@skrr-ai/cli 0.1.116 → 0.1.118

package/dist/lib/command-miss.js

@@ -19,7 +19,11 @@
  * Keeping the text here rather than in either caller is the point: a fix to one
  * phrasing reaches both, and neither surface can quietly drift from the other.
  */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TASK_COMMAND_MISS_TARGETS = void 0;
 exports.editDistance = editDistance;
 exports.nearestCommands = nearestCommands;
 exports.helpSubjectId = helpSubjectId;
@@ -29,6 +33,7 @@ exports.lookupFromConfig = lookupFromConfig;
 exports.resolveVerbSynonym = resolveVerbSynonym;
 exports.typedCommandWords = typedCommandWords;
 exports.commandMissEnvelope = commandMissEnvelope;
+const agent_guides_json_1 = __importDefault(require("../generated/agent-guides.json"));
 /** A uuid-ish token, which is what a stray space id looks like. */
 const LOOKS_LIKE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const DAEMON_READINESS = [
@@ -67,6 +72,78 @@ function describeAnsweredElsewhere(config, resolved, extras) {
         suggestions: targets.map((t) => `${config.bin} ${t.usage}`),
     };
 }
+/**
+ * Commands behind the Task spellings agents reach for before they have read
+ * the guide. Keep these ids here with their redirects so the manifest contract
+ * test can prove every printed target ships in this CLI build.
+ */
+exports.TASK_COMMAND_MISS_TARGETS = Object.freeze({
+    topic: 'tasks',
+    search: 'tasks:list',
+    resultShow: 'tasks:result:show',
+    resultSubmit: 'tasks:result:submit',
+});
+function hasTopic(config, id) {
+    return config.topicNames.some((topic) => topic.toLowerCase() === id);
+}
+function describeTaskCommandRedirect(config, parts, typedWords) {
+    const lower = parts.map((part) => part.toLowerCase());
+    // `task` is an understandable singular spelling of the Tasks topic, but a
+    // generic singular-to-plural rule would steal real topics such as `agent`.
+    if (lower.length === 1 &&
+        lower[0] === 'task' &&
+        config.findCommand('task') === undefined &&
+        !hasTopic(config, 'task') &&
+        hasTopic(config, exports.TASK_COMMAND_MISS_TARGETS.topic)) {
+        const target = `${config.bin} ${exports.TASK_COMMAND_MISS_TARGETS.topic} --help`;
+        return {
+            message: `\`${config.bin} task\` is not a topic; use \`${config.bin} tasks\` for Task commands.`,
+            fix: `See \`${target}\`.`,
+            suggestions: [target],
+        };
+    }
+    if (lower[0] === 'tasks' &&
+        lower[1] === 'search' &&
+        hasTopic(config, 'tasks') &&
+        config.findCommand(exports.TASK_COMMAND_MISS_TARGETS.search) !== undefined) {
+        const query = typedWords.slice(2).join(' ').trim();
+        const target = `${config.bin} tasks list --q ${query ? JSON.stringify(query) : '<query>'}`;
+        return {
+            message: `\`${config.bin} tasks search\` is not a command; search Tasks with \`${config.bin} tasks list --q\`.`,
+            fix: `Run \`${target}\`.`,
+            suggestions: [target],
+        };
+    }
+    if (lower.length === 3 &&
+        lower[0] === 'tasks' &&
+        lower[1] === 'result' &&
+        hasTopic(config, 'tasks:result')) {
+        const task = typedWords[2] ?? parts[2];
+        const targets = [
+            config.findCommand(exports.TASK_COMMAND_MISS_TARGETS.resultShow) !== undefined
+                ? {
+                    command: `${config.bin} tasks result show ${task}`,
+                    answers: 'read the current Result',
+                }
+                : null,
+            config.findCommand(exports.TASK_COMMAND_MISS_TARGETS.resultSubmit) !== undefined
+                ? {
+                    command: `${config.bin} tasks result submit ${task} --summary "<summary>"`,
+                    answers: 'submit a Result',
+                }
+                : null,
+        ].filter((target) => target !== null);
+        if (targets.length === 0)
+            return null;
+        return {
+            message: `\`${config.bin} ${typedWords.slice(0, 3).join(' ')}\` is not a command; ` +
+                `\`${config.bin} tasks result\` is a topic.`,
+            fix: targets.map((target) => `  \`${target.command}\` — ${target.answers}`).join('\n'),
+            suggestions: targets.map((target) => target.command),
+        };
+    }
+    return null;
+}
 const WHOAMI = {
     id: 'whoami',
     answers: 'who you are signed in as, which server, and where the credential came from',
@@ -147,12 +224,28 @@ const DEPENDENCY_WORKFLOW = [
     },
 ];
 const TASK_OPERATIONS = [
