@skrr-ai/cli 0.1.110 → 0.1.113

package/dist/lib/task-preflight.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readTaskPreflight = readTaskPreflight;
+exports.taskPreflightLines = taskPreflightLines;
+const task_admission_1 = require("./task-admission");
+const task_operations_1 = require("./task-operations");
+const LIMITS = [
+    'Workflow and execution checks are separate server observations, not an atomic reservation.',
+    'No Run, shell command, machine probe, or branch checkout was performed.',
+    'Tool availability, working-directory access, and successful provider execution remain unverified.',
+    'Starting rechecks current Task authorization, runtime admission, and tool permissions.',
+];
+function unavailable(error, label) {
+    const row = error && typeof error === 'object' ? error : {};
+    const status = typeof row.status === 'number' ? row.status : undefined;
+    let code = typeof row.code === 'string' && /^[A-Z][A-Z0-9_]{0,100}$/.test(row.code) ? row.code : undefined;
+    // Keep the native typed refusal without echoing an arbitrary response body,
+    // HTML proxy page, request URL, or credential into diagnostics.
+    if (!code && typeof row.body === 'string') {
+        try {
+            const body = JSON.parse(row.body);
+            if (typeof body?.code === 'string' && /^[A-Z][A-Z0-9_]{0,100}$/.test(body.code))
+                code = body.code;
+        }
+        catch { /* non-JSON server refusal */ }
+    }
+    const remedy = status === 401
+        ? 'Restore the current CLI sign-in or delegated runtime credential, then repeat this read-only check.'
+        : status === 403
+            ? 'Ask the Task owner or an authorized administrator to check your access; preflight does not bypass permissions.'
+            : status === 404
+                ? 'Check the Task reference and server support for this diagnostic. No start fallback was attempted.'
+                : 'Read tasks actionability and tasks start --dry-run separately for the native refusal, then repeat preflight after resolving it.';
+    return {
+        status: 'unavailable', certainty: 'unknown', code: code || 'TASK_PREFLIGHT_UNAVAILABLE',
+        ...(status ? { httpStatus: status } : {}),
+        message: `${label} could not be confirmed${status ? ` (HTTP ${status})` : ''}.`, remedy,
+    };
+}
+function isWorkflow(value, taskId) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const row = value;
+    const a = row.actionability;
+    return row.taskId === taskId && Boolean(a &&
+        ['ready', 'running', 'waiting', 'terminal'].includes(a.state) &&
+        ['agent', 'human', 'system', 'external', 'none'].includes(a.nextActor) &&
+        typeof a.reasonCode === 'string' && typeof a.reason === 'string' &&
+        (a.actorRefs === undefined || Array.isArray(a.actorRefs) && a.actorRefs.every(ref => ref && ['user', 'agent'].includes(ref.kind) && typeof ref.id === 'string')) &&
+        Array.isArray(a.allowedActions) && a.allowedActions.every(action => action &&
+        typeof action.action === 'string' && (action.targetId === undefined || typeof action.targetId === 'string')));
+}
+function isPreview(value, taskId) {
+    if (!(0, task_admission_1.isAdmissionPreview)(value) || value.taskId !== taskId)
+        return false;
+    const a = value.executionAdmission;
+    return Boolean(typeof a.unattended === 'boolean' && typeof a.approverAvailable === 'boolean' &&
+        (a.constraints === undefined || Array.isArray(a.constraints) && a.constraints.every(c => c &&
+            (c.message === undefined || typeof c.message === 'string') &&
+            (c.requiredAction === undefined || typeof c.requiredAction === 'string'))) &&
+        (a.permission === undefined || a.permission && typeof a.permission === 'object' &&
+            (a.permission.mode == null || typeof a.permission.mode === 'string') &&
+            (a.permission.source === undefined || typeof a.permission.source === 'string')) &&
+        (a.shell === undefined || a.shell && typeof a.shell === 'object' &&
+            (a.shell.state === undefined || typeof a.shell.state === 'string')) &&
+        (a.workingDirectory === undefined || a.workingDirectory &&
