@skrr-ai/cli 0.1.110 → 0.1.113

package/bin/run.js

@@ -33,7 +33,21 @@ try {
     fs.chmodSync(temporary, 0o600);
     fs.renameSync(temporary, bootstrap);
   }
-  require(bootstrap).registerSession(packageRoot);
+  const updateRuntime = require(bootstrap);
+  const admissionDeadline = Date.now() + 60000;
+  while (true) {
+    try {
+      updateRuntime.registerSession(packageRoot, Math.max(0, admissionDeadline - Date.now()));
+      break;
+    } catch (error) {
+      // Protocol-1 bootstraps already cached outside node_modules can time
+      // out their one-second bakery lock while another reader enters. Retry
+      // through that same gate within the normal admission budget: never
+      // load package modules while npm may be replacing them.
+      if (error?.code !== 'CLI_UPDATE_BUSY' || Date.now() >= admissionDeadline) throw error;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+  }
   process.env.SKRR_CLI_UPDATE_SESSION_REGISTERED = String(process.pid);
 } catch (error) {
   if (error && error.code === 'CLI_UPDATE_BUSY') {

package/dist/base-command.d.ts

@@ -1,4 +1,5 @@
 import { Command, Flags, type Interfaces } from '@oclif/core';
+import { type CliOperationOptions } from './lib/json-output';
 export { resolveProfileFromArgv } from './lib/keychain';
 import { dataService } from '@skrr-ai/data-provider';
 import { type WriteTarget } from './lib/write-target';
@@ -7,6 +8,7 @@ import { type CliConfig } from './lib/config';
 import { type OutboxMethod } from './lib/outbox';
 import { type CredentialProvenance, type ResolvedCredential } from './lib/credential-resolver';
 import { type BrokerRefusalDescription } from './lib/daemonBrokerRefusal';
+import { type TaskResourceReferenceCache } from './lib/task-resource-references';
 import { type DefaultAgentResolution } from './lib/tasks';
 export declare function assigneePayloadNeedsResolution(payload: Record<string, unknown>): boolean;
 /**
@@ -79,6 +81,13 @@ export declare abstract class BaseCommand extends Command {
     protected printJsonResult(value: unknown, options?: {
         ok?: boolean;
     }): void;
+    private jsonOperationContext?;
+    /** Opt in at the command boundary, including its existing structured errors. */
+    protected setJsonOperation(options: Partial<CliOperationOptions>): void;
+    /** Decorate an object when a command owns its own JSON/signal serializer. */
+    protected jsonOperationResult(value: unknown, options?: Partial<CliOperationOptions>): unknown;
+    protected printJsonOperation(value: unknown, options?: Partial<CliOperationOptions>): void;
+    private jsonOperationError;
     protected cliConfig: CliConfig;
     /**
      * Resolved credential for this process. Populated in `init()` and
@@ -123,6 +132,12 @@ export declare abstract class BaseCommand extends Command {
      * instead of the resolution being quietly wrong.
      */
     static resolveSpaceFlag: boolean;
+    private taskResourceReferenceCache?;
+    protected resolveTaskResourceReferences(payload: Record<string, unknown>, options?: {
+        existingTask?: Record<string, unknown>;
+        taskId?: string;
+        cache?: TaskResourceReferenceCache;
+    }): Promise<void>;
     /**
      * Turn a space reference into a space id, or fail the command.
      *
@@ -300,7 +315,9 @@ export declare abstract class BaseCommand extends Command {
      * caller that cannot watch: it is checked HERE, before the first write, and a
      * mismatch is a non-retryable usage error.
      */
-    protected assertWriteTarget(expected?: readonly string[]): Promise<WriteTarget>;
+    protected assertWriteTarget(expected?: readonly string[], options?: {
+        preview?: boolean;
+    }): Promise<WriteTarget>;
     /**
      * Turn free-text assignee references ("frank", "frank@example.com", "me",
      * or a raw id) into ids, failing the command if ANY of them can't be pinned
@@ -585,12 +602,23 @@ export declare function isTypedServerRefusal(body: Record<string, unknown> | nul
  */
 export declare function isApplicationCodedUnavailable(status: number | undefined, body: Record<string, unknown> | null): boolean;
 export declare function isRetryableFailure(status: number | undefined, body: Record<string, unknown> | null): boolean;
+/**
+ * The human text of an API error body (OSK-16986). The server's error envelope guarantees
+ * `message`; the legacy `error` string and the nested `{ error: { message } }` (`/v1`) are read
+ * only for a server or a proxy that did not pass that boundary. Same order as
+ * `errorBodyMessage` in `@skrr-ai/data-provider`, kept here because the CLI's specs replace that
+ * package with partial mocks and this runs on every API failure.
+ */
+export declare function errorBodyMessage(body: unknown): string | undefined;
 /**
  * The `details` of a CLI error envelope, in ONE shape. The server's refusal body becomes the
  * envelope's details; when that body carries its own `details` object (a typed refusal's
  * findings, e.g. `signalableNodeKeys`), those fields are lifted to the same level instead of
- * arriving as `error.details.details`, a depth no other error used (OSK-16494). A body without
- * a nested object is passed through unchanged.
+ * arriving as `error.details.details`, a depth no other error used (OSK-16494).
+ *
+ * The human text is always `details.message` (OSK-16986): the server's error envelope guarantees
+ * it, and for an older server that wrote only `error` (or the nested `/v1` shape) it is filled
+ * from there, so no caller reads two places. A lifted `details.message` cannot replace it.
  */
 export declare function envelopeDetails(body: Record<string, unknown> | null | undefined): unknown;
 /**