-    { id: 'tasks:guide', usage: 'tasks guide', answers: 'find the commands for Task planning, dependencies, execution, and results' },
+    {
+        id: 'guide',
+        usage: 'guide tasks',
+        answers: 'read the tasks guide — planning, dependencies, execution, and results',
+    },
 ];
 const TASK_PREFLIGHT = [
-    { id: 'tasks:preflight', usage: 'tasks preflight <task>', answers: 'read workflow blockers and execution prerequisites without starting work; shell execution remains unverified' },
-    { id: 'tasks:actionability', usage: 'tasks actionability <task>', answers: 'read the canonical next actor and allowed workflow actions' },
-    { id: 'tasks:start', usage: 'tasks start <task> --dry-run', answers: 'read only the server execution preview; never starts a Run' },
+    {
+        id: 'tasks:preflight',
+        usage: 'tasks preflight <task>',
+        answers: 'read workflow blockers and execution prerequisites without starting work; shell execution remains unverified',
+    },
+    {
+        id: 'tasks:actionability',
+        usage: 'tasks actionability <task>',
+        answers: 'read the canonical next actor and allowed workflow actions',
+    },
+    {
+        id: 'tasks:start',
+        usage: 'tasks start <task> --dry-run',
+        answers: 'read only the server execution preview; never starts a Run',
+    },
 ];
 const WORKFLOW_HINTS = {
     'spaces:projects': PROJECT_WORKFLOW,
@@ -167,6 +260,33 @@ const WORKFLOW_HINTS = {
     'tasks:doctor': TASK_PREFLIGHT,
     'tasks:readiness': TASK_PREFLIGHT,
 };
+/**
+ * `<topic> guide`, the pre-`skrr guide` spelling of "read the guide for that
+ * domain". A topic with no `guide` command of its own (`agents guide`,
+ * `store guide`, or an alias like `task-management guide`) is the reader
+ * asking for the front door — the ids come from the bundled registry, so a
+ * new guide becomes reachable here the release it ships, never by a second
+ * list kept in this file.
+ */
+const BUNDLED_GUIDE_NAMES = agent_guides_json_1.default.index.guides;
+function describeGuideRedirect(config, parts) {
+    if (parts.length !== 2 || parts[1].toLowerCase() !== 'guide')
+        return null;
+    // `skrr guide` itself must exist, and a real `<topic> guide` command answers for itself.
+    if (config.findCommand('guide') === undefined)
+        return null;
+    const typed = parts[0].toLowerCase();
+    const guide = BUNDLED_GUIDE_NAMES.find((entry) => entry.id === typed || (entry.aliases ?? []).includes(typed));
+    if (!guide)
+        return null;
+    const read = `${config.bin} guide ${guide.id}`;
+    return {
+        message: `\`${config.bin} ${parts.join(' ')}\` is not a command; ` +
+            `guides are read through \`${config.bin} guide\`.`,
+        fix: `  \`${read}\` — the ${guide.id} guide`,
+        suggestions: [read],
+    };
+}
 function describeIntentMiss(config, parts) {
     // An installed command (even one whose module cannot load) always owns its name.
     const known = [...config.commandIDs, ...config.topicNames];
@@ -285,8 +405,8 @@ function helpSubjectId(tokens, config) {
     return taken.join(':');
 }
 /** The text form: exactly what a miss has always printed. */
-function describeCommandMiss(config, id) {
-    const miss = analyzeCommandMiss(config, id);
+function describeCommandMiss(config, id, typedWords) {
+    const miss = analyzeCommandMiss(config, id, typedWords);
     return miss.fix ? `${miss.message}\n${miss.fix}` : miss.message;
 }
 /**
@@ -301,13 +421,19 @@ function describeCommandMiss(config, id) {
  *     suggest the nearest siblings under the same topic before falling back to
  *     the whole command list.
  */
-function analyzeCommandMiss(config, id) {
+function analyzeCommandMiss(config, id, typedWords) {
     const parts = String(id ?? '')
         .split(':')
         .filter(Boolean);
+    const taskRedirect = describeTaskCommandRedirect(config, parts, typedWords ?? parts);
+    if (taskRedirect)
+        return taskRedirect;
     const intent = describeIntentMiss(config, parts);
     if (intent)
         return intent;
+    const guideRedirect = describeGuideRedirect(config, parts);
+    if (guideRedirect)
+        return guideRedirect;
     for (let take = parts.length - 1; take >= 1; take -= 1) {
         const found = config.findCommand(parts.slice(0, take).join(':'));
         if (!found)
@@ -514,7 +640,7 @@ function typedCommandWords(id, rawArgv) {
  * the report found it.
  */
 function commandMissEnvelope(config, id, words) {
-    const miss = analyzeCommandMiss(config, id);
+    const miss = analyzeCommandMiss(config, id, words);
     return {
         ok: false,
         error: {

