@skrr-ai/cli 0.1.110 → 0.1.113

package/dist/lib/auth-failure.js

@@ -13,7 +13,34 @@
  * latch and turns it into the sentence the error should have carried.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.refusalFromResponse = refusalFromResponse;
 exports.describeRefreshRefusal = describeRefreshRefusal;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * OSK-16941 — the refusal an API 401 body describes, when it is a revoked
+ * session (`{ code: 'SESSION_REVOKED', reason }`). Lets the 401 explain itself
+ * when no refresh refusal was latched, and fills the reason in when the latch
+ * predates it.
+ */
+function refusalFromResponse(body, latched) {
+    const revoked = body?.code === 'SESSION_REVOKED';
+    if (latched?.reason) {
+        if (latched.reason === 'SESSION_REVOKED' &&
+            !latched.revocationReason &&
+            revoked &&
+            typeof body?.reason === 'string') {
+            return { ...latched, revocationReason: body.reason };
+        }
+        return latched;
+    }
+    if (!revoked)
+        return null;
+    return {
+        reason: 'SESSION_REVOKED',
+        ...(typeof body?.reason === 'string' ? { revocationReason: body.reason } : {}),
+        ...(typeof body?.message === 'string' && body.message ? { message: body.message } : {}),
+    };
+}
 /**
  * Explain one refresh refusal in terms of what the reader can do about it.
  * Returns null when there is no latched refusal, so the caller keeps its
@@ -47,11 +74,21 @@ function describeRefreshRefusal(refusal, opts) {
         };
     }
     if (code === 'SESSION_REVOKED') {
+        // OSK-16941 — say WHY, in the shared words, and what to do. A latch with no
+        // reason (an older server or auth-core) reads "we could not tell why".
+        const revocationReason = (0, data_provider_1.normalizeSessionRevocationReason)(refusal.revocationReason);
+        const brokered = revocationReason === 'machine_removed' ||
+            revocationReason === 'logged_out' ||
+            revocationReason === 'unknown'
+            ? ` Revoking a daemon that brokered this sign-in ends it too (\`${bin} login\` ` +
+                `without a browser signs in through this machine's daemon).`
+            : '';
         return {
             code,
-            message: `This sign-in was revoked${said}. Signing out elsewhere revokes it, and so does ` +
-                `revoking a daemon that brokered it (\`${bin} login\` without a browser signs in ` +
-                `through this machine's daemon). ${relogin}`,
+            revocationReason,
+            message: `This sign-in was revoked${said}. ` +
+                (0, data_provider_1.formatSessionRevocation)(refusal.revocationReason, { surface: 'cli', bin }) +
+                brokered,
         };
     }
     if (code === 'REFRESH_REUSED') {

package/dist/lib/cli-installers.d.ts

@@ -1,6 +1,13 @@
-/** Matches `ManagedCliAuthenticationState` in `daemon/src/cli-installers.ts`. */
+/**
+ * Matches `ManagedCliAuthenticationState` in `daemon/src/cli-installers.ts`.
+ *
+ * `unverified` (OSK-16927): a local sign-in exists and this daemon has not seen
+ * a model answer through it. It prints verbatim as the READINESS word, so a
+ * daemon older than the status never sends it and a CLI older than the daemon
+ * prints it unchanged.
+ */
 export interface ManagedCliAuthentication {
-    status: 'ready' | 'interactive-required' | 'headless-key-required';
+    status: 'ready' | 'unverified' | 'interactive-required' | 'headless-key-required';
     source: 'environment' | 'browser' | 'none';
     message: string;
 }

