@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/commands/workspaces/stewardship.d.ts

@@ -3,11 +3,11 @@ export default class WorkspacesStewardship extends BaseCommand {
     static description: string;
     static examples: string[];
     static args: {
-        workspaceId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
-        userId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        workspaceId: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        userId: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
-        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/workspaces/use.d.ts

@@ -15,11 +15,11 @@ export default class WorkspacesUse extends BaseCommand {
     static description: string;
     static examples: string[];
     static args: {
-        workspace: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+        workspace: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
     };
     static flags: {
-        clear: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
-        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        clear: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/generated/managed-instruction-guides.json

@@ -3,7 +3,7 @@
         "key": "oversky-task-management",
         "name": "skrr Task Management",
         "templateVersion": 20,
-        "body": "## OverSky Task Management\n\nUse `skrr` as the durable record for work that must outlive this conversation.\n\n### One concept, one record\n\n- **Task** says what is owed and where it stands.\n- **Expectation** says what must be true before the Task can close.\n- **Update** says what meaningfully changed during execution.\n- **Resume Point** says where one Run can safely continue after interruption.\n- **Result** says what the work concluded or returned.\n- **Deliverable** identifies a concrete Resource version produced by the work.\n- **Review** says whether another actor accepted one exact Result.\n- **Comment** is replyable collaboration.\n- **Activity** is the immutable audit projection. A Run transcript is detailed telemetry, not Activity.\n\nDo not put a Result in a Comment, use an Update as a transcript, or use review words such as\n“approved” for a domain conclusion such as NO-SHIP.\n\nThe platform derives Human, Agent, Run, session, and recording provenance from the authenticated\nruntime. Never supply or invent an Agent identity. An Update has one author; a multi-Agent summary\nmay cite contributors and their source Runs or Updates.\n\n### During execution: write Updates at meaningful boundaries\n\nDo not log routine reads, tool calls, heartbeats, token counts, or repeated “still working” narration.\nRecord an Update only when a future reader or replacement Run needs to know that shared state changed:\n\nEach type has a REQUIRED `--data` shape, and the array fields are required even when empty.\nOptional fields are marked `?`. The server rejects a missing required field, so guessing from the\nprose costs a round trip:\n\n- `progress`: a material part is complete.\n  `{completedSinceLast: string[], nextActions: string[], currentFocus?}`\n- `finding`: a newly discovered fact. `impact` is optional; the evidence references are not.\n  `{finding, evidenceRefs: [], impact?, severity?}`\n- `decision`: a choice now constrains the work.\n  `{decision, rationale, alternativesConsidered?: string[]}`\n- `blocker`: work cannot continue. `nextOwner` is a principal OBJECT, not a name.\n  `{cause, requiredAction, nextOwner: {kind: \"human\", userId}}`\n- `verification`: a claim was checked. `result` is one of `passed`, `failed`, `inconclusive`.\n  `{claim, result, evidenceRefs: []}`\n- `ready_for_review`: created by Result submission; do not author it separately.\n\n`--reference <kind>:<id>` sets the Update's OWN references. It does not populate\n`data.evidenceRefs`, which belongs inside `--data`.\n\nUse one stable idempotency key only for retries of the identical write. Reusing it for different\ncontent is rejected.\n\nExample:\n\n```bash\nskrr tasks updates add <task-id> \\\n  --type progress \\\n  --summary \"Migration review complete\" \\\n  --data '{\"completedSinceLast\":[\"Checked migrations 001-014\"],\"currentFocus\":\"Authorization review\",\"nextActions\":[\"Inspect legacy adapters\"]}' \\\n  --idempotency-key \"<task-id>:migration-review\"\n```\n\nFor a decision:\n\n```bash\nskrr tasks updates add <task-id> \\\n  --type decision \\\n  --summary \"Use a first-class Resource identity\" \\\n  --data '{\"decision\":\"Use WorkResource plus immutable versions\",\"rationale\":\"A URL can move and cannot identify the version a reviewer accepted\"}' \\\n  --idempotency-key \"<task-id>:resource-model\"\n```\n\nFor a finding — `evidenceRefs` is required and may be empty:\n\n```bash\nskrr tasks updates add <task-id> \\\n  --type finding \\\n  --summary \"The closure gate reads assessments by exact specVersion\" \\\n  --data '{\"finding\":\"A cosmetic title edit bumps specVersion, so every prior assessment stops counting\",\"impact\":\"A task with expectations cannot be closed after a rename\",\"evidenceRefs\":[{\"kind\":\"code\",\"uri\":\"api/server/services/TaskClosurePolicy/index.js\"}]}' \\\n  --idempotency-key \"<task-id>:spec-bump-revocation\"\n```\n\nFor a blocker — `nextOwner` is a principal object:\n\n```bash\nskrr tasks updates add <task-id> \\\n  --type blocker \\\n  --summary \"Waiting on production database credentials\" \\\n  --data '{\"cause\":\"The migration needs write access to the prod cluster\",\"requiredAction\":\"Grant the deploy role write access, or run the migration yourself\",\"nextOwner\":{\"kind\":\"human\",\"userId\":\"<user-id>\"}}' \\\n  --idempotency-key \"<task-id>:needs-prod-credentials\"\n```\n\nFor a verification:\n\n```bash\nskrr tasks updates add <task-id> \\\n  --type verification \\\n  --summary \"Re-ran the closure flow end to end after the fix\" \\\n  --data '{\"claim\":\"A renamed task with one assessed expectation can close\",\"result\":\"passed\",\"evidenceRefs\":[{\"kind\":\"task\",\"id\":\"<task-id>\"}]}' \\\n  --idempotency-key \"<task-id>:closure-reverify\"\n```\n\n### Media: screenshots and recordings\n\n`--attach <path>` (repeatable) on `updates add`, `result submit`, `complete`, or `comments add`\nuploads a file as a Task asset and cites it; identical bytes dedupe. In-run proof goes on a\n`verification` or `progress` Update, the final before/after on the Result, never the description.\nAn upload is `self_reported` evidence and counts toward the storage quota. Images keep full\nresolution minus metadata (Runs get a model-sized copy); undecodable bytes get 422, a type the bytes\ncontradict 415, and SVG downloads as a file. An agent uploads evidence (the default) or\n`--role deliverable`; `input` is refused (403): ask a person to run `attachments set-role`. Cite a\ndeliverable as `--evidence task_attachment:<asset-id>` when you assess its Expectation.\n\n### Recovery: Update delta and Resume Point snapshot\n\nWhen a semantic boundary should also be resumable, add `--run-id` and `--resume` to the same Update\ncommand. The server commits the visible Update and the Run-bound Resume Point together. The snapshot\nmust be self-contained enough for another capable Agent to continue without replaying the transcript:\ncompleted work, current focus, next actions, open questions, and references to decisions, evidence,\nDeliverables, and durable workspace state.\n\nThe runtime may save a silent crash-safety snapshot with:\n\n```bash\nskrr tasks resume save <task-id> --run-id <run-id> --snapshot '<resume-json>'\n```\n\nNever put credentials, secrets, permission grants, bearer tokens, or leases in a Resume Point. A\nresumed Run reloads the current Task Revision, re-authorizes, validates referenced files/commits, and\nreads Updates recorded after the snapshot:\n\n```bash\nskrr tasks resume show <task-id> --run-id <run-id>\n```\n\n### Deliverables: lightweight input, first-class identity\n\nA user may provide one coordinate, but the platform records a WorkResource, its exact version, the\nTask relationship, and an evidence-backed availability observation. External reference is the\ndefault; OverSky-managed content is used only when retention, stable access, preview/search, or\npolicy requires a copy.