package/dist/lib/guide-pointer.d.ts

@@ -0,0 +1,15 @@
+/** The one section a refusal code points at, plus the command that reads it. */
+export interface AgentGuidePointer {
+    id: string;
+    section: string;
+    /** `skrr guide <id> <section>` — what the `Guide:` line and `error.guide.command` carry. */
+    command: string;
+}
+/**
+ * The pointer for a refusal code: `{id, section, command}`, or `null` when no
+ * section explains it, the error carries no code, or the bundled vocabulary is
+ * unavailable. Never throws.
+ */
+export declare function agentGuidePointerFor(code: string | null | undefined): AgentGuidePointer | null;
+/** The `Guide:` line a refusal's human text ends with. */
+export declare function agentGuidePointerLine(pointer: AgentGuidePointer): string;

package/dist/lib/guide-pointer.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentGuidePointerFor = agentGuidePointerFor;
+exports.agentGuidePointerLine = agentGuidePointerLine;
+/**
+ * Agent guides — the pointer a refusal carries (OSK-17977).
+ *
+ * The cheapest moment to teach is the moment something goes wrong. A section's
+ * manifest entry declares the refusal codes it `explains`; the server registry
+ * enforces that each code has exactly one section. The CLI resolves the same
+ * table OFFLINE, from its bundled copy (`generated/agent-guides.json`), so a
+ * refusal that never reached the server — and one on a CLI that cannot reach
+ * it at all — still names the section that explains it.
+ *
+ * The lookup is deliberately fragile-proof: error rendering runs this on every
+ * failure, including inside test harnesses that swap `@skrr-ai/data-provider`
+ * for a partial mock. A pointer is advisory — it must never be the reason a
+ * refusal fails to render.
+ */
+const data_provider_1 = require("@skrr-ai/data-provider");
+const agent_guides_json_1 = __importDefault(require("../generated/agent-guides.json"));
+const catalog = agent_guides_json_1.default.index?.guides ?? [];
+/**
+ * The pointer for a refusal code: `{id, section, command}`, or `null` when no
+ * section explains it, the error carries no code, or the bundled vocabulary is
+ * unavailable. Never throws.
+ */
+function agentGuidePointerFor(code) {
+    if (typeof code !== 'string' || !code)
+        return null;
+    try {
+        const address = (0, data_provider_1.findAgentGuideSectionExplaining)(catalog, code);
+        if (!address?.section)
+            return null;
+        return {
+            id: address.id,
+            section: address.section,
+            command: (0, data_provider_1.agentGuideReadCommand)(address, 'cli'),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** The `Guide:` line a refusal's human text ends with. */
+function agentGuidePointerLine(pointer) {
+    return `Guide: ${pointer.command}`;
+}