+            (a.workingDirectory.path === null || typeof a.workingDirectory.path === 'string') &&
+            typeof a.workingDirectory.source === 'string'));
+}
+/** Compose native reads. This module cannot dispatch execution or infer grants. */
+async function readTaskPreflight(taskId, reads) {
+    const [workflowResult, executionResult] = await Promise.allSettled([
+        Promise.resolve().then(reads.workflow), Promise.resolve().then(reads.execution),
+    ]);
+    const workflow = workflowResult.status === 'fulfilled' && isWorkflow(workflowResult.value, taskId)
+        ? { status: 'observed', certainty: 'server_projection', value: workflowResult.value }
+        : unavailable(workflowResult.status === 'rejected' ? workflowResult.reason : { code: 'TASK_ACTIONABILITY_UNSUPPORTED' }, 'Workflow actionability');
+    const execution = executionResult.status === 'fulfilled' && isPreview(executionResult.value, taskId)
+        ? { status: 'observed', certainty: 'server_projection', value: executionResult.value }
+        : unavailable(executionResult.status === 'rejected' ? executionResult.reason : { code: 'TASK_START_PREVIEW_UNSUPPORTED' }, 'Execution preview');
+    // actionability.revision is the attention revision, not Task.version from
+    // start-preview. Equal numbers would not prove the reads shared a snapshot.
+    const workflowBlocked = workflow.status === 'observed' &&
+        !workflow.value.actionability.allowedActions.some(action => action.action === 'start_task');
+    const executionBlocked = execution.status === 'observed' && execution.value.executionAdmission.state === 'blocked';
+    const summary = workflowBlocked || executionBlocked ? 'blocked'
+        : workflow.status === 'unavailable' || execution.status === 'unavailable' ||
+            execution.value.executionAdmission.state !== 'ready' ? 'unknown'
+            : 'eligible_to_attempt';
+    return { taskId, summary, workflow, execution, consistency: 'independent_observations', limits: [...LIMITS] };
+}
+function taskPreflightLines(report, bin = 'skrr') {
+    const lines = [`Task preflight: ${report.taskId}`, `Start eligibility: ${report.summary.replaceAll('_', ' ')} (current server projections)`];
+    if (report.workflow.status === 'observed') {
+        const a = report.workflow.value.actionability;
+        lines.push('', `Workflow: ${a.state} (server projection)`, `Next actor: ${a.nextActor}`, `Why: ${a.reason} [${a.reasonCode}]`);
+        if (a.actorRefs?.length)
+            lines.push(`Eligible actors: ${a.actorRefs.map(ref => `${ref.kind}:${ref.id}`).join(', ')}`);
+        for (const action of a.allowedActions) {
+            const command = (0, task_operations_1.taskActionCommand)(action.action, report.taskId, action.targetId, bin, {
+                allowedActions: a.allowedActions,
+            });
+            lines.push(`  ${action.action}${command ? ` → ${command}` : ' (no single CLI remedy is mapped)'}`);
+        }
+        lines.push('Allowed actions describe the workflow; the caller must still have permission to perform them.');
+    }
+    else
+        lines.push('', `Workflow: unknown. ${report.workflow.message} [${report.workflow.code}]`, `Next step: ${report.workflow.remedy}`);
+    if (report.execution.status === 'observed') {
+        lines.push('', 'Execution prerequisites (server configuration; no execution test):', ...(0, task_admission_1.admissionLines)(report.execution.value.executionAdmission));
+        if (report.execution.value.executionAdmission.shell?.state) {
+            lines.push(`Shell approval prerequisites: ${report.execution.value.executionAdmission.shell.state} (policy only; shell execution unverified).`);
+        }
+        if (report.execution.value.executionAdmission.constraints?.length)
+            lines.push('Execution remedy owner: not reported by this server; ask the authorized Agent or Harness administrator.');
+    }
+    else
+        lines.push('', `Execution: unknown. ${report.execution.message} [${report.execution.code}]`, `Next step: ${report.execution.remedy}`);
+    lines.push('', ...report.limits, `More operations: ${bin} tasks guide`);
+    return lines;
+}