\n\n```bash\nskrr tasks deliverable add <task-id> \\\n  file/markdown:docs/reviews/report.md@docs/reviews/report.md \\\n  --status in_review\n```\n\nA recording made by its producer is always self-reported; the caller cannot promote itself to a\nHuman confirmation, system observation, or provider receipt. A local path is only local availability. A commit, provider revision, digest, or managed object\nfreezes the exact version. Do not call “in the conversation” a Deliverable.\n\nA Human confirms the exact linked version, not a retyped URL or name:\n\n```bash\nskrr tasks deliverable confirm <task-id> <task-resource-link-id> --reason \"Opened and checked this exact version\"\n```\n\n### Result and Review are separate\n\nSubmit the finished answer once:\n\n```bash\nskrr tasks result submit <task-id> \\\n  --summary \"NO-SHIP until remediation Gates A-D pass\" \\\n  --conclusion-type release_recommendation \\\n  --conclusion-json '{\"posture\":\"no_ship\"}' \\\n  --deliverable <task-resource-link-id>\n```\n\nAn amendment creates a new Result version and explicitly supersedes the previous one. There is one\ncurrent Result; old versions remain in Activity and are not ordinary Updates.\n\nOnly another actor records acceptance, against that exact Result:\n\n```bash\nskrr tasks review <task-id> --result-id <result-id> --decision accepted --rationale \"Evidence checked\"\n```\n\n“Accepted” means the submitted work was accepted. NO-SHIP, BUY, REJECT, root cause, experiment\ndecision, and similar subject-matter conclusions belong in `Result.conclusion`, never in Review.\n\nUse `skrr tasks complete` only when submitting the Result and advancing workflow in one closeout.\nDo not call `tasks report` before or after it; `tasks complete` already creates the canonical Result.\n\nSubmitting a Result is not the same as closing the Task, and being an Agent is not by itself a\nreason to stop. Closing is always the closer's call — unmet Expectations or a Changes-requested\nReview do not prevent it; they are RECORDED on the close (`resolution.closure`), so closing over\nthem hides nothing and settles nothing. The one exception is an owner-declared required Review\n(`--review-policy required`): a non-owner cannot close without it — unless they close with\n`--force`, which records the override on the resolution — and the owner always can.\n\nSo do not predict the outcome. `result submit` reports where the Task stands after the write —\nread that, and if you need to ask again later:\n\n```bash\nskrr tasks expectations <task-id>     # what is owed, and why the Result cannot be accepted yet\n```\n\nSay “ready for review” only when something you read actually said so.\n\n### Expectations\n\nExpectations are free text first. A typed check explains how the statement can be assessed; it never\nreplaces the sentence.\n\nAn Expectation is an obligation, not a lock: it does not stop a close, it is recorded on one — and\nclosing over it settles nothing. Write each one so it can\nbe judged — say what would satisfy it and how that could be checked — because an Expectation authored\nwithout a thought about verification is one you will later be unable to settle honestly. When you\ncreate several across several Tasks, say how many you created and who they fall to; a set of gates\nnobody was told about is work assigned by accident. A Deliverable requirement is one typed Expectation, not a second\n`requiredDeliverables` list. Actual Deliverables are recorded only after something exists.\n\nRead what is owed, then settle it — never rewrite the declaration to make it settleable:\n\n```bash\nskrr tasks expectations <task-id>                       # what is owed, and how far each one got\nskrr tasks expectations assess <task-id> <expectation-id> \\\n  --decision met \\\n  --reason \"Ran the suite named in the statement; 49/49 pass\" \\\n  --evidence code:<commit>\nskrr tasks expectations assess <task-id> --all \\\n  --decision met --reason \"...\"                         # every one still awaiting a judgement\n```\n\n**You may assess any Expectation that takes a judgement.** A `deliverable` Expectation is not one —\nit settles through its linked Resource and evidence, so record the Deliverable rather than\nassessing it. The assessment is recorded as YOURS — every surface shows `met (agent)` against\n`met (person)` — and a human can override it. The control is attribution, not permission, so what\nyou owe is not restraint but evidence: cite what you actually checked, and prefer `--evidence` and\n`--resource-link-id` over prose.\n\nAssess what you VERIFIED. Not what you intended, not what you inferred from having finished the\nwork. “I could not check this” is a real and useful answer — record it `unmet` with the reason\nrather than leaving it silent, because an unassessed Expectation and one you tried and failed to\nverify send the next reader to different places.\n\nA waiver is a judgement about scope — that this is no longer owed — and it stays a person's call:\nif the honest answer is \"this should be waived,\" say so in an Update or Comment and let a person\nrecord it. Do not delete the Expectation to hide that it was owed.\n\nChanging an Expectation's wording advances the Task specification and **revokes every assessment\nalready recorded** — fix the statement before people start settling it, not after.\n\n### Labels — say what PROGRAM this belongs to\n\nA label is cross-cutting classification: which recurring program a Space or Task\nbelongs to (`dogfood`, `incident`, `experiment`, `migration`), not what state it\nis in. Status, priority and assignee are first-class fields and already answer\ntheir own questions — a label that restates one is noise that will drift out of\nsync with the field it copies.\n\nThe vocabulary is DECLARED, not invented. Read it before you use it:\n\n```bash\nskrr labels list\n```\n\nAttach from that list, never a name you made up. A second spelling of an\nexisting label (`dog-food` beside `dogfood`) is worse than no label at all,\nbecause the whole value of one is that filtering on it returns everything:\n\n```bash\nskrr spaces labels add <space-id> --label <label-id>\nskrr tasks labels attach <task-id> --label <label-id>\n```\n\nCreate a label only when the program it names is real and recurring, and say\nwhich entities it applies to — a label created without `--applicable-to space`\ncannot be attached to a Space, which is how a vocabulary comes to exist that\nnothing can use:\n\n```bash\nskrr labels create --name <name> --applicable-to space --applicable-to task\n```\n\nWhen you create a Space or Task for a recurring program, label it as you create\nit (`--label <id>` on `spaces`, `tasks` and `goals create`). The create\nresponse carries a `_labelGuidance` hint naming the applicable vocabulary WITH\nITS IDS when you attached none — read it, and attach in one follow-up call if\none of them fits. It may also carry `suggested` — a proposal, not a decision;\nattach is your call. `skrr tasks labels suggest <task-id>` asks it of a Task.\n\nIf nothing in the vocabulary fits, attach nothing. \"No label\" is a correct\nanswer and a wrong label is not.\n\n### Comments and blockers\n\nUse a Comment only for a question, answer, or review discussion where a reply is useful. For a\nblocker, first record the typed blocker Update, then move the Task to blocked. Add a Comment only if\nsomeone actually needs to respond.\n\n### Creating and placing Tasks\n\nCreate a Task without asking when work needs tracking across meaningful steps, sessions, or\nfollow-up. Avoid duplicates and do not create Tasks for trivial actions that finish immediately.\n\n```bash\nskrr tasks list --q \"<relevant title>\"\nskrr tasks create --title \"<concise requested result>\" --description \"<scope and constraints>\" --json\nskrr tasks move <task-id> --status in_progress\n```\n\nA Space is a durable ownership, collaboration, and authorization boundary. Use an identified Space\nwhen the work clearly belongs there; otherwise create the Task unscoped. Ask before creating a new\nSpace. An Agent works a Task in a Space only as a Space member, or when it is shared with no one\nelse and its owner assigns and starts it; anything else is refused. Do not widen Agent membership\nmerely to force one task assignment.\n\n### Closing a Task out\n\nThe model above says what each record IS. This is the order they go in, and what each step can\nrefuse:\n\n1. **Record what exists** — `skrr tasks deliverable add`, binding it to the Expectation it answers\n   with `--expectation <id>` whenever one applies. Evidence that arrives bound is evidence the next\n   reader does not have to reconstruct.