package/dist/lib/command-miss.js

@@ -105,6 +105,110 @@ function describeFlatRedirect(config, parts, spokenId) {
         suggestions: targets.map((t) => `${config.bin} ${t.id}`),
     };
 }
+/** Intent hints are suggestions, never aliases: mutation verbs must still be explicit. */
+const SUGGESTED_VERBS = {
+    view: ['show', 'get'],
+    describe: ['show', 'get'],
+    read: ['show', 'get'],
+    info: ['show', 'get'],
+    details: ['show', 'get'],
+    fetch: ['show', 'get'],
+    new: ['create'],
+    add: ['create'],
+    edit: ['update'],
+};
+const PROJECT_WORKFLOW = [
+    {
+        id: 'projects:list',
+        usage: 'projects list --space <space>',
+        answers: 'list projects in a Space',
+    },
+    {
+        id: 'projects:create',
+        usage: 'projects create --space <space> --title "Project title"',
+        answers: 'create a project in a Space',
+    },
+];
+const DEPENDENCY_WORKFLOW = [
+    {
+        id: 'tasks:show',
+        usage: 'tasks show <task> --json',
+        answers: 'inspect blockedByIds and blocksIds dependencies',
+    },
+    {
+        id: 'tasks:update',
+        usage: 'tasks update <task> --add-blocked-by <blocker-task>',
+        answers: 'make this task wait on another task; use --remove-blocked-by to remove that dependency',
+    },
+    {
+        id: 'tasks:create-tree',
+        usage: 'tasks create-tree --help',
+        answers: 'create a task tree with blockedByTempIds dependencies',
+    },
+];
+const TASK_OPERATIONS = [
+    { id: 'tasks:guide', usage: 'tasks guide', answers: 'find the commands for Task planning, dependencies, execution, and results' },
+];
+const TASK_PREFLIGHT = [
+    { id: 'tasks:preflight', usage: 'tasks preflight <task>', answers: 'read workflow blockers and execution prerequisites without starting work; shell execution remains unverified' },
+    { id: 'tasks:actionability', usage: 'tasks actionability <task>', answers: 'read the canonical next actor and allowed workflow actions' },
+    { id: 'tasks:start', usage: 'tasks start <task> --dry-run', answers: 'read only the server execution preview; never starts a Run' },
+];
+const WORKFLOW_HINTS = {
+    'spaces:projects': PROJECT_WORKFLOW,
+    'spaces:phases': PROJECT_WORKFLOW,
+    'tasks:dependencies': DEPENDENCY_WORKFLOW,
+    'tasks:blockers': DEPENDENCY_WORKFLOW,
+    'tasks:dependency': DEPENDENCY_WORKFLOW,
+    'tasks:operations': TASK_OPERATIONS,
+    'tasks:help': TASK_OPERATIONS,
+    'tasks:workflow-guide': TASK_OPERATIONS,
+    'tasks:check': TASK_PREFLIGHT,
+    'tasks:doctor': TASK_PREFLIGHT,
+    'tasks:readiness': TASK_PREFLIGHT,
+};
+function describeIntentMiss(config, parts) {
+    // An installed command (even one whose module cannot load) always owns its name.
+    const known = [...config.commandIDs, ...config.topicNames];
+    const typed = parts.join(':');
+    if (config.findCommand(typed) || known.includes(typed))
+        return null;
+    const concept = parts.slice(0, 2).join(':');
+    let targets = known.includes(concept) || config.findCommand(concept)
+        ? []
+        : WORKFLOW_HINTS[concept]?.filter((target) => config.findCommand(target.id) !== undefined);
+    if (!targets?.length) {
+        targets = [];
+        for (let i = 1; i < parts.length; i += 1) {
+            const prefix = parts.slice(0, i).join(':');
+            if (!known.some((id) => id === prefix || id.startsWith(`${prefix}:`)))
+                break;
+            const extended = parts.slice(0, i + 1).join(':');
+            if (known.some((id) => id === extended || id.startsWith(`${extended}:`)))
+                continue;
+            for (const verb of SUGGESTED_VERBS[parts[i].toLowerCase()] ?? []) {
+                const id = `${prefix}:${verb}`;
+                if (config.findCommand(id) === undefined)
+                    continue;
+                const usage = id.split(':').join(' ');
+                targets.push({
+                    id,
+                    usage,
+                    answers: `see ${config.bin} ${usage} --help for arguments and flags`,
+                });
+                break;
+            }
+            break;
+        }
+    }
+    if (!targets.length)
+        return null;
+    return {
+        message: `\`${config.bin} ${parts.join(' ')}\` is not a command.`,
+        fix: targets.map((t) => `  \`${config.bin} ${t.usage}\` — ${t.answers}`).join('\n'),
+        suggestions: targets.map((t) => `${config.bin} ${t.usage}`),
+    };
+}
 /** Cheap edit distance, bounded — this runs only on a miss. */
 function editDistance(a, b) {
     const rows = a.length + 1;
@@ -201,6 +305,9 @@ function analyzeCommandMiss(config, id) {
     const parts = String(id ?? '')
         .split(':')
         .filter(Boolean);
+    const intent = describeIntentMiss(config, parts);
+    if (intent)
+        return intent;
     for (let take = parts.length - 1; take >= 1; take -= 1) {
         const found = config.findCommand(parts.slice(0, take).join(':'));
         if (!found)