package/dist/lib/lookbackPlans.d.ts

@@ -1,4 +1,4 @@
-import { lookbackPlansApi, isLookbackMutationOutcomeUnknown, type CreateLookbackPlanRequest, type LookbackPlan, type LookbackPlanInput } from '@skrr-ai/data-provider';
+import { lookbackPlansApi, isLookbackMutationOutcomeUnknown, type CreateLookbackPlanRequest, type LookbackPlan, type LookbackPlanInput, type LookbackPlansScope } from '@skrr-ai/data-provider';
 export { lookbackPlansApi, isLookbackMutationOutcomeUnknown };
 export declare function lookbackInputFailure(error: unknown): {
     code: "LOOKBACK_INVALID_FIELD" | "LOOKBACK_INVALID_TIME" | "LOOKBACK_INVALID_TIMEZONE" | "LOOKBACK_AMBIGUOUS_TIME" | "LOOKBACK_NONEXISTENT_TIME" | "LOOKBACK_LIMIT_EXCEEDED";
@@ -46,3 +46,5 @@ export declare function lookbackArmingLine(result: {
     reused?: boolean;
     armed: boolean;
 }): string;
+/** An empty list is only "none" for the workspace it looked in: name it (OSK-17930). */
+export declare function lookbackPlansEmptyMessage(scope?: LookbackPlansScope): string;

package/dist/lib/lookbackPlans.js

@@ -7,6 +7,7 @@ exports.lookbackCreateBody = lookbackCreateBody;
 exports.lookbackInput = lookbackInput;
 exports.lookbackPlanSummary = lookbackPlanSummary;
 exports.lookbackArmingLine = lookbackArmingLine;
+exports.lookbackPlansEmptyMessage = lookbackPlansEmptyMessage;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 Object.defineProperty(exports, "lookbackPlansApi", { enumerable: true, get: function () { return data_provider_1.lookbackPlansApi; } });
@@ -119,3 +120,11 @@ function lookbackArmingLine(result) {
     const status = result.armed ? 'armed' : 'saved; scheduling is pending';
     return `Lookback plan ${result.plan.id} ${status}${result.reused ? ' (existing plan)' : ''}.`;
 }
+/** An empty list is only "none" for the workspace it looked in: name it (OSK-17930). */
+function lookbackPlansEmptyMessage(scope) {
+    if (!scope)
+        return 'No lookback plans.';
+    if (!scope.workspaceId)
+        return "No lookback plans in no workspace (use --workspace to read a workspace's plans).";
+    return `No lookback plans in workspace ${scope.workspaceId}${scope.source === 'default' ? ' (your default; use --workspace to read another)' : ''}.`;
+}