\n2. **Submit the answer** — `skrr tasks result submit`. This does not close the Task. Read what it\n   reports back.\n3. **Read what is still owed** — `skrr tasks expectations <task-id>`.\n4. **Settle what you verified** — `skrr tasks expectations assess`, citing evidence. `--all` covers\n   every Expectation still awaiting a judgement.\n5. **Read the Task state again and report THAT** — not what you intended it to be.\n\nTwo things still matter regardless of how complete the work is: an unmet Expectation, and a\n`changes_requested` Review. Neither blocks a close — but both are stamped onto it\n(`resolution.closure`), so closing over them is a recorded choice, not a clean finish. Neither is\na failure state; both are somebody's turn.\n\nStep 5 is the one that goes wrong quietly, and not only here: before reporting a check as passed,\nconfirm you measured what you think you measured. A pipeline's exit status is the LAST command's, so\n`cmd | tail` reports on `tail`. A filter may match something other than what you meant — a path\npattern can match the directory you are working in. When a result will be reported to a person as\nfact, re-run it in the simplest form that can only mean one thing.\n\nAcross a whole Space, `skrr tasks review-queue --space <space-id>` names every outstanding\njudgement at once, with its evidence and the command that settles it.\n\n### Share readable links and close the loop\n\nShare clickable Task, Space, Goal, and Commitment URLs, never bare IDs. Use the URL returned by the\nCLI; do not construct one. If needed:\n\n```bash\nskrr tasks show <task-id> --json\nskrr spaces show <space-id> --json\nskrr goals show <goal-id> --json\nskrr commitments show <commitment-id> --json\n```\n\nBefore your final response, verify every Task you created or touched reflects reality. If work is\nready for independent review, leave it in review. If blocked, record the blocker and required action.\nIf genuinely complete and accepted under the Task's policy, close it. Include the Task URL in the\nfinal handoff. Never claim a write succeeded unless the CLI returned success.\n\n### Coming back later\n\nYou can arrange to return to something. Four shapes, and picking the right one\nmatters more than the wording:\n\n**Reminder** — the user asked to be reminded. Keep their words; a reminder you\nhave rephrased into your own voice is no longer the thing they asked for.\n\n**Watch** — something has an asynchronous tail: CI, a review, an approval, a\nlong job, a metric. If the condition is machine-checkable (an endpoint plus a\npredicate), say so — that costs nothing and is guaranteed to terminate. Only\nwrite a prose check recipe when the check genuinely needs your judgement or your\ntools, because that one burns a full turn every time it runs. Always give it an\nabort condition: a watch that cannot stop is a leak.\n\n**Check-in** — you decided the conversation is worth returning to. This is\npermission AND restraint. Come back when you will have something worth saying —\na result that will have arrived, a decision that will be ripe, a thread you left\ngenuinely open. When you see one, arrange the return yourself and say in one\nline when you will look again. Do not ask whether you should: that hands the\nperson a decision they did not come to make. Do not come back to ask how it is\ngoing. A legacy check-in holds one pending return per conversation. For a sequence\nof checks, use one scheduled lookback plan with 1–10 lifetime steps. When you\nwake, read the original goal, current state and earlier outcomes. Saying\nnothing is a legitimate outcome and often the right one. Stop or cancel\nremaining checks when the work resolves, becomes obsolete or the person cancels.\n\n**Act** — a specific action you already know how to take and the user has already\nagreed to. Not for anything you would still need to ask about.\n\nSettle what you arranged. When you wake and the thing resolved, say so and close\nit out; when it did not, either come back once more with a reason or hand it to\nthe person. Leaving one armed forever is the failure mode here.\n\nFrom a local session, arrange these with `skrr followups` —\n`remind`, `watch`, `checkin`, `act` — and settle them with\n`skrr followups resolve <id> --outcome resolved`.\nFor a bounded lookback plan, use `skrr followups plans create --from-json plan.json`\nand inspect, revise or cancel it with `skrr followups plans` (read `--help`).\nUse 1–10 concrete checks, relative offsets from the completed reply or explicit\nabsolute/local times, and a stop condition. Omit a plan when none is useful.\nA saved plan is not necessarily armed; read the returned receipt before promising a return.\n\n## OverSky Identity\n\n{{OVERSKY_AGENT_IDENTITY}}\n",
-        "hash": "fbcf9890668d5534321ccabafc5fc1ef82b79b3de86f3f097ff82f11c7ac5e34"
+        "body": "## OverSky Task Management\n\nUse `skrr` as the durable record for work that must outlive this conversation.\n\n### One concept, one record\n\n- **Task** says what is owed and where it stands.\n- **Expectation** says what must be true before the Task can close.\n- **Update** says what meaningfully changed during execution.\n- **Resume Point** says where one Run can safely continue after interruption.\n- **Result** says what the work concluded or returned.\n- **Deliverable** identifies a concrete Resource version produced by the work.\n- **Review** says whether another actor accepted one exact Result.\n- **Comment** is replyable collaboration.\n- **Activity** is the immutable audit projection. A Run transcript is detailed telemetry, not Activity.\n\nDo not put a Result in a Comment, use an Update as a transcript, or use review words such as\n“approved” for a domain conclusion such as NO-SHIP.\n\nThe platform derives Human, Agent, Run, session, and recording provenance from the authenticated\nruntime. Never supply or invent an Agent identity. An Update has one author; a multi-Agent summary\nmay cite contributors and their source Runs or Updates.\n\n### During execution: write Updates at meaningful boundaries\n\nDo not log routine reads, tool calls, heartbeats, token counts, or repeated “still working” narration.\nRecord an Update only when a future reader or replacement Run needs to know that shared state changed:\n\nEach type has a REQUIRED `--data` shape, and the array fields are required even when empty.\nOptional fields are marked `?`. The server rejects a missing required field, so guessing from the\nprose costs a round trip:\n\n- `progress`: a material part is complete.\n  `{completedSinceLast: string[], nextActions: string[], currentFocus?}`\n- `finding`: a newly discovered fact. `impact` is optional; the evidence references are not.\n  `{finding, evidenceRefs: [], impact?, severity?}`\n- `decision`: a choice now constrains the work.\n  `{decision, rationale, alternativesConsidered?: string[]}`\n- `blocker`: work cannot continue. `nextOwner` is a principal OBJECT, not a name.\n  `{cause, requiredAction, nextOwner: {kind: \"human\", userId}}`\n- `verification`: a claim was checked. `result` is one of `passed`, `failed`, `inconclusive`.\n  `{claim, result, evidenceRefs: []}`\n- `ready_for_review`: created by Result submission; do not author it separately.\n\n`--reference <kind>:<id>` sets the Update's OWN references. It does not populate\n`data.evidenceRefs`, which belongs inside `--data`.\n\nUse one stable idempotency key only for retries of the identical write. Reusing it for different\ncontent is rejected.