package/dist/lib/commitment-loop-status.js

@@ -40,6 +40,14 @@ function when(value) {
     const pad = (n) => String(n).padStart(2, '0');
     return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}`;
 }
+/**
+ * Standing health is an optional contract field (added with OSK-17003); read
+ * it defensively across package builds. `ok` is not worth a line.
+ */
+function standingHealth(row) {
+    const health = row.health;
+    return health && health.state !== 'ok' ? health : null;
+}
 function count(value) {
     return typeof value === 'number' && Number.isFinite(value) ? String(value) : '?';
 }
@@ -72,7 +80,9 @@ function watchSummary(status) {
                 ? '?'
                 : row.completeness === 'partial'
                     ? '~'
-                    : '✓';
+                    : standingHealth(row)
+                        ? '!'
+                        : '✓';
         return `${row.source}${mark}`;
     })
         .join(' ');
@@ -140,13 +150,15 @@ function formatLoopSummary(status) {
     }
     const watching = Array.isArray(status.watching) ? status.watching : [];
     const trouble = watching
-        .filter((row) => row.access !== 'readable' || row.completeness === 'partial')
+        .filter((row) => row.access !== 'readable' || row.completeness === 'partial' || standingHealth(row) !== null)
         .map((row) => {
         const access = row.access === 'blocked'
             ? 'CANNOT READ'
             : row.access === 'unknown'
                 ? 'not known'
-                : 'PARTIAL read';
+                : row.completeness === 'partial'
+                    ? 'PARTIAL read'
+                    : 'needs attention';
         return `${row.source} ${access}${row.reason ? ` (${row.reason})` : ''}`;
     });
     lines.push(`sources:   ${!watching.length ? 'none declared' : trouble.length ? trouble.join('; ') : 'all readable'}`);
@@ -202,6 +214,16 @@ function formatCommitmentLoopStatus(status) {
         if (Array.isArray(limitations) && limitations.length) {
             lines.push(`      not watched: ${limitations.join(', ')}`);
         }
+        const health = standingHealth(row);
+        if (health) {
+            const ref = row.ref;
+            lines.push(`      now: ${health.title}${health.code ? ` (${health.code})` : ''}${health.since ? ` since ${when(health.since)}` : ''}${ref ? ` [${ref}]` : ''}`);
+            lines.push(`      ${health.detail}`);
+            if (health.retryAfter)
+                lines.push(`      next retry: ${when(health.retryAfter)}`);
+            if (health.fix)
+                lines.push(`      fix: ${health.fix}`);
+        }
     }
     lines.push(`  Open loops:  ${count(status.pendingWork?.openLoops)}   Pending runs: ${count(status.pendingWork?.pendingRuns)}`);
     lines.push(`  Runs today:  ${runs(status)}   Spend today: ${spend(status)}`);