package/dist/lib/task-resource-references.d.ts

@@ -0,0 +1,23 @@
+type RecordValue = Record<string, unknown>;
+export type TaskResourceReferenceCache = Map<string, Promise<unknown>>;
+export type TaskResourceReferenceOptions = {
+    existingTask?: RecordValue;
+    cache?: TaskResourceReferenceCache;
+    resolveSpace: (value: string) => Promise<string>;
+    getTask?: (id: string) => Promise<RecordValue>;
+    getProject?: (id: string) => Promise<RecordValue>;
+    listProjects?: (spaceId: string) => Promise<unknown>;
+    listGoals?: (spaceId: string) => Promise<unknown>;
+};
+export declare class TaskResourceReferenceError extends Error {
+    readonly code: string;
+    readonly candidates: RecordValue[];
+    constructor(code: string, message: string, candidates?: RecordValue[]);
+}
+/**
+ * Resolve structured-input names as well as flag names, before assignment
+ * defaults. UUIDs keep their existing native validation path. A Goal is a
+ * relationship, not containment: a qualified Goal never moves its Task.
+ */
+export declare function resolveTaskResourceReferences(payload: RecordValue, options: TaskResourceReferenceOptions): Promise<void>;
+export {};

package/dist/lib/task-resource-references.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TaskResourceReferenceError = void 0;
+exports.resolveTaskResourceReferences = resolveTaskResourceReferences;
+const data_provider_1 = require("@skrr-ai/data-provider");
+const failed_lookup_1 = require("./failed-lookup");
+const projects_1 = require("./projects");
+const UUID = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
+const STORAGE_ID = /^[\da-f]{24}$/i;
+const str = (value) => typeof value === 'string' ? value.trim() : '';
+class TaskResourceReferenceError extends Error {
+    code;
+    candidates;
+    constructor(code, message, candidates = []) {
+        super(message);
+        this.code = code;
+        this.candidates = candidates;
+        this.name = 'TaskResourceReferenceError';
+    }
+}
+exports.TaskResourceReferenceError = TaskResourceReferenceError;
+function rows(body, kind) {
+    const value = body;
+    const data = value?.data ?? (kind === 'project' ? value?.projects : undefined);
+    if (!Array.isArray(data) || value?.has_more === true) {
+        throw new TaskResourceReferenceError('TASK_RESOURCE_LOOKUP_INCOMPLETE', `Cannot safely resolve a ${kind} name from an incomplete or unsupported list. Use its canonical id, or inspect ${kind}s list with --space.`);
+    }
+    return data.filter((row) => row !== null && typeof row === 'object');
+}
+/** Names are exact, case-insensitive matches. Never choose a fuzzy first hit. */
+function select(kind, query, candidates) {
+    const normalize = (v) => str(v).toLowerCase();
+    const q = normalize(query);
+    const byId = candidates.filter(row => normalize(row.id) === q || normalize(row.identifier) === q || normalize(row.ref) === q);
+    // Native project external keys are exact and case-sensitive, and take
+    // precedence over a human title, as they do on the project endpoint.
+    const byExternalKey = kind === 'project' ? candidates.filter(row => row.externalKey === query) : [];
+    const matches = byId.length ? byId : byExternalKey.length ? byExternalKey : candidates.filter(row => normalize(row.title) === q);
+    if (matches.length !== 1 || !str(matches[0]?.id)) {
+        throw new TaskResourceReferenceError(matches.length > 1 ? 'TASK_RESOURCE_AMBIGUOUS' : 'TASK_RESOURCE_NOT_FOUND', matches.length > 1
+            ? `More than one ${kind} matches "${query}". Use a canonical id from ${kind}s list --space <space>.`
+            : `No visible ${kind} exactly matches "${query}" in this Space. Inspect ${kind}s list --space <space>, or use a canonical id.`, matches.map(row => ({ id: row.id, identifier: row.identifier, title: row.title })));
+    }
+    return str(matches[0].id);
+}
+/**
+ * Resolve structured-input names as well as flag names, before assignment
+ * defaults. UUIDs keep their existing native validation path. A Goal is a
+ * relationship, not containment: a qualified Goal never moves its Task.
+ */