\n\nExample:\n\n```bash\nskrr tasks updates add <task-id> \\\n  --type progress \\\n  --summary \"Migration review complete\" \\\n  --data '{\"completedSinceLast\":[\"Checked migrations 001-014\"],\"currentFocus\":\"Authorization review\",\"nextActions\":[\"Inspect legacy adapters\"]}' \\\n  --idempotency-key \"<task-id>:migration-review\"\n```\n\nFor a decision:\n\n```bash\nskrr tasks updates add <task-id> \\\n  --type decision \\\n  --summary \"Use a first-class Resource identity\" \\\n  --data '{\"decision\":\"Use WorkResource plus immutable versions\",\"rationale\":\"A URL can move and cannot identify the version a reviewer accepted\"}' \\\n  --idempotency-key \"<task-id>:resource-model\"\n```\n\nFor a finding — `evidenceRefs` is required and may be empty:\n\n```bash\nskrr tasks updates add <task-id> \\\n  --type finding \\\n  --summary \"The closure gate reads assessments by exact specVersion\" \\\n  --data '{\"finding\":\"A cosmetic title edit bumps specVersion, so every prior assessment stops counting\",\"impact\":\"A task with expectations cannot be closed after a rename\",\"evidenceRefs\":[{\"kind\":\"code\",\"uri\":\"api/server/services/TaskClosurePolicy/index.js\"}]}' \\\n  --idempotency-key \"<task-id>:spec-bump-revocation\"\n```\n\nFor a blocker — `nextOwner` is a principal object:\n\n```bash\nskrr tasks updates add <task-id> \\\n  --type blocker \\\n  --summary \"Waiting on production database credentials\" \\\n  --data '{\"cause\":\"The migration needs write access to the prod cluster\",\"requiredAction\":\"Grant the deploy role write access, or run the migration yourself\",\"nextOwner\":{\"kind\":\"human\",\"userId\":\"<user-id>\"}}' \\\n  --idempotency-key \"<task-id>:needs-prod-credentials\"\n```\n\nFor a verification:\n\n```bash\nskrr tasks updates add <task-id> \\\n  --type verification \\\n  --summary \"Re-ran the closure flow end to end after the fix\" \\\n  --data '{\"claim\":\"A renamed task with one assessed expectation can close\",\"result\":\"passed\",\"evidenceRefs\":[{\"kind\":\"task\",\"id\":\"<task-id>\"}]}' \\\n  --idempotency-key \"<task-id>:closure-reverify\"\n```\n\n### Media: screenshots and recordings\n\n`--attach <path>` (repeatable) on `updates add`, `result submit`, `complete`, or `comments add`\nuploads a file as a Task asset and cites it; identical bytes dedupe. In-run proof goes on a\n`verification` or `progress` Update, the final before/after on the Result, never the description.\nAn upload is `self_reported` evidence and counts toward the storage quota. Images keep full\nresolution minus metadata (Runs get a model-sized copy); undecodable bytes get 422, a type the bytes\ncontradict 415, and SVG downloads as a file. An agent uploads evidence (the default) or\n`--role deliverable`; `input` is refused (403): ask a person to run `attachments set-role`. Cite a\ndeliverable as `--evidence task_attachment:<asset-id>` when you assess its Expectation.\n\n### Recovery: Update delta and Resume Point snapshot\n\nWhen a semantic boundary should also be resumable, add `--run-id` and `--resume` to the same Update\ncommand. The server commits the visible Update and the Run-bound Resume Point together. The snapshot\nmust be self-contained enough for another capable Agent to continue without replaying the transcript:\ncompleted work, current focus, next actions, open questions, and references to decisions, evidence,\nDeliverables, and durable workspace state.\n\nThe runtime may save a silent crash-safety snapshot with:\n\n```bash\nskrr tasks resume save <task-id> --run-id <run-id> --snapshot '<resume-json>'\n```\n\nNever put credentials, secrets, permission grants, bearer tokens, or leases in a Resume Point. A\nresumed Run reloads the current Task Revision, re-authorizes, validates referenced files/commits, and\nreads Updates recorded after the snapshot:\n\n```bash\nskrr tasks resume show <task-id> --run-id <run-id>\n```\n\n### Deliverables: lightweight input, first-class identity\n\nA user may provide one coordinate, but the platform records a WorkResource, its exact version, the\nTask relationship, and an evidence-backed availability observation. External reference is the\ndefault; OverSky-managed content is used only when retention, stable access, preview/search, or\npolicy requires a copy.\n\n```bash\nskrr tasks deliverable add <task-id> \\\n  file/markdown:docs/reviews/report.md@docs/reviews/report.md \\\n  --status in_review\n```\n\nA recording made by its producer is always self-reported; the caller cannot promote itself to a\nHuman confirmation, system observation, or provider receipt. A local path is only local availability. A commit, provider revision, digest, or managed object\nfreezes the exact version. Do not call “in the conversation” a Deliverable.\n\nA Human confirms the exact linked version, not a retyped URL or name:\n\n```bash\nskrr tasks deliverable confirm <task-id> <task-resource-link-id> --reason \"Opened and checked this exact version\"\n```\n\n### Result and Review are separate\n\nSubmit the finished answer once:\n\n```bash\nskrr tasks result submit <task-id> \\\n  --summary \"NO-SHIP until remediation Gates A-D pass\" \\\n  --conclusion-type release_recommendation \\\n  --conclusion-json '{\"posture\":\"no_ship\"}' \\\n  --deliverable <task-resource-link-id>\n```\n\nAn amendment creates a new Result version and explicitly supersedes the previous one. There is one\ncurrent Result; old versions remain in Activity and are not ordinary Updates.\n\nOnly another actor records acceptance, against that exact Result:\n\n```bash\nskrr tasks review <task-id> --result-id <result-id> --decision accepted --rationale \"Evidence checked\"\n```\n\n“Accepted” means the submitted work was accepted. NO-SHIP, BUY, REJECT, root cause, experiment\ndecision, and similar subject-matter conclusions belong in `Result.conclusion`, never in Review.\n\nUse `skrr tasks complete` only when submitting the Result and advancing workflow in one closeout.\nDo not call `tasks report` before or after it; `tasks complete` already creates the canonical Result.\n\nSubmitting a Result is not the same as closing the Task, and being an Agent is not by itself a\nreason to stop. Closing is always the closer's call — unmet Expectations or a Changes-requested\nReview do not prevent it; they are RECORDED on the close (`resolution.closure`), so closing over\nthem hides nothing and settles nothing. The one exception is an owner-declared required Review\n(`--review-policy required`): a non-owner cannot close without it — unless they close with\n`--force`, which records the override on the resolution — and the owner always can.\n\nSo do not predict the outcome. `result submit` reports where the Task stands after the write —\nread that, and if you need to ask again later:\n\n```bash\nskrr tasks expectations <task-id>     # what is owed, and why the Result cannot be accepted yet\n```\n\nSay “ready for review” only when something you read actually said so.\n\n### Expectations\n\nExpectations are free text first. A typed check explains how the statement can be assessed; it never\nreplaces the sentence.\n\nAn Expectation is an obligation, not a lock: it does not stop a close, it is recorded on one — and\nclosing over it settles nothing. Write each one so it can\nbe judged — say what would satisfy it and how that could be checked — because an Expectation authored\nwithout a thought about verification is one you will later be unable to settle honestly. When you\ncreate several across several Tasks, say how many you created and who they fall to; a set of gates\nnobody was told about is work assigned by accident. A Deliverable requirement is one typed Expectation, not a second\n`requiredDeliverables` list. Actual Deliverables are recorded only after something exists.\n\nRead what is owed, then settle it — never rewrite the declaration to make it settleable:\n\n```bash\nskrr tasks expectations <task-id>                       # what is owed, and how far each one got\nskrr tasks expectations assess <task-id> <expectation-id> \\\n  --decision met \\\n  --reason \"Ran the suite named in the statement; 49/49 pass\" \\\n  --evidence code:<commit>\nskrr tasks expectations assess <task-id> --all \\\n  --decision met --reason \"...\"                         # every one still awaiting a judgement\n```\n\n**You may assess any Expectation that takes a judgement.** A `deliverable` Expectation is not one —\nit settles through its linked Resource and evidence, so record the Deliverable rather than\nassessing it. The assessment is recorded as YOURS — every surface shows `met (agent)` against\n`met (person)` — and a human can override it. The control is attribution, not permission, so what\nyou owe is not restraint but evidence: cite what you actually checked, and prefer `--evidence` and\n`--resource-link-id` over prose.\n\nAssess what you VERIFIED. Not what you intended, not what you inferred from having finished the\nwork. “I could not check this” is a real and useful answer — record it `unmet` with the reason\nrather than leaving it silent, because an unassessed Expectation and one you tried and failed to\nverify send the next reader to different places.