package/dist/base-command.js

@@ -17,6 +17,7 @@ exports.describeDaemonScopedCredential = describeDaemonScopedCredential;
 exports.isTypedServerRefusal = isTypedServerRefusal;
 exports.isApplicationCodedUnavailable = isApplicationCodedUnavailable;
 exports.isRetryableFailure = isRetryableFailure;
+exports.errorBodyMessage = errorBodyMessage;
 exports.envelopeDetails = envelopeDetails;
 exports.retiredFlagHint = retiredFlagHint;
 exports.parseErrorRemedy = parseErrorRemedy;
@@ -63,6 +64,7 @@ const step_up_1 = require("./lib/step-up");
 const delegated_cli_1 = require("./lib/delegated-cli");
 const dedicated_guest_1 = require("./lib/dedicated-guest");
 const harness_context_1 = require("./lib/harness-context");
+const task_resource_references_1 = require("./lib/task-resource-references");
 const tasks_1 = require("./lib/tasks");
 function assigneePayloadNeedsResolution(payload) {
     const fields = [
@@ -199,6 +201,26 @@ class BaseCommand extends core_1.Command {
     printJsonResult(value, options = {}) {
         this.log(JSON.stringify((0, json_output_1.withOk)(value, options.ok ?? true), null, 2));
     }
+    jsonOperationContext;
+    /** Opt in at the command boundary, including its existing structured errors. */
+    setJsonOperation(options) {
+        this.jsonOperationContext = { ...this.jsonOperationContext, ...options };
+    }
+    /** Decorate an object when a command owns its own JSON/signal serializer. */
+    jsonOperationResult(value, options = {}) {
+        return (0, json_output_1.withCliOperation)(value, {
+            command: this.id ?? '', mode: 'execute', outcome: 'succeeded',
+            ...this.jsonOperationContext, ...options,
+        });
+    }
+    printJsonOperation(value, options = {}) {
+        this.printJsonResult(this.jsonOperationResult(value, options));
+    }
+    jsonOperationError(value) {
+        return this.jsonOperationContext
+            ? this.jsonOperationResult(value, { outcome: 'failed', writeState: 'unknown' })
+            : value;
+    }
     cliConfig;
     /**
      * Resolved credential for this process. Populated in `init()` and
@@ -616,6 +638,43 @@ class BaseCommand extends core_1.Command {
      * instead of the resolution being quietly wrong.
      */
     static resolveSpaceFlag = true;
+    taskResourceReferenceCache;
+    async resolveTaskResourceReferences(payload, options = {}) {
+        const cache = options.cache ?? (this.taskResourceReferenceCache ??= new Map());
+        let existingTask = options.existingTask;
+        // An ordinary UUID patch must keep its old request count. Only a readable
+        // scoped reference needs a current Task read to discover its Space.
+        const needsScope = ['projectId', 'goalId'].some(field => {
+            const value = payload[field];
+            return typeof value === 'string' && value.trim() &&
+                !/^[\da-f-]{36}$/i.test(value) && !/^[\da-f]{24}$/i.test(value);
+        });
+        try {
+            if (needsScope && !payload.spaceId && !existingTask && options.taskId) {
+                const key = `task:${options.taskId}`;
+                if (!cache.has(key))
+                    cache.set(key, data_provider_1.dataService.getTask(options.taskId, { enrich: false }));
+                existingTask = await cache.get(key);
+            }
+            await (0, task_resource_references_1.resolveTaskResourceReferences)(payload, {
+                existingTask,
+                cache,
+                resolveSpace: value => this.resolveSpaceReference(value),
+            });
+        }
+        catch (error) {
+            if (error instanceof task_resource_references_1.TaskResourceReferenceError) {
+                this.failWithCliError({
+                    message: error.message,
+                    code: error.code,
+                    exit: 2,
+                    retryable: false,
+                    details: { context: { candidates: error.candidates } },
+                });
+            }
+            this.handleApiError(error);
+        }
+    }
     /**
      * Turn a space reference into a space id, or fail the command.