package/dist/lib/commitments.d.ts

@@ -1,4 +1,4 @@
-import { type CommitmentObservationsQuery, type CommitmentObservationsResponse } from '@skrr-ai/data-provider';
+import { type CommitmentAuthoringSnapshot, type CommitmentAuthoringWarning, type CommitmentObservationsQuery, type CommitmentObservationsResponse } from '@skrr-ai/data-provider';
 /**
  * commitments.ts — request-based client for the Commitments subsystem
  * (`/api/commitments/*`).
@@ -557,6 +557,7 @@ export interface CommitmentAccountingReadout {
     costNoSpendRunCount?: number;
     /** …of which the verdict rests on inference, not a recorded refusal. */
     costNoSpendInferredRunCount?: number;
+    costProjection?: CostProjectionCensus;
     costStatus?: 'reported' | 'partial' | 'unavailable' | 'not_applicable';
     recommendedAttemptMultiplier?: number | null;
     multiplierDerivation?: string;
@@ -582,6 +583,18 @@ export interface CommitmentCostWindow {
     /** …of which the verdict rests on inference, not a recorded refusal. */
     noSpendInferredRunCount?: number;
     costStatus?: 'reported' | 'partial' | 'unavailable' | 'not_applicable';
+    /** Which spend rule closed the window's days; older days keep that rule's census. */
+    projection?: CostProjectionCensus & {
+        olderDays?: Array<{
+            date?: string;
+            version?: number;
+        }>;
+    };
+}
+/** How many closed days were derived under an older spend rule than the current one. */
+export interface CostProjectionCensus {
+    currentVersion?: number;
+    olderDayCount?: number;
 }
 /**
  * The event-wake block of a Commitment's trigger status (`eventCapabilities`), as the server sends
@@ -832,7 +845,7 @@ export declare function describeOperation(operation: string | null | undefined,
  * under "Fix:" read as a remedy nobody wrote (OSK-16230). That narrative is
  * labelled `Blocker:` instead, and no remedy is made up for it.
  */
-type OperationFixLabel = 'Fix' | 'Blocker' | 'Last run';
+type OperationFixLabel = string;
 export declare function describeOperationFix(commitment: CommitmentView, operation: string | null | undefined): Array<{
     label: OperationFixLabel;
     text: string;
@@ -860,6 +873,22 @@ export declare function withLiveAssessment(commitment: CommitmentView, operating
  * nothing says so and names the version it left alone (OSK-16199); a server
  * that predates the receipt is reported as updated, exactly as before.
  */
+/**
+ * The warnings a Commitment write deserves (OSK-17003): what the replacement
+ * removed (a watched source, its settings, daily times), what now reads
+ * differently (daily times in a new timezone) and what stores without effect
+ * (an `agent_run` source with no declared keys, collaborator agents).
+ *
+ * The server's `warnings` win when the response carries the field. An older
+ * server sends none, so the CLI derives the same list locally from the contract
+ * it read and the payload it sent — one derivation, `@skrr-ai/data-provider`'s.
+ */
+export declare function commitmentWriteWarnings(response: unknown, fallback: {
+    before?: CommitmentAuthoringSnapshot | null;
+    payload: Record<string, unknown>;
+}): CommitmentAuthoringWarning[];
+/** One `Warning:` line per authoring warning, after the write's own output. */
+export declare function renderCommitmentWriteWarnings(warnings: CommitmentAuthoringWarning[], warn: (line: string) => void): void;
 export declare function describeCommitmentRevision(revision: CommitmentRevisionReceipt | undefined): string;
 export declare function renderCommitmentSummary(commitment: CommitmentView, log: (line: string) => void, 
 /**
@@ -914,7 +943,13 @@ export declare function renderProactivenessScorecard(scorecard: ReadModelRecord,
  * or model), because that is the next question every reader asks.
  */
 export declare function formatCommitmentCycles(page: Partial<CommitmentCyclesResponse>): string[];
-/** The six questions for the latest Cycle, the first ✗ carrying its fix. */
+/** One line per typed refusal reason a Run's hypotheses met; never claim text. */
+export declare function hypothesisRefusalLines(run: {
+    hypothesisRefusals?: Array<{
+        reason: string;
+        count: number;
+    }>;
+}): string[];
 export declare function formatCommitmentExplanation(explanation: Partial<CommitmentExplanationResponse>): string[];
 /**
  * Print the continuation hint for a paged `object:'list'` response — the line
@@ -954,6 +989,12 @@ export declare function renderCommitmentHypotheses(response: ReadModelRecord, lo
 export declare function renderCommitmentLineage(lineage: ReadModelRecord, log: (line: string) => void): void;
 /** Human view for daily control-loop metrics. */
 export declare function renderCommitmentMetrics(response: ReadModelRecord, log: (line: string) => void): void;
+/**
+ * The spend rule a closed day was derived under (OSK-15500): `open` until the day
+ * closes, `vN` when current, `vN (older)` when a later rule exists, so a day whose
+ * cost census predates the current rule is visible in the table.
+ */
+export declare function costRuleCell(projection: Record<string, unknown> | null | undefined, closed?: boolean): string;
 /** Human view for the case list — one row per durable problem case. */
 export declare function renderCommitmentCases(response: ReadModelRecord, log: (line: string) => void): void;
 /**