\n\nA waiver is a judgement about scope — that this is no longer owed — and it stays a person's call:\nif the honest answer is \"this should be waived,\" say so in an Update or Comment and let a person\nrecord it. Do not delete the Expectation to hide that it was owed.\n\nChanging an Expectation's wording advances the Task specification and **revokes every assessment\nalready recorded** — fix the statement before people start settling it, not after.\n\n### Labels — say what PROGRAM this belongs to\n\nA label is cross-cutting classification: which recurring program a Space or Task\nbelongs to (`dogfood`, `incident`, `experiment`, `migration`), not what state it\nis in. Status, priority and assignee are first-class fields and already answer\ntheir own questions — a label that restates one is noise that will drift out of\nsync with the field it copies.\n\nThe vocabulary is DECLARED, not invented. Read it before you use it:\n\n```bash\nskrr labels list\n```\n\nAttach from that list, never a name you made up. A second spelling of an\nexisting label (`dog-food` beside `dogfood`) is worse than no label at all,\nbecause the whole value of one is that filtering on it returns everything:\n\n```bash\nskrr spaces labels add <space-id> --label <label-id>\nskrr tasks labels attach <task-id> --label <label-id>\n```\n\nCreate a label only when the program it names is real and recurring, and say\nwhich entities it applies to — a label created without `--applicable-to space`\ncannot be attached to a Space, which is how a vocabulary comes to exist that\nnothing can use:\n\n```bash\nskrr labels create --name <name> --applicable-to space --applicable-to task\n```\n\nWhen you create a Space or Task for a recurring program, label it as you create\nit (`--label <id>` on `spaces`, `tasks` and `goals create`). The create\nresponse carries a `_labelGuidance` hint naming the applicable vocabulary WITH\nITS IDS when you attached none — read it, and attach in one follow-up call if\none of them fits. It may also carry `suggested` — a proposal, not a decision;\nattach is your call. `skrr tasks labels suggest <task-id>` asks it of a Task.\n\nIf nothing in the vocabulary fits, attach nothing. \"No label\" is a correct\nanswer and a wrong label is not.\n\n### Comments and blockers\n\nUse a Comment only for a question, answer, or review discussion where a reply is useful. For a\nblocker, first record the typed blocker Update, then move the Task to blocked. Add a Comment only if\nsomeone actually needs to respond.\n\n### Creating and placing Tasks\n\nCreate a Task without asking when work needs tracking across meaningful steps, sessions, or\nfollow-up. Avoid duplicates and do not create Tasks for trivial actions that finish immediately.\n\n```bash\nskrr tasks list --q \"<relevant title>\"\nskrr tasks create --title \"<concise requested result>\" --description \"<scope and constraints>\" --json\nskrr tasks move <task-id> --status in_progress\n```\n\nA Space is a durable ownership, collaboration, and authorization boundary. Use an identified Space\nwhen the work clearly belongs there; otherwise create the Task unscoped. Ask before creating a new\nSpace. An Agent works a Task in a Space only as a Space member, or when it is shared with no one\nelse and its owner assigns and starts it; anything else is refused. Do not widen Agent membership\nmerely to force one task assignment.\n\n### Closing a Task out\n\nThe model above says what each record IS. This is the order they go in, and what each step can\nrefuse:\n\n1. **Record what exists** — `skrr tasks deliverable add`, binding it to the Expectation it answers\n   with `--expectation <id>` whenever one applies. Evidence that arrives bound is evidence the next\n   reader does not have to reconstruct.\n2. **Submit the answer** — `skrr tasks result submit`. This does not close the Task. Read what it\n   reports back.\n3. **Read what is still owed** — `skrr tasks expectations <task-id>`.\n4. **Settle what you verified** — `skrr tasks expectations assess`, citing evidence. `--all` covers\n   every Expectation still awaiting a judgement.\n5. **Read the Task state again and report THAT** — not what you intended it to be.\n\nTwo things still matter regardless of how complete the work is: an unmet Expectation, and a\n`changes_requested` Review. Neither blocks a close — but both are stamped onto it\n(`resolution.closure`), so closing over them is a recorded choice, not a clean finish. Neither is\na failure state; both are somebody's turn.\n\nStep 5 is the one that goes wrong quietly, and not only here: before reporting a check as passed,\nconfirm you measured what you think you measured. A pipeline's exit status is the LAST command's, so\n`cmd | tail` reports on `tail`. A filter may match something other than what you meant — a path\npattern can match the directory you are working in. When a result will be reported to a person as\nfact, re-run it in the simplest form that can only mean one thing.\n\nAcross a whole Space, `skrr tasks review-queue --space <space-id>` names every outstanding\njudgement at once, with its evidence and the command that settles it.\n\n### Share readable links and close the loop\n\nShare clickable Task, Space, Goal, and Commitment URLs, never bare IDs. Use the URL returned by the\nCLI; do not construct one. If needed:\n\n```bash\nskrr tasks show <task-id> --json\nskrr spaces show <space-id> --json\nskrr goals show <goal-id> --json\nskrr commitments show <commitment-id> --json\n```\n\nBefore your final response, verify every Task you created or touched reflects reality. If work is\nready for independent review, leave it in review. If blocked, record the blocker and required action.\nIf genuinely complete and accepted under the Task's policy, close it. Include the Task URL in the\nfinal handoff. Never claim a write succeeded unless the CLI returned success.\n\n### Coming back later\n\nYou can arrange to return to something. Four shapes, and picking the right one\nmatters more than the wording:\n\n**Reminder** — the user asked to be reminded. Keep their words; a reminder you\nhave rephrased into your own voice is no longer the thing they asked for.\n\n**Watch** — something has an asynchronous tail: CI, a review, an approval, a\nlong job, a metric. If the condition is machine-checkable (an endpoint plus a\npredicate), say so — that costs nothing and is guaranteed to terminate. Only\nwrite a prose check recipe when the check genuinely needs your judgement or your\ntools, because that one burns a full turn every time it runs. Always give it an\nabort condition: a watch that cannot stop is a leak.\n\n**Check-in** — you decided the conversation is worth returning to. This is\npermission AND restraint. Come back when you will have something worth saying —\na result that will have arrived, a decision that will be ripe, a thread you left\ngenuinely open. When you see one, arrange the return yourself and say in one\nline when you will look again. Do not ask whether you should: that hands the\nperson a decision they did not come to make. Do not come back to ask how it is\ngoing. A legacy check-in holds one pending return per conversation. For a sequence\nof checks, use one scheduled lookback plan with 1–10 lifetime steps. When you\nwake, read the original goal, current state and earlier outcomes. Saying\nnothing is a legitimate outcome and often the right one. Stop or cancel\nremaining checks when the work resolves, becomes obsolete or the person cancels.\n\n**Act** — a specific action you already know how to take and the user has already\nagreed to. Not for anything you would still need to ask about.\n\nSettle what you arranged. When you wake and the thing resolved, say so and close\nit out; when it did not, either come back once more with a reason or hand it to\nthe person. Leaving one armed forever is the failure mode here.\n\nFrom a local session, arrange these with `skrr followups` —\n`remind`, `watch`, `checkin`, `act` — and settle them with\n`skrr followups resolve <id> --outcome resolved`.\nFor a bounded lookback plan, use `skrr followups plans create --from-json plan.json`\nand inspect, revise or cancel it with `skrr followups plans` (read `--help`).\nUse 1–10 concrete checks, relative offsets from the completed reply or explicit\nabsolute/local times, and a stop condition. Omit a plan when none is useful.\nA saved plan is not necessarily armed; read the returned receipt before promising a return.\n",
+        "hash": "a4bcb9d4c39e33e8a1dcd12b8a669efe80c67d81c3a8ad90119be73f8352c8b6"
     }
 }