package/dist/lib/node-adapter.js

@@ -16,6 +16,7 @@ const dpop_auth_1 = require("./dpop-auth");
 const refresh_1 = require("./refresh");
 const delegated_cli_1 = require("./delegated-cli");
 const workspace_header_1 = require("./workspace-header");
+const task_runtime_headers_1 = require("./task-runtime-headers");
 const non_json_response_1 = require("./non-json-response");
 require("./auth-core-init");
 const rate_limit_retry_1 = require("./rate-limit-retry");
@@ -150,7 +151,8 @@ function createNodeAdapter(opts = {}) {
     /** The last 429's `Retry-After`, read off the response of the most recent attempt. */
     let lastRetryAfterMs;
     async function rawRequest(method, url, body, options, isFormData) {
-        const headers = buildHeaders(options?.headers);
+        const finalUrl = appendQuery(resolveUrl(url), options?.params);
+        const headers = (0, task_runtime_headers_1.withTaskRuntimeHeaders)(buildHeaders(options?.headers), finalUrl, method);
         let finalBody;
         if (body !== undefined && body !== null && method !== 'GET') {
             if (isFormData) {
@@ -162,12 +164,11 @@ function createNodeAdapter(opts = {}) {
                 finalBody = JSON.stringify(body);
             }
         }
-        const finalUrl = appendQuery(resolveUrl(url), options?.params);
         // OSK-12020 — a DPoP-bound hand-off token needs a fresh proof per request
         // (and per retry: proofs are single-use). No-op for every other token.
         Object.assign(headers, await (0, dpop_auth_1.dpopHeadersFor)(currentCredential().token, method, finalUrl));
         // E6: bounded retry on 429 for a GET or an idempotency-keyed write.
-        const { response, retryAfterMs } = await (0, rate_limit_retry_1.fetchWithRateLimitRetry)(() => fetch(finalUrl, { method, headers, body: finalBody }), { method, headers });
+        const { response, retryAfterMs } = await (0, rate_limit_retry_1.fetchWithRateLimitRetry)(() => fetch(finalUrl, { method, headers, body: finalBody, ...(0, task_runtime_headers_1.taskRuntimeRedirectOptions)(headers) }), { method, headers });
         lastRetryAfterMs = retryAfterMs;
         return response;
     }

package/dist/lib/outbox.d.ts

@@ -36,20 +36,6 @@ export interface OutboxEntry {
  * silently dropped.
  */
 export declare const MAX_REPLAY_ATTEMPTS = 10;
-/**
- * Derive a stable idempotency key from the write's own content.
- *
- * Content-derived rather than random, and that is the whole design: a random
- * key would make every replay of the SAME intent look like a new write, which
- * is exactly what the server-side dedupe exists to prevent. Hashing
- * (kind, scope, payload) means replaying the same comment collapses onto the
- * original, while a genuinely different comment on the same task hashes
- * differently and still posts.
- *
- * Truncated to 32 hex chars — comfortably collision-resistant for a per-user,
- * 24-hour dedupe window, and short enough to read in `skrr outbox list`.
- */
-export declare function idempotencyKeyFor(kind: string, scope: string, payload: string): string;
 export declare function isOutageFailure(err: unknown): boolean;
 export declare function isRetryableWrite(err: unknown): boolean;
 export declare function enqueueWrite(input: Omit<OutboxEntry, 'id' | 'queuedAt' | 'attempts'>, profile?: string): OutboxEntry;

package/dist/lib/outbox.js

@@ -34,7 +34,6 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_REPLAY_ATTEMPTS = void 0;
-exports.idempotencyKeyFor = idempotencyKeyFor;
 exports.isOutageFailure = isOutageFailure;
 exports.isRetryableWrite = isRetryableWrite;
 exports.enqueueWrite = enqueueWrite;
@@ -93,26 +92,6 @@ const crypto = __importStar(require("node:crypto"));
  * silently dropped.
  */
 exports.MAX_REPLAY_ATTEMPTS = 10;
-/**
- * Derive a stable idempotency key from the write's own content.
- *
- * Content-derived rather than random, and that is the whole design: a random
- * key would make every replay of the SAME intent look like a new write, which
- * is exactly what the server-side dedupe exists to prevent. Hashing
- * (kind, scope, payload) means replaying the same comment collapses onto the
- * original, while a genuinely different comment on the same task hashes
- * differently and still posts.
- *
- * Truncated to 32 hex chars — comfortably collision-resistant for a per-user,
- * 24-hour dedupe window, and short enough to read in `skrr outbox list`.
- */
-function idempotencyKeyFor(kind, scope, payload) {
-    const digest = crypto
-        .createHash('sha256')
-        .update(`${kind}\u0000${scope}\u0000${payload}`)
-        .digest('hex');
-    return `${kind}_${digest.slice(0, 32)}`;
-}
 /**
  * Per-profile queue directory.
  *