+async function resolveTaskResourceReferences(payload, options) {
+    const cache = options.cache ?? new Map();
+    const read = async (key, load) => {
+        if (!cache.has(key))
+            cache.set(key, load());
+        return await cache.get(key);
+    };
+    const space = (query) => read(`space:${query}`, () => options.resolveSpace(query));
+    if (str(payload.spaceId) && !UUID.test(str(payload.spaceId)))
+        payload.spaceId = await space(str(payload.spaceId));
+    let taskSpace = str(payload.spaceId) || str(options.existingTask?.spaceId);
+    const inheritedSpace = async () => {
+        if (taskSpace)
+            return taskSpace;
+        if (str(payload.parentId)) {
+            const parentId = str(payload.parentId);
+            const parent = await read(`task:${parentId}`, () => options.getTask
+                ? options.getTask(parentId) : data_provider_1.dataService.getTask(parentId, { enrich: false }));
+            taskSpace = str(parent.spaceId);
+        }
+        if (!taskSpace && UUID.test(str(payload.projectId))) {
+            const id = str(payload.projectId);
+            const project = await read(`project:${id}`, () => options.getProject ? options.getProject(id) : projects_1.projectApi.get(id));
+            taskSpace = str(project.spaceId);
+            if (taskSpace)
+                payload.spaceId = taskSpace;
+        }
+        return taskSpace;
+    };
+    for (const kind of ['project', 'goal']) {
+        const field = kind === 'project' ? 'projectId' : 'goalId';
+        const raw = str(payload[field]);
+        if (!raw || UUID.test(raw) || STORAGE_ID.test(raw))
+            continue;
+        if ((0, failed_lookup_1.isFailedLookupValue)(raw))
+            throw new TaskResourceReferenceError('TASK_RESOURCE_NOT_A_REFERENCE', `"${raw}" is not a ${kind} reference. Use the id or exact title from ${kind}s list.`);
+        const localScope = await inheritedSpace();
+        if (localScope) {
+            const body = await read(`${kind}s:${localScope}`, () => kind === 'project'
+                ? options.listProjects ? options.listProjects(localScope) : data_provider_1.dataService.listSpaceProjects(localScope)
+                : options.listGoals ? options.listGoals(localScope) : data_provider_1.dataService.listSpaceGoals(localScope));
+            const candidates = rows(body, kind);
+            const q = raw.toLowerCase();
+            if (candidates.some(row => (kind === 'project' && row.externalKey === raw) ||
+                [row.id, row.identifier, row.ref, row.title].some(value => str(value).toLowerCase() === q))) {
+                payload[field] = select(kind, raw, candidates);
+                continue;
+            }
+        }
+        const slash = raw.indexOf('/');
+        const qualified = slash > 0 && slash < raw.length - 1;
+        const query = qualified ? raw.slice(slash + 1).trim() : raw;
+        const qualifiedSpace = qualified ? await space(raw.slice(0, slash).trim()) : '';
+        const scope = qualifiedSpace || localScope;
+        if (!scope)
+            throw new TaskResourceReferenceError('TASK_RESOURCE_REQUIRES_SPACE', `Resolving a ${kind} name requires --space, a scoped parent, or <space-ref>/<${kind}-ref-or-exact-title>. A canonical id works without a name lookup.`);
+        if (kind === 'project' && taskSpace && qualifiedSpace && taskSpace !== qualifiedSpace) {
+            throw new TaskResourceReferenceError('PROJECT_SPACE_MISMATCH', 'The qualified project and Task name different Spaces. Correct --space or the project reference; no Task was written.');
+        }
+        const body = await read(`${kind}s:${scope}`, () => kind === 'project'
+            ? options.listProjects ? options.listProjects(scope) : data_provider_1.dataService.listSpaceProjects(scope)
+            : options.listGoals ? options.listGoals(scope) : data_provider_1.dataService.listSpaceGoals(scope));
+        payload[field] = select(kind, query, rows(body, kind));
+        if (kind === 'project' && !taskSpace) {
+            taskSpace = scope;
+            payload.spaceId = scope;
+        }
+    }
+}