      *
@@ -650,7 +709,14 @@ class BaseCommand extends core_1.Command {
             catch (err) {
                 this.handleApiError(err);
             }
-            const rows = (response?.data ?? []);
+            const envelope = response;
+            if (!Array.isArray(envelope?.data) || envelope?.has_more === true) {
+                this.failWithCliError({
+                    message: 'The Space lookup is incomplete or unavailable, so a unique match cannot be established. Use a canonical Space id, or narrow the search with spaces list --q <name>.',
+                    code: 'SPACE_REF_LOOKUP_INCOMPLETE', exit: 2, retryable: false,
+                });
+            }
+            const rows = envelope.data;
             return rows.map(space_resolver_1.spaceRefFrom).filter((s) => s !== null);
         };
         let outcome = (0, space_resolver_1.resolveSpaceRef)(normalizedQuery, await load(false));
@@ -724,7 +790,7 @@ class BaseCommand extends core_1.Command {
         // both contracts.
         if (!(0, projects_1.looksLikeCanonicalProjectId)(projectRef)) {
             this.failWithCliError({
-                message: 'Name the space: pass --space, or use the qualified ref `<space>/<project>` that `projects list` prints.',
+                message: 'Name the space: pass --space <space-id-or-ref>, or qualify the project ref as <space-id-or-ref>/<project-ref> (for example OSK-S-3/OSK-P-12).',
                 code: 'PROJECT_REF_REQUIRES_SPACE',
                 exit: 2,
                 retryable: false,
@@ -752,7 +818,7 @@ class BaseCommand extends core_1.Command {
                 // A server that predates the lookup. The caller's old remedy still
                 // works there, so the error names it rather than a server upgrade only.
                 this.failWithCliError({
-                    message: 'This skrr server cannot look a project up by id — name the space: pass --space, or use the qualified ref `<space>/<project>` that `projects list` prints.',
+                    message: 'This skrr server cannot look a project up by id — name the space: pass --space <space-id-or-ref>, or qualify the project as <space-id-or-ref>/<project-id>.',
                     code: 'PROJECT_REF_REQUIRES_SPACE',
                     exit: 2,
                     retryable: false,
@@ -824,7 +890,14 @@ class BaseCommand extends core_1.Command {
         catch (err) {
             this.handleApiError(err);
         }
-        const rows = (response?.data ?? []);
+        const envelope = response;
+        if (!Array.isArray(envelope?.data) || envelope?.has_more === true) {
+            this.failWithCliError({
+                message: 'The Task-title lookup is incomplete or unavailable, so a unique match cannot be established. Use a Task id/ref from tasks list --q <title>.',
+                code: 'TASK_REF_LOOKUP_INCOMPLETE', exit: 2, retryable: false,
+            });
+        }
+        const rows = envelope.data;
         const candidates = rows.map(task_ref_resolver_1.taskRefFrom).filter((t) => t !== null);
         const outcome = (0, task_ref_resolver_1.resolveTaskRef)(query, candidates);
         if (outcome.ok)
@@ -1076,7 +1149,7 @@ class BaseCommand extends core_1.Command {
      * caller that cannot watch: it is checked HERE, before the first write, and a
      * mismatch is a non-retryable usage error.
      */
-    async assertWriteTarget(expected) {
+    async assertWriteTarget(expected, options = {}) {
         const target = await this.describeWriteTarget();
         const unmet = (0, write_target_1.firstUnmetExpectation)(target, expected);
         if (unmet !== undefined) {
@@ -1093,7 +1166,7 @@ class BaseCommand extends core_1.Command {
             });
         }
         if (process.stderr.isTTY) {
-            process.stderr.write(`Writing to ${(0, write_target_1.formatWriteTarget)(target)}\n`);
+            process.stderr.write(`${options.preview ? 'Dry run target:' : 'Writing to'} ${(0, write_target_1.formatWriteTarget)(target)}\n`);
         }
         return target;
     }
@@ -1225,7 +1298,7 @@ class BaseCommand extends core_1.Command {