package/dist/lib/agentic-stream.d.ts

@@ -1,4 +1,4 @@
-import { type AssistantTextJoiner } from '@skrr-ai/data-provider';
+import { type PublicProjection, type AssistantTextJoiner } from '@skrr-ai/data-provider';
 /**
  * Why a question was dismissed when no terminal exists to ask it on. It is the
  * REASON for a dismissal, never an answer: it travels as the value of the
@@ -48,6 +48,7 @@ export type AgenticStreamResult = {
  */
 export type ReconciledTerminal = {
     status: 'completed' | 'failed';
+    publicProjection?: PublicProjection;
     /** The answer as persisted, when there is one. */
     text?: string;
     /** The recorded failure reason — `metadata.agentic.error` on the message. */
@@ -100,6 +101,7 @@ export type HandoverReading =
  | {
     state: 'repaired';
     text: string;
+    publicProjection?: PublicProjection;
     repairedAt?: string;
 }
 /** The machine's turn ended without finishing, and the server settled it so. */
@@ -107,6 +109,7 @@ export type HandoverReading =
     state: 'failed';
     error: string;
     text?: string;
+    publicProjection?: PublicProjection;
 };
 export type HandoverWaitOptions = {
     /** Read the persisted response message. A throw or null is "no evidence". */
@@ -153,6 +156,10 @@ export type AgenticStreamOptions = {
     token: string;
     workspaceId?: string;
     sessionId: string;
+    /** Caller-owned conversation identity, never taken from a permission payload. */
+    conversationId?: string;
+    /** Action-required notices when stdout is reserved for a final result. */
+    statusOutput?: NodeJS.WritableStream;
     jsonl?: boolean;
     approveTools?: boolean;
     input?: NodeJS.ReadableStream;
@@ -512,6 +519,7 @@ export declare class AgenticStreamClient {
     private readonly textJoiner;
     /** Highest envelope `__seq` folded into `accumulated`, for gap detection. */
     private highestSeq;
+    private publicProjection;
     private readonly pendingEnvelopes;
     private replayTimer;
     private replayFlight;
@@ -560,6 +568,7 @@ export declare class AgenticStreamClient {
      * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
      */
     private readonly openPermissionPrompts;
+    private readonly browserPermissionRequests;
     /**
      * Question prompts on the terminal still waiting for an answer, by
      * questionId, so a server `question:cancel` can close the one it names