package/dist/lib/commitments.js

@@ -25,6 +25,8 @@ exports.describeOperation = describeOperation;
 exports.describeOperationFix = describeOperationFix;
 exports.describeStoppedBy = describeStoppedBy;
 exports.withLiveAssessment = withLiveAssessment;
+exports.commitmentWriteWarnings = commitmentWriteWarnings;
+exports.renderCommitmentWriteWarnings = renderCommitmentWriteWarnings;
 exports.describeCommitmentRevision = describeCommitmentRevision;
 exports.renderCommitmentSummary = renderCommitmentSummary;
 exports.describeWakeDecision = describeWakeDecision;
@@ -33,6 +35,7 @@ exports.renderCommitmentLedger = renderCommitmentLedger;
 exports.renderCommitmentTrace = renderCommitmentTrace;
 exports.renderProactivenessScorecard = renderProactivenessScorecard;
 exports.formatCommitmentCycles = formatCommitmentCycles;
+exports.hypothesisRefusalLines = hypothesisRefusalLines;
 exports.formatCommitmentExplanation = formatCommitmentExplanation;
 exports.renderListPageHint = renderListPageHint;
 exports.describeObservationArtifacts = describeObservationArtifacts;
@@ -41,6 +44,7 @@ exports.renderCommitmentObservations = renderCommitmentObservations;
 exports.renderCommitmentHypotheses = renderCommitmentHypotheses;
 exports.renderCommitmentLineage = renderCommitmentLineage;
 exports.renderCommitmentMetrics = renderCommitmentMetrics;
+exports.costRuleCell = costRuleCell;
 exports.renderCommitmentCases = renderCommitmentCases;
 exports.renderCommitmentCaseDetail = renderCommitmentCaseDetail;
 exports.renderCommitmentRemediationProposals = renderCommitmentRemediationProposals;
@@ -958,6 +962,19 @@ function describeOperation(operation, reason) {
     };
     return `not running — ${meaning[status] ?? status}`;
 }
+/**
+ * The label for the last Run's remedy: `Fix` when it is the only line, `Last
+ * run` beside a blocker, qualified when the stored verdict it came with is
+ * superseded, so a remedy about an earlier contract is not read as a claim
+ * about the current one (OSK-15389).
+ */
+function lastRunLabel(liveness, besideBlocker) {
+    if (liveness?.current !== false)
+        return besideBlocker ? 'Last run' : 'Fix';
+    return liveness.superseded?.reason === 'contract_changed_after_observation'
+        ? 'Last run (before the contract changed)'
+        : 'Last run (earlier observation)';
+}
 function describeOperationFix(commitment, operation) {
     if (operation === 'ready' || operation === 'working')
         return [];
@@ -981,14 +998,18 @@ function describeOperationFix(commitment, operation) {
     // What refused the last Run is a second fact, not an alternative to the
     // blocker: a paused Commitment whose Run was refused needs both a resume and
     // the fix, or resuming only fails again (OSK-15389). The sentence is the
-    // server's, derived on read from the failure code; it is printed whenever it
-    // exists and says something the blocker's fix does not.
+    // server's, derived on read from the failure code.
+    //
+    // It is printed even when the stored liveness verdict is superseded. A
+    // supersession says the stored OPERATION no longer describes the Commitment
+    // (it was paused, its contract was edited since); the last Run's refusal and
+    // its remedy are facts about that Run and stay true. Dropping them was
+    // exactly the case being fixed: paused after a refusal, contract edited since.
+    // The label says which Run the sentence is about instead.
     const liveness = commitment.state?.liveness;
-    const lastRunFix = liveness && liveness.current !== false && typeof liveness.diagnosisFix === 'string'
-        ? liveness.diagnosisFix.trim()
-        : '';
+    const lastRunFix = liveness && typeof liveness.diagnosisFix === 'string' ? liveness.diagnosisFix.trim() : '';
     if (lastRunFix && lastRunFix !== remediation) {
-        lines.push({ label: lines.length ? 'Last run' : 'Fix', text: lastRunFix });
+        lines.push({ label: lastRunLabel(liveness, lines.length > 0), text: lastRunFix });
     }
     return lines;
 }