             const exit = err.exitCode ?? err.oclif?.exit ?? 1;
             process.exitCode = exit;
             const details = detailsFromCaughtError(err) ?? httpBody;
-            this.log(JSON.stringify({
+            this.log(JSON.stringify(this.jsonOperationError({
                 ok: false,
                 error: {
                     code: err.code ?? parseCliErrorCode(err),
@@ -1236,7 +1309,7 @@ class BaseCommand extends core_1.Command {
                     ...parseErrorRemedy(err, this.id, this.config?.bin),
                     ...(details ? { details } : {}),
                 },
-            }, null, 2));
+            }), null, 2));
             return;
         }
         return super.catch(err);
@@ -1310,7 +1383,9 @@ class BaseCommand extends core_1.Command {
             const body = parseErrorBody(e.body);
             const bodyCode = stringProp(body, 'code') || stringProp(body, 'errorType');
             // A body path the person never typed is read back as the flag that wrote it (OSK-15313).
-            const bodyMessage = (0, request_field_flags_1.translateRequestFieldPaths)(stringProp(body, 'message') || stringProp(body, 'error'), this.requestFieldFlags);
+            // The server answers every error with `message` (OSK-16986); `errorBodyMessage` keeps the
+            // older `error` string and the nested `/v1` shape as fallbacks for a server without it.
+            const bodyMessage = (0, request_field_flags_1.translateRequestFieldPaths)(errorBodyMessage(body), this.requestFieldFlags);
             // `requireAuth()` catches this before requests for normal commands, but
             // keep the API-error check too: a handful of commands make a direct
             // request and a supplied `--token` can bypass their normal preflight.
@@ -1434,7 +1509,7 @@ class BaseCommand extends core_1.Command {
                 // latched refresh refusal names the half the reader can act on.
                 const refreshRefusal = presentedCiToken || presentedPat
                     ? null
-                    : (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
+                    : (0, auth_failure_1.describeRefreshRefusal)((0, auth_failure_1.refusalFromResponse)(body, readRefreshRefusal()), {
                         bin: this.config.bin,
                         cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
                     });
@@ -1808,7 +1883,7 @@ class BaseCommand extends core_1.Command {
         // that. Lead with the sign-in, name the refused refresh when one is latched,
         // and give the order the fix has to happen in: sign in, THEN replay.
         if (e.status === 401) {
-            const refusal = (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
+            const refusal = (0, auth_failure_1.describeRefreshRefusal)((0, auth_failure_1.refusalFromResponse)(parseErrorBody(err.body), readRefreshRefusal()), {
                 bin: this.config.bin,
                 cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
             });
@@ -1903,7 +1978,7 @@ class BaseCommand extends core_1.Command {
     /** E6: the server's `Retry-After` for the refused call, when it was a 429. */
     lastRetryAfterMs;
     writeJsonCliError({ message, code, status, exit, retryable, details, requestId, }) {
-        this.log(JSON.stringify({
+        this.log(JSON.stringify(this.jsonOperationError({
             ok: false,
             error: {
                 code,
@@ -1922,7 +1997,7 @@ class BaseCommand extends core_1.Command {
                 ...(this.lastRetryAfterMs !== undefined ? { retryAfterMs: this.lastRetryAfterMs } : {}),
                 ...(details ? { details } : {}),
             },
-        }, null, 2));
+        }), null, 2));
         this.exit(exit);
     }
     /**
@@ -1988,7 +2063,13 @@ function parseGlobalFlags(argv) {
 function readRefreshRefusal() {
     try {
         const state = (0, auth_core_1.needsReauthState)();
-        return state.needed ? { reason: state.reason, message: state.message } : null;
+        return state.needed
+            ? {
+                reason: state.reason,