package/dist/lib/task-spec-verification.d.ts

@@ -0,0 +1,42 @@
+type Task = Record<string, unknown>;
+export type TaskSpecInput = {
+    tempId: string;
+    id: string;
+    expected: Task;
+};
+export type TaskSpecObservation = {
+    tempId: string;
+    id: string;
+    state: 'matched' | 'mismatched' | 'unavailable';
+    checkedFields: string[];
+    uncheckedFields: Array<{
+        field: string;
+        reason: string;
+    }>;
+    mismatches: Array<{
+        field: string;
+        expected: unknown;
+        actual: unknown;
+    }>;
+    expectationCount?: number;
+    specVersion?: unknown;
+    error?: string;
+};
+/** Compare declarations, never assessments or whether a lesson/task worked. */
+export declare function compareTaskSpecification(input: TaskSpecInput, actual: Task): TaskSpecObservation;
+/** Bounded native rereads. Failure to read is not evidence of a failed write. */
+export declare function verifyTaskSpecifications(inputs: TaskSpecInput[], read: (id: string) => Promise<Task>): Promise<{
+    object: string;
+    ok: boolean;
+    scope: string;
+    assessmentPerformed: boolean;
+    summary: {
+        total: number;
+        matched: number;
+        mismatched: number;
+        unavailable: number;
+        withUncheckedFields: number;
+    };
+    results: TaskSpecObservation[];
+}>;
+export {};