package/dist/lib/roles.d.ts

@@ -53,7 +53,7 @@ export declare const roleApi: {
                 config?: Record<string, unknown> | undefined;
             }[];
             sources: {
-                source: "space" | "tasks" | "email" | "goal" | "files" | "local" | "daemon" | "browser" | "conversations" | "slack" | "memory" | "github" | "messages" | "calendar" | "docs" | "metrics" | "agent_run" | "agent_initiatives" | "documents" | "product_metrics" | "business_metrics" | "state_monitor" | "monitor";
+                source: "space" | "tasks" | "memory" | "email" | "goal" | "files" | "local" | "daemon" | "browser" | "conversations" | "slack" | "github" | "messages" | "calendar" | "docs" | "metrics" | "agent_run" | "agent_initiatives" | "documents" | "product_metrics" | "business_metrics" | "state_monitor" | "monitor";
                 enabled: boolean;
                 config?: Record<string, unknown> | undefined;
             }[];

package/dist/lib/store-listing.d.ts

@@ -15,7 +15,12 @@ import { type ReleaseCapabilityManifestView, type StoreAgentInstallFunnelSummary
  *     "withheld" with the floor it missed, never as 0 — a zero is a claim that
  *     nobody did the thing, and the server did not make that claim.
  */
-/** A listing's price in token credits (1,000,000 = $1), as the Store states it. */
+/**
+ * A listing's price as the Store prints it — `$4.00`, or `Free`. The wire
+ * value is integer micro-USD (1,000,000 = $1); every store, skills and
+ * actions command prints through this one formatter so no surface can quote
+ * the same price in a different unit (OSK-18256).
+ */
 export declare function formatListingPrice(price: number | null | undefined): string;
 /** `4.6 ★ (12 ratings)`, or `No ratings yet` — never `0.0` for an unrated listing. */
 export declare function formatListingRating(rating: number | null | undefined, count: number | null | undefined): string;

package/dist/lib/store-listing.js

@@ -29,7 +29,12 @@ const data_provider_1 = require("@skrr-ai/data-provider");
  *     "withheld" with the floor it missed, never as 0 — a zero is a claim that
  *     nobody did the thing, and the server did not make that claim.
  */
-/** A listing's price in token credits (1,000,000 = $1), as the Store states it. */
+/**
+ * A listing's price as the Store prints it — `$4.00`, or `Free`. The wire
+ * value is integer micro-USD (1,000,000 = $1); every store, skills and
+ * actions command prints through this one formatter so no surface can quote
+ * the same price in a different unit (OSK-18256).
+ */
 function formatListingPrice(price) {
     return (0, data_provider_1.formatStoreAcquisitionPrice)(price);
 }