package/dist/lib/agentic-stream.js

@@ -25,6 +25,8 @@ exports.streamShowsRecordedText = streamShowsRecordedText;
 exports.describeRunPermission = describeRunPermission;
 exports.toWebSocketOrigin = toWebSocketOrigin;
 const node_readline_1 = require("node:readline");
+const computer_use_1 = require("@skrr-ai/auth-core/computer-use");
+const web_url_1 = require("./web-url");
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const config_1 = require("./config");
@@ -740,6 +742,7 @@ class AgenticStreamClient {
     textJoiner = (0, data_provider_1.createAssistantTextJoiner)();
     /** Highest envelope `__seq` folded into `accumulated`, for gap detection. */
     highestSeq = 0;
+    publicProjection;
     pendingEnvelopes = new Map();
     replayTimer = null;
     replayFlight = null;
@@ -790,6 +793,7 @@ class AgenticStreamClient {
      * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
      */
     openPermissionPrompts = new Map();
+    browserPermissionRequests = new Set();
     /**
      * Question prompts on the terminal still waiting for an answer, by
      * questionId, so a server `question:cancel` can close the one it names
@@ -972,6 +976,7 @@ class AgenticStreamClient {
             reason,
             ...(terminal.error ? { message: terminal.error, error: terminal.error } : {}),
             ...(typeof terminal.text === 'string' ? { result: terminal.text } : {}),
+            ...(terminal.publicProjection ? { publicProjection: terminal.publicProjection } : {}),
         });
         return true;
     }
@@ -1004,6 +1009,7 @@ class AgenticStreamClient {
         this.replayTimer = null;
         this.stopHandoverTimers();
         this.pendingEnvelopes.clear();
+        this.browserPermissionRequests.clear();
         this.abandonConnectWait?.();
         const socket = this.socket;
         this.socket = null;
@@ -1129,6 +1135,7 @@ class AgenticStreamClient {
                 type: 'execution:complete',
                 sessionId: this.options.sessionId,
                 result: reading.text,
+                ...(reading.publicProjection ? { publicProjection: reading.publicProjection } : {}),
                 repaired: true,
                 repairedFrom: 'durable_record',
                 overturned: { code: exports.WORKER_REPLACED_CODE, reason: exports.DAEMON_HANDOVER_REASON },
@@ -1146,6 +1153,7 @@ class AgenticStreamClient {
             message: reading.error,
             errors: [reading.error],
             ...(typeof reading.text === 'string' && reading.text ? { result: reading.text } : {}),
+            ...(reading.publicProjection ? { publicProjection: reading.publicProjection } : {}),
             handover: { outcome: 'machine_failed', waitedMs },
         });
         return true;
@@ -1454,6 +1462,9 @@ class AgenticStreamClient {
             if (fresh.length === 0)
                 return; // a pure re-delivery — drop it whole
             const scoped = { ...event, envelopes: fresh };
+            if (fresh.some((env) => env?.ev?.t === 'text' &&
+                env.ev?.publicProjection === 'lookback_answer_v1'))
+                this.publicProjection = 'lookback_answer_v1';
             // Note what never arrived before folding this batch in (OSK-7631,
             // OSK-13518). Checked against the FRESH set: a re-delivery carries old
             // seqs and would read as a gap that never happened.
@@ -1539,6 +1550,8 @@ class AgenticStreamClient {
         socket.on('message:stream', (event) => {
             if (!match(event))
                 return;
+            if (event.publicProjection === 'lookback_answer_v1')
+                this.publicProjection = event.publicProjection;
             const text = typeof event.text === 'string' ? event.text : '';
             const delta = typeof event.delta === 'string' ? event.delta : '';
             if (text && text.length >= this.accumulated.length)
@@ -1574,6 +1587,7 @@ class AgenticStreamClient {
             if (!match(event))
                 return;
             this.accumulated = '';
+            this.publicProjection = undefined;
             this.textJoiner.reset();
             this.renderedText = '';
             // Seqs restart with the stream, so a fresh low seq is not a gap.
@@ -1670,6 +1684,41 @@ class AgenticStreamClient {
         if (this.closed)
             return;
         this.emit({ ...event, type: 'permission.requested' });
+        // Runtime-authored application consent is exclusively an interactive app
+        // decision. A TTY or --approve-tools is not that authenticated human lane.
+        // Recognize malformed runtime asks too, so they never fall into generic grants.
+        if (event.purpose === 'runtime-elicitation' || event.runtimeElicitation !== undefined || event.toolName === 'ComputerUse') {
+            let message = 'This Computer Use request cannot be verified. Wait for a new request in the app.';
+            let requestValid = false;
+            try {
+                const runtime = event.runtimeElicitation;
+                (0, computer_use_1.assertComputerUseElicitationRequest)(runtime);
+                if (event.purpose !== 'runtime-elicitation' || event.toolName !== 'ComputerUse' ||
+                    event.toolUseId !== runtime.requestId || runtime.context.sessionId !== this.options.sessionId ||
+                    runtime.expiresAt <= Date.now())
+                    throw new Error('Mismatched runtime permission');
+                const display = (text) => describePermissionTarget({ command: text }) ?? '';
+                message = [display(runtime.message),
+                    `Choices in the app: ${runtime.options.map((option) => display(option.label)).join(' | ')}`,
+                    `Expires: ${new Date(runtime.expiresAt).toISOString()}`,
+                    'Answer in the signed-in app. This CLI cannot grant or decline application access.'].join('\n');
+                requestValid = true;
+            }
+            catch {
+                // No generic yes/no fallback, including on malformed or expired requests.
+            }
+            const approvalUrl = this.options.conversationId
+                ? (0, web_url_1.conversationUrlFrom)(this.options.baseURL, { conversationId: this.options.conversationId })
+                : null;
+            if (approvalUrl)
+                message += `\nOpen ${approvalUrl} and choose Review pending decisions.`;
+            else
+                message += '\nOpen this conversation in the signed-in app and choose Review pending decisions.';
+            if (event.toolUseId)
+                this.browserPermissionRequests.add(event.toolUseId);
+            this.emit({ ...event, type: 'permission.browser_required', requestValid, approvalUrl, message });
+            return;
+        }
         if (!this.options.approveTools || !this.socket) {
             if (event.toolUseId) {
                 this.socket?.emit('permission:deny', {
@@ -1805,12 +1854,15 @@ class AgenticStreamClient {
         const open = toolUseId ? this.openPermissionPrompts.get(toolUseId) : undefined;
         // Every answer is echoed to the whole session as `answered` — including
         // this client's own. Only one that closes a prompt still open HERE is news.
-        if (event.reason === 'answered' && !open)
+        const browserWaiting = toolUseId ? this.browserPermissionRequests.has(toolUseId) : false;
+        if (event.reason === 'answered' && !open && !browserWaiting)
             return;
         if (!this.firstTimeSeen('permission-cancel', toolUseId))
             return;
-        if (toolUseId)
+        if (toolUseId) {
             this.openPermissionPrompts.delete(toolUseId);
+            this.browserPermissionRequests.delete(toolUseId);
+        }
         open?.abort();
         this.emit({
             ...event,
@@ -1928,6 +1980,13 @@ class AgenticStreamClient {
         // result, so there the line goes to stderr (OSK-13543).
         if (!this.options.jsonl && this.renderHandoverStatus(event))
             return;
+        if (event.type === 'permission.browser_required' && (this.options.quiet || !this.options.jsonl)) {
+            const output = this.options.quiet
+                ? this.options.statusOutput ?? process.stderr
+                : this.options.output ?? process.stdout;
+            output.write(`\n[application permission] ${String(event.message)}\n`);
+            return;
+        }
         // Accumulation and `onEvent` still run — only the incremental rendering is
         // suppressed, so a quiet run is the same turn with a different display.
         if (this.options.quiet)
@@ -2099,7 +2158,7 @@ class AgenticStreamClient {
             const streamedText = (0, widgetTerminalText_1.widgetsAsText)(this.accumulated, { final: true });
             void this.readRecordedText().then((recorded) => {
                 this.settleGapVerdict(streamedText, recorded);
-                this.settle(status, event, recorded?.text || undefined);
+                this.settle(status, event, recorded);
             });
             return;
         }
@@ -2124,10 +2183,10 @@ class AgenticStreamClient {
             try {
                 const terminal = await reconcile();
                 if (terminal && typeof terminal.text === 'string' && terminal.text) {
-                    return { text: terminal.text };
+                    return { text: terminal.text, ...(terminal.publicProjection ? { publicProjection: terminal.publicProjection } : {}) };
                 }
                 if (terminal)
-                    empty = { text: '' };
+                    empty = { text: '', ...(terminal.publicProjection ? { publicProjection: terminal.publicProjection } : {}) };
             }
             catch {
                 // No evidence either way; try again, then settle on the stream.
@@ -2135,7 +2194,7 @@ class AgenticStreamClient {
         }
         return empty;
     }
-    settle(status, event, recordedText) {
+    settle(status, event, recorded) {
         // `execution:complete` carries the final answer as `result`, and it is
         // AUTHORITATIVE — preferred over whatever the deltas added up to, not just
         // used when they added up to nothing.
@@ -2146,6 +2205,8 @@ class AgenticStreamClient {
         // `result` whenever the server sends one makes the returned text the
         // agent's actual final message rather than however much of it arrived in
         // time.
+        if (event.publicProjection === 'lookback_answer_v1')
+            this.publicProjection = event.publicProjection;
         const finalText = typeof event.result === 'string' ? event.result : '';
         // …EXCEPT when it is a strict suffix of what we accumulated.
         //
@@ -2168,7 +2229,10 @@ class AgenticStreamClient {
             this.accumulated.length > finalText.length &&
             (this.accumulated.endsWith(finalText) ||
                 endsWithIgnoringWhitespace(this.accumulated, finalText));
-        if (finalText && finalText !== this.accumulated && !accumulationIsSuperset) {
+        if (event.publicProjection === 'lookback_answer_v1' && typeof event.result === 'string') {
+            this.accumulated = event.result;
+        }
+        else if (finalText && finalText !== this.accumulated && !accumulationIsSuperset) {
             this.accumulated = finalText;
         }
         // The record wins over a stream known to have lost chunks, unless what
@@ -2176,9 +2240,10 @@ class AgenticStreamClient {
         // other way round).
         // (Compared as the reader sees it: the record holds a widget as its fallback sentence,
         // which is shorter than the block the stream carried, and the raw length would never lose.)
-        if (recordedText &&
-            recordedText.length > (0, widgetTerminalText_1.widgetsAsText)(this.accumulated, { final: true }).length) {
-            this.accumulated = recordedText;
+        if (recorded && (recorded.publicProjection === 'lookback_answer_v1' ||
+            recorded.text.length > (0, widgetTerminalText_1.widgetsAsText)(this.accumulated, { final: true }).length)) {
+            this.accumulated = recorded.text;
+            this.publicProjection = recorded.publicProjection;
         }
         // The finished answer, as every other surface shows it: the web applies
         // this same sanitizer, so a scheduling JSON block or leaked function-call
@@ -2186,7 +2251,7 @@ class AgenticStreamClient {
         // printed as part of the agent's answer.
         // A widget is its fallback sentence in a terminal, first: the sanitizer must read
         // prose and never a widget's script (the server projects before it sanitizes, too).
-        this.accumulated = (0, data_provider_1.sanitizeFinalText)((0, widgetTerminalText_1.widgetsAsText)(this.accumulated, { final: true }));
+        this.accumulated = (0, data_provider_1.sanitizeFinalText)((0, widgetTerminalText_1.widgetsAsText)(this.accumulated, { final: true }), this.publicProjection);
         if (!this.options.quiet && !this.options.jsonl && this.accumulated) {
             const output = this.options.output ?? process.stdout;
             const { append, shown } = renderableDelta(this.renderedText, this.accumulated);

package/dist/lib/artifact-export.d.ts

@@ -23,18 +23,18 @@ export declare class ExportContractError extends Error {
     constructor(message: string, code: string);
 }
 export declare function standardExportFlags(): {
-    summary: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
-    output: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-    json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    summary: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    output: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
 };
 export declare function paginatedExportFlags(options?: {
     defaultMaxItems?: number;
 }): {
-    'max-items': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-    cursor: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-    summary: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
-    output: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-    json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    'max-items': import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    cursor: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    summary: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    output: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
 };
 export declare function resolveExportSelection(flags: {
     output?: string;

package/dist/lib/channel-command-runners.d.ts

@@ -1,6 +1,6 @@
 import { type ProviderCliSpec } from './channel-tools';
 type CommandBridge = any;
-export declare const agentFlag: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+export declare const agentFlag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
 export declare function runToolsCommand(command: CommandBridge, commandClass: CommandBridge, spec: ProviderCliSpec): Promise<void>;
 export declare function runListChannelsCommand(command: CommandBridge, commandClass: CommandBridge, spec: ProviderCliSpec): Promise<void>;
 export declare function runReadChannelCommand(command: CommandBridge, commandClass: CommandBridge, spec: ProviderCliSpec): Promise<void>;
@@ -9,14 +9,14 @@ export declare function runSearchCommand(command: CommandBridge, commandClass: C
 export declare function runListUsersCommand(command: CommandBridge, commandClass: CommandBridge, spec: ProviderCliSpec): Promise<void>;
 export declare function runInvokeCommand(command: CommandBridge, commandClass: CommandBridge, spec: ProviderCliSpec): Promise<void>;
 export declare function runSendAsAgentCommand(command: CommandBridge, commandClass: CommandBridge, spec: ProviderCliSpec): Promise<void>;
-export declare const jsonFlag: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
-export declare const limitFlag: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
-export declare const channelFlag: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
-export declare const optionalChannelFlag: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-export declare const threadFlag: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-export declare const messageFlag: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-export declare const textFlag: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-export declare const inlineArgsFlag: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-export declare const inputArg: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
-export declare const toolArg: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+export declare const jsonFlag: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+export declare const limitFlag: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+export declare const channelFlag: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+export declare const optionalChannelFlag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+export declare const threadFlag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+export declare const messageFlag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+export declare const textFlag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+export declare const inlineArgsFlag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+export declare const inputArg: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+export declare const toolArg: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
 export {};