@@ -1051,6 +1072,34 @@ function withLiveAssessment(commitment, operatingState) {
  * nothing says so and names the version it left alone (OSK-16199); a server
  * that predates the receipt is reported as updated, exactly as before.
  */
+/**
+ * The warnings a Commitment write deserves (OSK-17003): what the replacement
+ * removed (a watched source, its settings, daily times), what now reads
+ * differently (daily times in a new timezone) and what stores without effect
+ * (an `agent_run` source with no declared keys, collaborator agents).
+ *
+ * The server's `warnings` win when the response carries the field. An older
+ * server sends none, so the CLI derives the same list locally from the contract
+ * it read and the payload it sent — one derivation, `@skrr-ai/data-provider`'s.
+ */
+function commitmentWriteWarnings(response, fallback) {
+    if (response &&
+        typeof response === 'object' &&
+        Array.isArray(response.warnings)) {
+        return (0, data_provider_1.readCommitmentAuthoringWarnings)(response);
+    }
+    const changedFields = Object.keys(fallback.payload).filter((key) => key !== 'expectedVersion');
+    return (0, data_provider_1.deriveCommitmentAuthoringWarnings)({
+        before: fallback.before ?? null,
+        after: { ...(fallback.before ?? {}), ...fallback.payload },
+        changedFields: fallback.before ? changedFields : null,
+    });
+}
+/** One `Warning:` line per authoring warning, after the write's own output. */
+function renderCommitmentWriteWarnings(warnings, warn) {
+    for (const warning of warnings)
+        warn(warning.message);
+}
 function describeCommitmentRevision(revision) {
     if (!revision || typeof revision.changed !== 'boolean')
         return 'Updated commitment:';
@@ -1651,6 +1700,8 @@ function formatCommitmentCycles(page) {
         for (const run of cycle.runs || []) {
             if (run.reportPayload)
                 lines.push(`             run ${run.id} report: ${run.reportPayload.status === 'rejected' ? 'structured report rejected; plain summary used' : 'structured report validated (delivery tracked separately)'}`);
+            for (const line of hypothesisRefusalLines(run))
+                lines.push(`             ${line}`);
             if (!['machine', 'contract', 'work'].includes(run.failureClass))
                 continue;
             const owner = run.failureOwner === 'model' ? 'model' : run.failureOwner || 'work';
@@ -1691,6 +1742,20 @@ const ANSWER_GLYPH = { yes: '✓', no: '✗', 'n/a': '–' };
 /** The mark `cycles` already gives a chosen quiet: the loop looked and decided to say nothing. */
 const QUIET_ANSWER_GLYPH = CYCLE_GLYPH.quiet;
 /** The six questions for the latest Cycle, the first ✗ carrying its fix. */
+/** Why the causal ledger refused a hypothesis, for a person reading the run. */
+const HYPOTHESIS_REFUSAL_REASON = {
+    not_an_object: 'entry was not an object',
+    missing_statement: 'no statement',
+    missing_falsifier: 'no falsifier',
+    episode_cap_reached: 'episode already holds its limit of open claims',
+    unknown_hypothesis_id: 'named an id this investigation does not hold',
+    new_hypothesis_must_be_open: 'a new claim must start open',
+    server_only_hypothesis_status: 'that status is set only by the server',
+};
+/** One line per typed refusal reason a Run's hypotheses met; never claim text. */
+function hypothesisRefusalLines(run) {
+    return (run.hypothesisRefusals || []).map((refusal) => `${refusal.count} ${refusal.count === 1 ? 'hypothesis' : 'hypotheses'} not recorded: ${HYPOTHESIS_REFUSAL_REASON[refusal.reason] || refusal.reason} (${refusal.reason})`);
+}
 function formatCommitmentExplanation(explanation) {
     const cycle = explanation.cycle;
     const lines = [
@@ -1721,9 +1786,12 @@ function formatCommitmentExplanation(explanation) {
     // nobody on an unattended Run (OSK-12201). Same lines as show/preflight.
     if (cycle) {
         lines.push(...platformFetchLines(cycle));
-        for (const run of cycle.runs || [])