+                message: state.message,
+                ...(state.revocationReason ? { revocationReason: state.revocationReason } : {}),
+            }
+            : null;
     }
     catch {
         return null;
@@ -2022,7 +2103,7 @@ function apiRefusal(err) {
     const body = parseErrorBody(err.body);
     return {
         code: stringProp(body, 'code') || stringProp(body, 'errorType'),
-        message: stringProp(body, 'message') || stringProp(body, 'error'),
+        message: errorBodyMessage(body),
         ...(body ? { body } : {}),
     };
 }
@@ -2460,21 +2541,45 @@ const RETIRED_FLAG_REPLACEMENTS = {
         '`tasks deliverable add`.',
     '--supersede': '--supersede is implicit: submitting again creates a new Result version.',
 };
+/**
+ * The human text of an API error body (OSK-16986). The server's error envelope guarantees
+ * `message`; the legacy `error` string and the nested `{ error: { message } }` (`/v1`) are read
+ * only for a server or a proxy that did not pass that boundary. Same order as
+ * `errorBodyMessage` in `@skrr-ai/data-provider`, kept here because the CLI's specs replace that
+ * package with partial mocks and this runs on every API failure.
+ */
+function errorBodyMessage(body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return undefined;
+    const record = body;
+    const text = (value) => typeof value === 'string' && value.trim() !== '' ? value : undefined;
+    const nested = record.error && typeof record.error === 'object' && !Array.isArray(record.error)
+        ? record.error.message
+        : undefined;
+    return text(record.message) ?? text(record.error) ?? text(nested);
+}
 /**
  * The `details` of a CLI error envelope, in ONE shape. The server's refusal body becomes the
  * envelope's details; when that body carries its own `details` object (a typed refusal's
  * findings, e.g. `signalableNodeKeys`), those fields are lifted to the same level instead of
- * arriving as `error.details.details`, a depth no other error used (OSK-16494). A body without
- * a nested object is passed through unchanged.
+ * arriving as `error.details.details`, a depth no other error used (OSK-16494).
+ *
+ * The human text is always `details.message` (OSK-16986): the server's error envelope guarantees
+ * it, and for an older server that wrote only `error` (or the nested `/v1` shape) it is filled
+ * from there, so no caller reads two places. A lifted `details.message` cannot replace it.
  */
 function envelopeDetails(body) {
     if (!body)
         return undefined;
+    const message = errorBodyMessage(body);
     const nested = body.details;
-    if (!nested || typeof nested !== 'object' || Array.isArray(nested))
-        return body;
-    const { details: _nested, ...rest } = body;
-    return { ...rest, ...nested };
+    const lifted = !nested || typeof nested !== 'object' || Array.isArray(nested)
+        ? body
+        : (() => {
+            const { details: _nested, ...rest } = body;
+            return { ...rest, ...nested };
+        })();
+    return message === undefined ? lifted : { ...lifted, message };
 }
 /**
  * The commands those flags were retired FROM. The table was applied to every command, so a
@@ -2532,7 +2637,16 @@ function parseErrorRemedy(err, commandId, bin = 'skrr') {
                 `Pass --${flag} <value>. Run \`${helpCommand}\` for its description and accepted values.`,
         };
     }
-    const nonexistent = /Nonexistent flag[s]?:?\s*(-{1,2}[\w-]+)/i.exec(message);
+    const nonexistent = /Nonexistent flag[s]?:?\s*(-{1,2}[\w-]+)(?:[ =]([^\s,][^,\n]*))?/i.exec(message);
+    if (nonexistent?.[2]) {
+        // `"--outcome failed"` arrived as ONE argument: the flag may well exist, so
+        // "remove it" would be wrong advice. Same case retiredFlagHint explains in text.
+        return {
+            flag: nonexistent[1].replace(/^-+/, ''),
+            fix: suggestion ??
+                `Pass the flag and its value as separate arguments: ${nonexistent[1]} ${nonexistent[2].trim()}`,
+        };
+    }
     if (nonexistent) {
         return {
             flag: nonexistent[1].replace(/^-+/, ''),