package/dist/lib/task-admission.js

@@ -6,14 +6,34 @@ function admissionLines(value) {
     if (!value)
         return ['Execution admission: not reported by this server.'];
     const lines = [`Approval prerequisites: ${value.state}.`];
+    const observation = value.runtimePolicyObservation;
     if (value.permission) {
-        lines.push(`Permission policy: ${value.permission.mode || 'inherited/unknown'} (${value.permission.source || 'source unavailable'}).`);
+        lines.push(!value.permission.mode &&
+            value.permission.source === 'daemon' &&
+            observation?.source !== 'not_applicable'
+            ? 'Permission override: inherit daemon (no Agent or Harness override).'
+            : `Permission policy: ${value.permission.mode || 'inherited/unknown'} (${value.permission.source || 'source unavailable'}).`);
+    }
+    const configured = observation?.configuredDefault;
+    if (observation ? observation.source !== 'not_applicable' : value.permission?.source === 'daemon') {
+        if (configured && observation?.source === 'daemon_registration') {
+            lines.push(`Daemon last reported configured default: ${configured.permissionMode} (${configured.provider}/${configured.engine}; process registration at ${observation.reportedAt}). This is not the future effective policy.`);
+        }
+        else {
+            lines.push('Daemon configured default: unreported. Check status on the selected machine and daemon profile; reconnect or update that daemon to refresh its report.');
+        }
+        if (value.taskCommandApproval?.support === 'reported') {
+            lines.push(`Exact Task-command approval protocol: reported (${value.taskCommandApproval.provider}/${value.taskCommandApproval.engine}). Run, owner and command readiness remain unverified; no command is authorized.`);
+        }
+        else {
+            lines.push('Exact Task-command approval protocol: unreported for the selected engine.');
+        }
     }
     if (value.workingDirectory) {
         lines.push(`Working directory: ${value.workingDirectory.path || 'daemon configured default'} (${value.workingDirectory.source}; existence and access are checked on the machine at start).`);
     }
     if (value.unattended && !value.approverAvailable) {
-        lines.push('This run is unattended. Tools that need approval cannot obtain it during the run.');
+        lines.push('This run is unattended; generic provider interactive approval is unavailable. Exact Task-command requests have a separate approval path when supported.');
     }
     for (const constraint of value.constraints || []) {
         if (constraint.message)
@@ -29,7 +49,9 @@ function isAdmissionPreview(value) {
         return false;
     const row = value;
     const admission = row.executionAdmission;
-    return row.dryRun === true && typeof row.taskId === 'string' && Boolean(admission &&
-        ['ready', 'blocked', 'unknown'].includes(String(admission.state)) &&
-        admission.scope === 'approval_prerequisites');
+    return (row.dryRun === true &&
+        typeof row.taskId === 'string' &&
+        Boolean(admission &&
+            ['ready', 'blocked', 'unknown'].includes(String(admission.state)) &&
+            admission.scope === 'approval_prerequisites'));
 }

package/dist/lib/task-batch.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Domain lib for `POST|PATCH /api/tasks/batch` (docs/architecture/task-batch-api-2026-10-08.md).
+ *
+ * `tasks create-tree` and `tasks bulk-update` reach the batch routes through
+ * `dataService.createTasksBatch|updateTasksBatch` and nothing else. This file owns
+ * the parts a command should not restate: chunking at the server cap, a
+ * tempId translation, and the "this server has no batch route" signal that
+ * sends a command back to its serial path. The shared transport owns each
+ * request's fresh idempotency key.
+ */
 import { type TaskBatchItemResult, type TaskBatchPatchItem } from '@skrr-ai/data-provider';
 export type ApiFailure = {
     message: string;
@@ -16,13 +26,6 @@ export declare function describeApiFailure(err: unknown): ApiFailure;
  */
 export declare function isBatchRouteMissing(err: unknown): boolean;
 export declare function chunkItems<T>(items: T[], size?: number): T[][];
-/**
- * Same chunk, same key: a retry of an interrupted command replays the stored
- * result instead of creating twice. The key is a fingerprint of the items, so a
- * DIFFERENT chunk can never collide with it (the server answers 422 on a key
- * reused with a different body).
- */
-export declare function batchIdempotencyKey(kind: 'create' | 'patch', items: unknown[]): string;
 export type BatchCreateNode = {
     key: string;
     parentKey?: string;