package/dist/lib/task-spec-verification.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareTaskSpecification = compareTaskSpecification;
+exports.verifyTaskSpecifications = verifyTaskSpecifications;
+const node_util_1 = require("node:util");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const FIELDS = [
+    'title', 'status', 'priority', 'estimate', 'commitmentId', 'spaceId', 'goalId', 'projectId', 'parentId',
+    'externalKey', 'executionMode', 'reviewPolicy', 'assigneeAgentIds',
+    'assigneeUserIds', 'labelIds', 'tags', 'workingDirectory', 'executionIsolation',
+    'startDate', 'dueDate', 'expectations', 'blocksIds', 'blockedByIds',
+];
+const SETS = new Set(['labelIds', 'tags', 'blocksIds', 'blockedByIds', 'assigneeAgentIds', 'assigneeUserIds']);
+const DATES = new Set(['startDate', 'dueDate']);
+function comparable(field, value) {
+    // Explicit clears may be persisted as an absent field; both mean unset.
+    if (value === undefined || value === null)
+        return null;
+    if (SETS.has(field) && Array.isArray(value))
+        return [...new Set(value)].sort();
+    if (DATES.has(field) && typeof value === 'string') {
+        const time = Date.parse(value);
+        return Number.isFinite(time) ? time : value;
+    }
+    return value;
+}
+function authoredExpectations(value, authored) {
+    if (!Array.isArray(value) || !Array.isArray(authored))
+        return value;
+    return value.map((item, index) => {
+        const original = (0, data_provider_1.normalizeTaskExpectationDeclaration)(authored[index]);
+        const parsed = (0, data_provider_1.normalizeTaskExpectationDeclaration)(item);
+        if (!parsed.ok)
+            return item;
+        const row = parsed.value;
+        return {
+            ...(original.ok && original.value.id ? { id: row.id } : {}),
+            text: row.text,
+            check: row.check ?? { method: 'manual' },
+            ...(original.ok && original.value.presetKey ? { presetKey: row.presetKey } : {}),
+        };
+    });
+}
+/** Compare declarations, never assessments or whether a lesson/task worked. */
+function compareTaskSpecification(input, actual) {
+    const checkedFields = FIELDS.filter(field => Object.prototype.hasOwnProperty.call(input.expected, field));
+    const mismatches = [];
+    if (actual.id !== input.id)
+        mismatches.push({ field: 'id', expected: input.id, actual: actual.id ?? null });
+    for (const field of checkedFields) {
+        const expected = field === 'expectations' ? authoredExpectations(input.expected[field], input.expected[field]) : comparable(field, input.expected[field]);
+        const observed = field === 'expectations' ? authoredExpectations(actual[field], input.expected[field]) : comparable(field, actual[field]);
+        if (!(0, node_util_1.isDeepStrictEqual)(expected, observed)) {
+            mismatches.push({ field, expected: input.expected[field] ?? null, actual: actual[field] ?? null });
+        }
+    }
+    // Rich text is normalized by the native service. A client-side byte compare
+    // would assert a false mismatch; report the exact boundary, not a full-spec pass.
+    const uncheckedFields = Object.keys(input.expected).filter(field => !checkedFields.includes(field))
+        .map(field => ({ field, reason: field === 'description' || field === 'descriptionFormat'
+            ? 'Native rich-text normalization; content is not compared by this structured-field check.'
+            : 'This authored field is outside the supported structured-field comparator; no equality claim is made.' }));
+    return {
+        tempId: input.tempId, id: input.id,
+        state: mismatches.length ? 'mismatched' : 'matched',
+        checkedFields: [...checkedFields], uncheckedFields, mismatches,
+        ...(Array.isArray(actual.expectations) ? { expectationCount: actual.expectations.length } : {}),
+        ...(actual.specVersion !== undefined ? { specVersion: actual.specVersion } : {}),
+    };
+}
+/** Bounded native rereads. Failure to read is not evidence of a failed write. */
+async function verifyTaskSpecifications(inputs, read) {
+    const results = [];
+    for (let start = 0; start < inputs.length; start += 4) {
+        const group = await Promise.all(inputs.slice(start, start + 4).map(async (input) => {
+            try {
+                return compareTaskSpecification(input, await read(input.id));
+            }
+            catch (error) {
+                return { tempId: input.tempId, id: input.id, state: 'unavailable',
+                    checkedFields: [], uncheckedFields: [], mismatches: [],
+                    error: error instanceof Error ? error.message : String(error) };
+            }
+        }));
+        results.push(...group);
+    }
+    return {
+        object: 'task_specification_verification',
+        ok: results.every(row => row.state === 'matched'),
+        scope: 'declared_structured_fields',
+        assessmentPerformed: false,
+        summary: {
+            total: inputs.length,
+            matched: results.filter(row => row.state === 'matched').length,
+            mismatched: results.filter(row => row.state === 'mismatched').length,
+            unavailable: results.filter(row => row.state === 'unavailable').length,
+            withUncheckedFields: results.filter(row => row.uncheckedFields.length > 0).length,
+        },
+        results,
+    };
+}

package/dist/lib/task-work.d.ts

@@ -0,0 +1,11 @@
+import type { TaskExecutionSnapshot, TaskConversationInputBody, TaskConversationInputReceipt, TaskInputPurpose } from '@skrr-ai/data-provider';
+/** Observation time is not evidence that a worker just sent a heartbeat. */
+export declare function describeExecutionState(state: TaskExecutionSnapshot): string[];
+export declare function buildTaskContinuationBody(input: {
+    text: string;
+    commandKey?: string;
+    purpose?: TaskInputPurpose;
+    workflowGeneration: number;
+    authorizationGeneration: number;
+}): TaskConversationInputBody;
+export declare function describeTaskContinuation(receipt: TaskConversationInputReceipt): string;

