FLAG_COMMANDS.has(commandId)) {
+        for (const flag of Object.keys(RETIRED_FLAG_REPLACEMENTS)) {
+            if (definedFlags.includes(flag.replace(/^--/, '')))
+                continue;
+            if (new RegExp(`${flag}(?![\\w-])`).test(message)) {
+                lines.push(`  ${RETIRED_FLAG_REPLACEMENTS[flag]}`);
+            }
+        }
+    }
+    return lines.length ? lines.join('\n') : null;
 }
 /**
  * P6: a parse error used to say what was wrong and drop the remedy that text
@@ -2485,7 +2637,16 @@ function parseErrorRemedy(err, commandId, bin = 'skrr') {
                 `Pass --${flag} <value>. Run \`${helpCommand}\` for its description and accepted values.`,
         };
     }
-    const nonexistent = /Nonexistent flag[s]?:?\s*(-{1,2}[\w-]+)/i.exec(message);
+    const nonexistent = /Nonexistent flag[s]?:?\s*(-{1,2}[\w-]+)(?:[ =]([^\s,][^,\n]*))?/i.exec(message);
+    if (nonexistent?.[2]) {
+        // `"--outcome failed"` arrived as ONE argument: the flag may well exist, so
+        // "remove it" would be wrong advice. Same case retiredFlagHint explains in text.
+        return {
+            flag: nonexistent[1].replace(/^-+/, ''),
+            fix: suggestion ??
+                `Pass the flag and its value as separate arguments: ${nonexistent[1]} ${nonexistent[2].trim()}`,
+        };
+    }
     if (nonexistent) {
         return {
             flag: nonexistent[1].replace(/^-+/, ''),

package/dist/commands/actions/list.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const list_output_1 = require("../../lib/list-output");
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -38,7 +39,7 @@ class ActionsList extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.printJsonResult((0, list_output_1.listResult)(response));
             return;
         }
         (0, action_listings_1.renderActionListings)(response.data, (line) => this.log(line));

package/dist/commands/agenda/trigger/create.js

@@ -38,7 +38,7 @@ class AgendaTriggerCreate extends base_command_1.BaseCommand {
             required: true,
         }),
         prompt: core_1.Flags.string({
-            description: 'The instruction the agent receives when the trigger fires (max 4000 chars). Write in second person.',
+            description: `The instruction the agent receives when the trigger fires (max ${data_provider_1.TRIGGER_PROMPT_TEMPLATE_MAX_CHARS} chars). Write in second person.`,
             required: true,
         }),
         cron: core_1.Flags.string({

package/dist/commands/agenda/trigger/list.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isUnconfirmedTurnCapture = isUnconfirmedTurnCapture;
+const list_output_1 = require("../../../lib/list-output");
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
@@ -55,7 +56,7 @@ class AgendaTriggerList extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.printJsonResult((0, list_output_1.listResult)(response));
             return;
         }
         const r = response;

package/dist/commands/agent-groups/list.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const list_output_1 = require("../../lib/list-output");
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -24,7 +25,7 @@ class AgentGroupsList extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.printJsonResult((0, list_output_1.listResult)(response));
             return;
         }
         // Defensive shape handling — accept either { data: [...] } or a plain array.

package/dist/commands/agents/actions/list.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const list_output_1 = require("../../../lib/list-output");
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../../base-command");
 const agent_actions_1 = require("../../../lib/agent-actions");
@@ -27,7 +28,7 @@ class AgentsActionsList extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(actions, null, 2));
+            this.printJsonResult((0, list_output_1.listResult)(actions));
             return;
         }
         (0, agent_actions_1.renderActions)(actions, (line) => this.log(line));

package/dist/commands/agents/always-on/status.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
+const agent_proactive_baseline_1 = require("../../../lib/agent-proactive-baseline");
 /**
  * `skrr agents always-on status <agent-id>` — read the composed generation-aware
  * Always-On status envelope via the single control endpoint
@@ -62,6 +63,10 @@ class AgentsAlwaysOnStatus extends base_command_1.BaseCommand {
             const reasons = (status.messaging.degradedReasons || []).join(', ') || 'unknown';
             this.log(`Messaging:        degraded (${reasons})`);
         }
+        // Read-only setup facts: who wrote the policy/Compass, which system loops
+        // and watchers exist, and the command that repairs each gap.
+        for (const line of (0, agent_proactive_baseline_1.proactiveBaselineLines)(status.proactiveBaseline))
+            this.log(line);
     }
 }
 exports.default = AgentsAlwaysOnStatus;