package/dist/lib/task-batch.js

@@ -4,7 +4,6 @@ exports.batchRetryPolicy = void 0;
 exports.describeApiFailure = describeApiFailure;
 exports.isBatchRouteMissing = isBatchRouteMissing;
 exports.chunkItems = chunkItems;
-exports.batchIdempotencyKey = batchIdempotencyKey;
 exports.reconcileSubmittedNodes = reconcileSubmittedNodes;
 exports.createNodesViaBatch = createNodesViaBatch;
 exports.patchTasksViaBatch = patchTasksViaBatch;
@@ -14,10 +13,10 @@ exports.patchTasksViaBatch = patchTasksViaBatch;
  * `tasks create-tree` and `tasks bulk-update` reach the batch routes through
  * `dataService.createTasksBatch|updateTasksBatch` and nothing else. This file owns
  * the parts a command should not restate: chunking at the server cap, a
- * deterministic idempotency key per chunk, tempId translation, and the "this
- * server has no batch route" signal that sends a command back to its serial path.
+ * tempId translation, and the "this server has no batch route" signal that
+ * sends a command back to its serial path. The shared transport owns each
+ * request's fresh idempotency key.
  */
-const node_crypto_1 = require("node:crypto");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const tasks_1 = require("./tasks");
 /** Normalize a thrown API error (or a per-item batch error) into one shape. */
@@ -60,16 +59,6 @@ function chunkItems(items, size = data_provider_1.TASK_BATCH_MAX_ITEMS ?? 100) {
         out.push(items.slice(i, i + size));
     return out;
 }
-/**
- * Same chunk, same key: a retry of an interrupted command replays the stored
- * result instead of creating twice. The key is a fingerprint of the items, so a
- * DIFFERENT chunk can never collide with it (the server answers 422 on a key
- * reused with a different body).
- */
-function batchIdempotencyKey(kind, items) {
-    const digest = (0, node_crypto_1.createHash)('sha256').update((0, data_provider_1.stableJson)(items)).digest('hex').slice(0, 40);
-    return `cli-${kind}-batch:${digest}`;
-}
 /** A lost response is not a lost write. Only READ here; never retry a write. */
 async function reconcileSubmittedNodes(nodes, mapping, error, deadlineAt = Date.now() + 5000) {
     const rows = [];
@@ -316,9 +305,7 @@ async function createNodesViaBatch(nodes, mapping, options = {}) {
         let response;
         try {
             options.onSubmit?.(sent);
-            response = await data_provider_1.dataService.createTasksBatch(items, {
-                idempotencyKey: batchIdempotencyKey('create', items),
-            });
+            response = await data_provider_1.dataService.createTasksBatch(items);
         }
         catch (err) {
             if (round === 1 && isBatchRouteMissing(err))
@@ -510,9 +497,7 @@ async function patchTasksViaBatch(updates) {
             continue;
         }
         try {
-            const response = await data_provider_1.dataService.updateTasksBatch(chunk, {
-                idempotencyKey: batchIdempotencyKey('patch', chunk),
-            });
+            const response = await data_provider_1.dataService.updateTasksBatch(chunk);
             for (const [i, result] of response.results.entries()) {
                 results.push({ ...result, index: offset + i });
             }

package/dist/lib/task-operations.d.ts

@@ -1,25 +1,13 @@
-/** Documentation and display paths only. The server still owns allowedActions. */
+/**
+ * Documentation and display paths only. The server still owns allowedActions.
+ *
+ * `skrr tasks guide`'s command map retired into the tasks guide's `commands`
+ * section (`skrr guide tasks commands`), the one copy every surface reads;
+ * what remains here is the action→command remedies preflight and
+ * actionability render into server-declared allowedActions.
+ */
 export declare function taskActionCommand(action: string, taskId: string, targetId: string | undefined, bin?: string, context?: {
     allowedActions?: ReadonlyArray<{
         action: string;
     }>;
 }): string | undefined;
-export declare function taskOperationsGuide(bin?: string): {
-    title: string;
-    sections: ({
-        title: string;
-        commands: {
-            command: string;
-            purpose: string;
-        }[];
-        note?: undefined;
-    } | {
-        title: string;
-        note: string;
-        commands: {
-            command: string;
-            purpose: string;
-        }[];
-    })[];
-};
-export declare function taskOperationsGuideLines(bin?: string): string[];