package/dist/commands/actions/list.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const list_output_1 = require("../../lib/list-output");
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -38,7 +39,7 @@ class ActionsList extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.printJsonResult((0, list_output_1.listResult)(response));
             return;
         }
         (0, action_listings_1.renderActionListings)(response.data, (line) => this.log(line));

package/dist/commands/agenda/trigger/create.js

@@ -38,7 +38,7 @@ class AgendaTriggerCreate extends base_command_1.BaseCommand {
             required: true,
         }),
         prompt: core_1.Flags.string({
-            description: 'The instruction the agent receives when the trigger fires (max 4000 chars). Write in second person.',
+            description: `The instruction the agent receives when the trigger fires (max ${data_provider_1.TRIGGER_PROMPT_TEMPLATE_MAX_CHARS} chars). Write in second person.`,
             required: true,
         }),
         cron: core_1.Flags.string({

package/dist/commands/agenda/trigger/list.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isUnconfirmedTurnCapture = isUnconfirmedTurnCapture;
+const list_output_1 = require("../../../lib/list-output");
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
@@ -55,7 +56,7 @@ class AgendaTriggerList extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.printJsonResult((0, list_output_1.listResult)(response));
             return;
         }
         const r = response;

package/dist/commands/agent-groups/list.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const list_output_1 = require("../../lib/list-output");
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -24,7 +25,7 @@ class AgentGroupsList extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.printJsonResult((0, list_output_1.listResult)(response));
             return;
         }
         // Defensive shape handling — accept either { data: [...] } or a plain array.

package/dist/commands/agents/actions/list.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const list_output_1 = require("../../../lib/list-output");
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../../base-command");
 const agent_actions_1 = require("../../../lib/agent-actions");
@@ -27,7 +28,7 @@ class AgentsActionsList extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(actions, null, 2));
+            this.printJsonResult((0, list_output_1.listResult)(actions));
             return;
         }
         (0, agent_actions_1.renderActions)(actions, (line) => this.log(line));

package/dist/commands/agents/always-on/status.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
+const agent_proactive_baseline_1 = require("../../../lib/agent-proactive-baseline");
 /**
  * `skrr agents always-on status <agent-id>` — read the composed generation-aware
  * Always-On status envelope via the single control endpoint
@@ -62,6 +63,10 @@ class AgentsAlwaysOnStatus extends base_command_1.BaseCommand {
             const reasons = (status.messaging.degradedReasons || []).join(', ') || 'unknown';
             this.log(`Messaging:        degraded (${reasons})`);
         }
+        // Read-only setup facts: who wrote the policy/Compass, which system loops
+        // and watchers exist, and the command that repairs each gap.
+        for (const line of (0, agent_proactive_baseline_1.proactiveBaselineLines)(status.proactiveBaseline))
+            this.log(line);
     }
 }
 exports.default = AgentsAlwaysOnStatus;

package/dist/commands/agents/chat.js

@@ -456,7 +456,10 @@ class AgentsChat extends base_command_1.BaseCommand {
      * canonical scope at all. Naming that at launch is cheap; discovering it
      * mid-run costs a session.
      */
-    static TASK_REF_IN_PROMPT = /\b(?:OSK-\d+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/;
+    // UUIDs identify Stores, versions, files and conversations too. Only a
+    // Task identifier or a UUID with an explicit Task label/URL/command earns
+    // this warning; a resource UUID alone cannot establish its kind.
+    static TASK_REF_IN_PROMPT = new RegExp(String.raw `\bOSK-\d+\b|(?:\btask(?:[\s_-]*(?:id|uuid))?\s*[:=]?\s*["'\x60]?|/tasks?/|\bskrr\s+tasks\s+(?:(?:updates|result|expectations|deliverable|comments|resume)\s+)?[a-z-]+\s+)[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b`, 'i');
     /**
      * `--local-skill` names → the references the server resolves, from the daemon
      * that will run the turn. Any name that does not resolve stops the command:

package/dist/commands/agents/create.d.ts

@@ -71,7 +71,8 @@ export declare function unappliedPayloadKeys(sent: Record<string, unknown>, crea
  * to claim a platform role that they had misspelled something.
  */
 export declare function unappliedPayloadKeysWarning(keys: readonly string[]): string;
-export declare function backgroundLoopLines(agentId: string, relationshipLoopsSkipped: boolean): string[];
+export declare function initialAutonomyReceipt(created: unknown, requested: unknown): boolean | 'unconfirmed';
+export declare function backgroundLoopLines(agentId: string, relationshipLoopsSkipped: boolean, initialAlwaysOn?: boolean | 'unconfirmed'): string[];
 /**
  * The flags `--from-spec` may be combined with: placement and identity for the
  * NEW row, which a spec document deliberately cannot carry (where an agent runs
@@ -96,6 +97,7 @@ export default class AgentsCreate extends BaseCommand {
         target: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'next-target': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'working-directory': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'initial-always-on': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'no-relationship-loops': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'default-permission-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         tools: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;