package/dist/lib/task-work.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeExecutionState = describeExecutionState;
+exports.buildTaskContinuationBody = buildTaskContinuationBody;
+exports.describeTaskContinuation = describeTaskContinuation;
+const node_crypto_1 = require("node:crypto");
+/** Observation time is not evidence that a worker just sent a heartbeat. */
+function describeExecutionState(state) {
+    return [
+        `Task: ${state.taskId}`,
+        `Workflow: ${state.workflowStatus} (generation ${state.workflowGeneration})`,
+        `Execution: ${state.execution.runStatus ?? 'not observed'}${state.execution.runId ? `; Run ${state.execution.runId}` : ''}`,
+        `Liveness: ${state.liveness.state}; last runtime signal ${state.liveness.lastRuntimeSignalAt ?? 'unavailable'}`,
+        `Health: ${state.health.condition}; ${state.health.reason}`,
+        ...(state.waiting ? [`Waiting: ${state.waiting.kind}; ${state.waiting.referenceId}`] : []),
+        `Work input: ${state.work.latestWorkInputRevision}; ${state.work.pendingCommandCount} pending command(s); ${state.work.queuedExchangeCount} queued exchange(s)`,
+        `Result: ${state.result.currentResultId ?? 'none'} (${state.result.applicability})${state.result.reason ? `; ${state.result.reason}` : ''}`,
+        `Observed: ${state.observedAt}; consistency ${state.consistency}`,
+        ...state.limitations.map((limitation) => `Limitation: ${limitation}`),
+    ];
+}
+function buildTaskContinuationBody(input) {
+    if (!input.text.trim() || input.text.length > 24000)
+        throw new Error('--text must contain 1–24000 characters.');
+    const commandKey = input.commandKey ?? `cli-input-${(0, node_crypto_1.randomUUID)()}`;
+    if (!commandKey.trim() || commandKey.length > 300)
+        throw new Error('--command-key must contain 1–300 characters.');
+    if (!Number.isInteger(input.workflowGeneration) || input.workflowGeneration < 1 ||
+        !Number.isInteger(input.authorizationGeneration) || input.authorizationGeneration < 1) {
+        throw new Error('Workflow and authorization generations must be positive integers.');
+    }
+    return { commandKey, text: input.text, purpose: input.purpose ?? 'continue_work',
+        expectedWorkflowGeneration: input.workflowGeneration,
+        expectedAuthorizationGeneration: input.authorizationGeneration };
+}
+function describeTaskContinuation(receipt) {
+    const detail = receipt.reason ? `: ${receipt.reason}` : '';
+    if (receipt.phase === 'refused')
+        return `Task input refused${detail}. Command ${receipt.commandId}.`;
+    return `Task input ${receipt.phase}${detail}. Command ${receipt.commandId}; ${receipt.purposeDecision ?? 'classification pending'}${receipt.exchangeId ? `; exchange ${receipt.exchangeId}` : ''}. Execution is reported separately by tasks execution-state.`;
+}

package/dist/lib/task-write-attribution.d.ts

@@ -0,0 +1,26 @@
+import { readRuntimeContext } from './runtime-context';
+export declare const AGENT_BINDING_GUIDANCE: string;
+export declare const ACCOUNT_ATTRIBUTION_NOTICE: string;
+type Principal = {
+    kind: string;
+    userId?: string;
+    agentId?: string;
+    service?: string;
+};
+/** Use the persisted server receipt, never the process's claimed Agent identity. */
+export declare function taskWriteAttribution(receipt: unknown, field: 'assessedBy' | 'submittedBy'): {
+    bindingGuidance?: string | undefined;
+    notice: string | null;
+    method?: string | undefined;
+    source: "server_receipt";
+    principal: Principal | null;
+};
+export declare function attributionLines(attribution: ReturnType<typeof taskWriteAttribution>): string[];
+/** Environment hints explain local execution only; the server verifies every write. */
+export declare function runtimeWriteAttribution(runtime: ReturnType<typeof readRuntimeContext>): {
+    authority: "authenticated_server_principal";
+    runtimeBinding: string;
+    notice: string;
+    bindingGuidance: string;
+};
+export {};