+        for (const run of cycle.runs || []) {
             if (run.reportPayload)
                 lines.push(`  run ${run.id} report: ${run.reportPayload.status === 'rejected' ? 'structured report rejected; plain summary used' : 'structured report validated (delivery tracked separately)'}`);
+            for (const line of hypothesisRefusalLines(run))
+                lines.push(`  ${line}`);
+        }
     }
     lines.push(...permissionLines(explanation.permissions));
     return lines;
@@ -1790,8 +1858,22 @@ function observationLegend(data) {
     const shortened = data.some((item) => (0, format_1.formatCell)(firstValue(item, ['value', 'observedValue', 'latestValue'])).length >
         OBSERVATION_VALUE_WIDTH);
     if (shortened) {
-        lines.push('VALUE is shortened to fit this table (…); the stored value is complete in --json.');
-    }
+        lines.push('VALUE is shortened to fit this table (…); --json has the stored value.');
+    }
+    // The server stores a bounded copy of each reported value and marks every
+    // clamp. A clamped copy is not the value the run saw, and must not read as it.
+    const truncated = data.filter((item) => Array.isArray(item.truncation) && item.truncation.length > 0);
+    for (const item of truncated.slice(0, 5)) {
+        const cuts = item.truncation
+            .map((cut) => cut.kind === 'bytes'
+            ? `${text(cut.total)} bytes, over the store limit: nothing kept`
+            : `${text(cut.kind).replace('_', ' ')} at ${text(cut.path)}: kept ${text(cut.retained)} of ${text(cut.total)}`)
+            .join('; ');
+        lines.push(`VALUE TRUNCATED for ${text(item.key)} at ${text(firstValue(item, ['observedAt', 'createdAt']))}: ${cuts}. ` +
+            'CHANGED still compares the complete reported value.');
+    }
+    if (truncated.length > 5)
+        lines.push(`VALUE TRUNCATED for ${truncated.length - 5} more rows; see truncation in --json.`);
     if (data.some((item) => item.declared === false)) {
         lines.push('DECLARED no / REASON undeclared: the key is not declared on this Commitment’s agent_run ' +
             'source, so the reading is recorded but can never open a loop.');
@@ -1945,6 +2027,7 @@ function renderCommitmentMetrics(response, log) {
             date: text(firstValue(item, ['date', 'dateStart'])),
             checks: text(firstValue(totals, ['checks', 'totalChecks']), '0'),
             succeeded: text(firstValue(totals, ['succeededChecks', 'succeeded']), '0'),
+            costRule: costRuleCell(record(item.costProjection), Boolean(record(item.recompute)?.closedAt)),
             health: (0, format_1.formatCell)(health),
             sources: records(item.sources)
                 .map((source) => text(source.source, 'source'))
@@ -1954,10 +2037,25 @@ function renderCommitmentMetrics(response, log) {
         { key: 'date', header: 'DATE', maxWidth: 24 },
         { key: 'checks', header: 'CHECKS' },
         { key: 'succeeded', header: 'SUCCEEDED' },
+        { key: 'costRule', header: 'COST RULE', maxWidth: 14 },
         { key: 'health', header: 'HEALTH', maxWidth: 28 },
         { key: 'sources', header: 'SOURCES', maxWidth: 48 },
     ], 'No daily metrics recorded.', log);
 }
+/**
+ * The spend rule a closed day was derived under (OSK-15500): `open` until the day
+ * closes, `vN` when current, `vN (older)` when a later rule exists, so a day whose
+ * cost census predates the current rule is visible in the table.
+ */
+function costRuleCell(projection, closed = Boolean(projection)) {
+    // A closed day without a description came from a server that does not send one.
+    if (!projection)
+        return closed ? '-' : 'open';
+    const version = Number(projection.version);
+    if (!Number.isInteger(version))
+        return '-';
+    return projection.current === false ? `v${version} (older)` : `v${version}`;
+}
 /** Human view for the case list — one row per durable problem case. */
 function renderCommitmentCases(response, log) {
     const data = records(response.data);