package/dist/lib/commerce-command.d.ts

@@ -16,8 +16,8 @@
  * required will not be fired with `{}` just because a path was omitted.
  */
 export declare const jsonBodyFlags: {
-    file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-    json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
 };
 export interface JsonBodyOwner {
     error(message: string, options?: {

package/dist/lib/commitment-endpoints.d.ts

@@ -1,7 +1,7 @@
 import { withQuery } from './triggers';
 export declare const ENDPOINT_CAPABILITIES: readonly ["push", "reply", "structuredAsk"];
 /** Derived from the one destination registry; never a second list. */
-export declare const COMMITMENT_ENDPOINT_DESTINATIONS: ("email" | "pinned" | "app_owner_dm" | "slack_owner_dm" | "slack_channel" | "main" | "discord_owner_dm" | "user_notify")[];
+export declare const COMMITMENT_ENDPOINT_DESTINATIONS: ("email" | "main" | "pinned" | "app_owner_dm" | "slack_owner_dm" | "slack_channel" | "discord_owner_dm" | "user_notify")[];
 export type EndpointCapability = (typeof ENDPOINT_CAPABILITIES)[number];
 export interface CommitmentEndpoint {
     id: string;

package/dist/lib/computer-use.d.ts

@@ -0,0 +1,9 @@
+import { Command } from '@oclif/core';
+export declare function buildComputerUseArgs(action: string | undefined, argv: readonly string[]): string[];
+/** The runtime owns local consent, installation and lifecycle; the REST CLI only dispatches. */
+export declare function forwardComputerUseCommand(command: Command, action: string | undefined, argv: readonly string[]): Promise<void>;
+export declare abstract class ComputerUseCommand extends Command {
+    static strict: boolean;
+    protected abstract action: string | undefined;
+    run(): Promise<void>;
+}

package/dist/lib/computer-use.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ComputerUseCommand = void 0;
+exports.buildComputerUseArgs = buildComputerUseArgs;
+exports.forwardComputerUseCommand = forwardComputerUseCommand;
+const core_1 = require("@oclif/core");
+const exec_runtime_binary_1 = require("./exec-runtime-binary");
+function buildComputerUseArgs(action, argv) {
+    return ['computer-use', ...(action ? [action] : []), ...argv];
+}
+/** The runtime owns local consent, installation and lifecycle; the REST CLI only dispatches. */
+async function forwardComputerUseCommand(command, action, argv) {
+    const fail = (message, code, exit) => {
+        if (argv.includes('--json')) {
+            command.log(JSON.stringify({ object: 'computer_use_control', schemaVersion: 1, action: action ?? argv[0] ?? 'help', ok: false, error: { code, message } }));
+            return command.exit(exit);
+        }
+        command.log(message);
+        return command.exit(exit);
+    };
+    try {
+        if ((await (0, exec_runtime_binary_1.runtimeBinarySupportsSubcommand)('computer-use')) === false) {
+            return fail('The installed runtime command does not support Computer Use. ' +
+                'Run `skrr daemon status --json` to identify the running installation, then ' +
+                '`skrr update --check --json` to inspect available releases. ' +
+                'If the running daemon belongs to the Skrr desktop app, update that app. ' +
+                'An up-to-date runtime command can differ from the running daemon, and the latest ' +
+                'release may not include Computer Use yet. Retry only with a compatible official runtime.', 'runtime_unsupported', 2);
+        }
+        command.exit(await (0, exec_runtime_binary_1.execRuntimeBinary)(buildComputerUseArgs(action, argv)));
+    }
+    catch (error) {
+        if (error.message === 'runtime-binary-not-installed') {
+            return fail((0, exec_runtime_binary_1.notInstalledMessage)(), 'runtime_not_installed', 127);
+        }
+        throw error;
+    }
+}
+class ComputerUseCommand extends core_1.Command {
+    static strict = false;
+    async run() {
+        // Never call parse(): unknown runtime flags must reach the authoritative parser unchanged.
+        await forwardComputerUseCommand(this, this.action, this.argv);
+    }
+}
+exports.ComputerUseCommand = ComputerUseCommand;

package/dist/lib/continuityPreferences.d.ts

@@ -0,0 +1,3 @@
+import type { ContinuityPreferencesResponse, UpdateContinuityPreferencesRequest } from '@skrr-ai/data-provider';
+export declare function continuityPreferencesInput(raw: unknown, explicitAgentId?: string): UpdateContinuityPreferencesRequest;
+export declare function continuityPreferencesLines(result: ContinuityPreferencesResponse): string[];

package/dist/lib/continuityPreferences.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.continuityPreferencesInput = continuityPreferencesInput;
+exports.continuityPreferencesLines = continuityPreferencesLines;
+function continuityPreferencesInput(raw, explicitAgentId) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        throw new Error('Expected a preferences update object.');
+    const body = raw;
+    const allowed = ['agentId', 'expectedRevision', 'proactiveContributions', 'automaticReturns', 'allowHostedInference', 'inherit'];
+    if (Object.keys(body).some((key) => !allowed.includes(key)))
+        throw new Error('Unsupported preferences field. Supply only settings, scope and expectedRevision.');
+    if (!Number.isSafeInteger(body.expectedRevision) || body.expectedRevision < 0)
+        throw new Error('expectedRevision must be a nonnegative integer from the selected scope.');
+    if (body.agentId !== undefined && (typeof body.agentId !== 'string' || !body.agentId.trim()))
+        throw new Error('agentId must be a nonempty string.');
+    if (explicitAgentId && body.agentId && explicitAgentId !== body.agentId)
+        throw new Error('--agent conflicts with agentId in the input.');
+    const agentId = explicitAgentId || body.agentId;
+    const fields = ['proactiveContributions', 'automaticReturns', 'allowHostedInference'];
+    for (const key of fields) {
+        if (body[key] !== undefined && typeof body[key] !== 'boolean' && !(key === 'allowHostedInference' && body[key] === null))
+            throw new Error(`${key} must be a boolean${key === 'allowHostedInference' ? ' or null to inherit' : ''}.`);
+    }
+    if (body.inherit !== undefined && body.inherit !== true)
+        throw new Error('inherit must be true when supplied.');
+    if (body.inherit === true && (!agentId || fields.some((key) => body[key] !== undefined)))
+        throw new Error('inherit requires an agentId and cannot be combined with individual settings.');
+    if (body.inherit !== true && !fields.some((key) => body[key] !== undefined))
+        throw new Error('Supply at least one preference setting or inherit:true.');
+    return { ...body, ...(agentId ? { agentId } : {}) };
+}
+function continuityPreferencesLines(result) {
+    const hosted = result.settings.allowHostedInference;
+    return [
+        `Scope: ${result.scope.agentId ? `agent ${result.scope.agentId}` : 'account'} (r${result.revision})`,
+        `Proactive contributions: ${result.preferences.proactiveContributions ? 'on' : 'off'}`,
+        `Automatic returns: ${result.preferences.automaticReturns ? 'on' : 'off'}`,
+        `Hosted continuity analysis: ${hosted === null ? 'inherit' : hosted ? 'allowed' : 'disallowed'}`,
+        `Effective hosted permission: ${result.preferences.effectiveHostedInferenceAllowed ? 'allowed' : 'disallowed'}`,
+        'Hosted permission covers private continuity analysis separately from the primary agent route; it does not guarantee an available inference route.',
+    ];
+}