package/dist/lib/task-write-attribution.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCOUNT_ATTRIBUTION_NOTICE = exports.AGENT_BINDING_GUIDANCE = void 0;
+exports.taskWriteAttribution = taskWriteAttribution;
+exports.attributionLines = attributionLines;
+exports.runtimeWriteAttribution = runtimeWriteAttribution;
+exports.AGENT_BINDING_GUIDANCE = 'Assign this runtime in skrr → Engines, then run in its authenticated Agent session. ' +
+    'An --agent flag or an environment Agent id cannot establish authenticated authorship.';
+exports.ACCOUNT_ATTRIBUTION_NOTICE = 'Without authenticated Agent provenance, Task writes are attributed to the signed-in account. ' +
+    'An account-attributed assessment is not proof of an independent human check.';
+/** Use the persisted server receipt, never the process's claimed Agent identity. */
+function taskWriteAttribution(receipt, field) {
+    const record = receipt && typeof receipt === 'object' ? receipt : {};
+    const entity = record[field === 'assessedBy' ? 'assessment' : 'result'];
+    const row = entity && typeof entity === 'object' ? entity : {};
+    const value = row[field];
+    const principal = value && typeof value === 'object' && typeof value.kind === 'string'
+        ? value : null;
+    return {
+        source: 'server_receipt',
+        principal,
+        ...(typeof row.method === 'string' ? { method: row.method } : {}),
+        notice: principal?.kind === 'human' ? exports.ACCOUNT_ATTRIBUTION_NOTICE
+            : !principal ? 'The server receipt did not identify the author; no authorship is inferred from local runtime hints.' : null,
+        ...(!principal || principal.kind === 'human' ? { bindingGuidance: exports.AGENT_BINDING_GUIDANCE } : {}),
+    };
+}
+function attributionLines(attribution) {
+    const actor = attribution.principal;
+    return [
+        actor ? `Recorded author: ${actor.kind} (${actor.userId || actor.agentId || actor.service || 'id unavailable'}).`
+            : 'Recorded author: unavailable in server receipt.',
+        ...(attribution.notice ? [attribution.notice] : []),
+        ...(attribution.bindingGuidance ? [attribution.bindingGuidance] : []),
+    ];
+}
+/** Environment hints explain local execution only; the server verifies every write. */
+function runtimeWriteAttribution(runtime) {
+    return {
+        authority: 'authenticated_server_principal',
+        runtimeBinding: runtime.agent?.boundToSession ? 'session_hint' : 'unbound',
+        notice: runtime.agent?.boundToSession
+            ? 'Local session binding is a hint. The server verifies Agent provenance and returns the recorded author.'
+            : exports.ACCOUNT_ATTRIBUTION_NOTICE,
+        bindingGuidance: exports.AGENT_BINDING_GUIDANCE,
+    };
+}

package/dist/lib/tasks.d.ts

@@ -76,6 +76,7 @@ export declare function releasePinRepairGuard(payload: TaskRecord): TaskMutation
  */
 export declare function taskUpdateMutationGuard(payload: TaskRecord): TaskMutationGuardFailure | null;
 export type TaskCreateFlagValues = {
+    unassigned?: boolean;
     template?: string;
     title?: string;
     description?: string;
@@ -211,6 +212,18 @@ export declare function applyDaemonSessionDefaults(payload: TaskRecord): void;
 export declare function validateTaskCreatePayload(payload: TaskRecord): string[];
 /** Stamp the unambiguous executor so CLI-authored tasks are explicit on day one. */
 export declare function applyInferredTaskExecutionMode(payload: TaskRecord): void;
+/** A caller's explicit clearing instruction, never a new native field. Flag
+ * values override JSON just as named assignment flags do. */
+export declare function applyExplicitTaskUnassignment(payload: TaskRecord, requested: boolean): void;
+export declare function taskUnassignmentFlagError(flags: Record<string, unknown>): string | null;
+/** A projection of a frozen payload or a native returned row, not admission. */
+export declare function taskAssignmentPreview(task: TaskRecord): {
+    executor: import("@skrr-ai/data-provider").TaskExecutorResolution;
+    assigneeAgentIds: string[];
+    assigneeUserIds: string[];
+    assigned: boolean;
+    startRequested: false;
+};
 /**
  * Stamp an executor only when the post-update assignee set is unambiguous.
  * Existing fields participate when an upsert omits one assignee kind; this