package/dist/lib/compasses.d.ts

@@ -8,6 +8,10 @@ export interface CompassInvariantTarget {
     maintainedState?: string[];
     successMetrics?: string[];
     boundaries?: string[];
+    learnedTactics?: Array<{
+        id?: string;
+        description?: string;
+    }>;
     freshness?: Record<string, unknown>;
     cadence?: Record<string, unknown>;
     escalation?: Record<string, unknown>;

package/dist/lib/compasses.js

@@ -44,6 +44,12 @@ exports.compassApi = {
     appendTactic: (id, body) => data_provider_2.request.post(`${base(id)}/tactics`, body),
     commitments: (id, query) => data_provider_2.request.get((0, triggers_1.withQuery)(`${base(id)}/commitments`, query)),
 };
+const OVERFLOW_FIELD_LABEL = {
+    maintainedState: 'keeps-true entries',
+    successMetrics: 'success metrics',
+    boundaries: 'boundaries',
+    learnedTactics: 'learned tactics',
+};
 function shortDate(value) {
     if (!value)
         return '—';
@@ -120,6 +126,11 @@ function renderCompass(compass, log) {
             if (target.successMetrics?.length) {
                 log(`    measured by: ${target.successMetrics.join('; ')}`);
             }
+            // The agent's prompt carries a bounded number of each list. Say which
+            // were cut, so the list above is not read as what the agent sees.
+            for (const overflow of (0, data_provider_1.describeCompassOverflow)(target)) {
+                log(`    ! shown to the agent: ${overflow.rendered} of ${overflow.authored} ${OVERFLOW_FIELD_LABEL[overflow.field]} (${overflow.omitted} not shown)`);
+            }
         }
     }
     const tactics = compass.learnedTactics ?? [];

package/dist/lib/daemon-setup.js

@@ -98,13 +98,13 @@ async function offerDaemonSetup(opts = {}) {
     log('');
     log(`  This computer has no ${data_provider_1.BRAND.displayName} background service. It is what lets your agents work here —`);
     log('  running commands, editing files, and driving a browser on this machine.');
-    // What it does UNASKED is part of the decision, and it used to be found
-    // afterwards in a status table (OSK-16439). The defaults are the daemon's
-    // (`DEFAULT_CONFIG.permissions`, pinned against this sentence by
-    // `unattended-posture.spec.ts` in the daemon): reads, writes, shell commands
-    // and Claude sessions run without a prompt until someone changes them.
-    log('  Until you change it, agents can read files, edit files and run shell commands here');
-    log(`  without asking you first. To be asked before each call instead: \`${(0, daemon_command_hint_1.daemonCommandHint)('config', { extraArgs: '--require-approvals' })}\``);
+    // Disclose both the safe new-profile default and upgrade compatibility at
+    // the point where the person consents to a persistent local service.
+    log('  New local profiles require approval for file reads, edits and shell commands.');
+    log('  Cloud-started Claude Code sessions are refused until explicitly enabled.');
+    log('  Existing profiles keep their permission settings, which may allow tools without asking.');
+    log(`  Require approvals for this profile: \`${(0, daemon_command_hint_1.daemonCommandHint)('config', { extraArgs: '--require-approvals' })}\``);
+    log(`  Allow only a chosen category without asking: \`${(0, daemon_command_hint_1.daemonCommandHint)('config', { extraArgs: '--mode read=auto' })}\``);
     // This creates a persistent service with broad local capabilities, so a
     // bare Enter must visibly and behaviorally decline it. `confirm` names its
     // second argument `defaultNo`; passing false showed `[Y/n]` and accepted an

package/dist/lib/daemonHandoff.js

@@ -148,8 +148,9 @@ function describeDelivery(opts) {
 /**
  * Compare deployments, not spellings.
  *
- * `https://oversky.ai` and `https://skrr.ai` are one deployment under two names,
- * and the first is still what every daemon installed before the cutover carries.
+ * The pre-cutover production host and `https://skrr.ai` are one deployment under
+ * two names, and the first is still what every daemon installed before the cutover
+ * carries.
  * Trimming and lowercasing alone would report a move on every login from every
  * one of those machines — a warning that is wrong for the largest group of users
  * who would see it, which is how a signal becomes noise. `canonicalizeKnownBaseURL`

package/dist/lib/dedicated-ssh.d.ts

@@ -132,6 +132,8 @@ export interface SshProxyOptions {
     ttlSeconds?: number;
     getToken?: () => Promise<string>;
     recoveryMs?: number;
+    /** Process lifecycle; injectable so tests never signal the test runner. */
+    signalSource?: Pick<NodeJS.Process, 'on' | 'off'>;
     /** Injected for tests. */
     connect?: (url: string, opts: Parameters<typeof io>[1]) => Socket;
     /** Injected for tests. */