@skrr-ai/cli 0.1.117 → 0.1.119

package/dist/base-command.d.ts

@@ -32,6 +32,7 @@ export declare abstract class BaseCommand extends Command {
      * acquiring unrelated account authority. Human invocations are unaffected.
      */
     static autonomousCredentialPolicy: 'delegated' | 'bound-session';
+    static sessionReadPolicy?: 'memory-history-v1';
     /** Add the owning agent's web detail link without overwriting resource URLs. */
     protected withAgentContext<T>(agentId: string, value: T): T & {
         agentUrl: string | null;

package/dist/base-command.js

@@ -53,6 +53,7 @@ const cli_id_1 = require("./lib/cli-id");
 const keychain_2 = require("./lib/keychain");
 const outbox_1 = require("./lib/outbox");
 const node_adapter_1 = require("./lib/node-adapter");
+const memory_history_session_1 = require("./lib/memory-history-session");
 const migrate_1 = require("./lib/migrate");
 const auth_core_init_1 = require("./lib/auth-core-init");
 const credential_resolver_1 = require("./lib/credential-resolver");
@@ -125,6 +126,7 @@ class BaseCommand extends core_1.Command {
      * acquiring unrelated account authority. Human invocations are unaffected.
      */
     static autonomousCredentialPolicy = 'delegated';
+    static sessionReadPolicy;
     /** Add the owning agent's web detail link without overwriting resource URLs. */
     withAgentContext(agentId, value) {
         const agentUrl = (0, web_url_1.agentUrlFrom)(this.cliConfig.baseURL, { id: agentId });
@@ -292,7 +294,11 @@ class BaseCommand extends core_1.Command {
         // touching migration, Keychain/file auth, refresh, or daemon auto-broker
         // state. The restricted session token (or a null credential when it is
         // missing) is the only adapter authority exposed to the command.
-        let autonomousCredential = (0, credential_resolver_1.resolveTrustedAutonomousCredential)();
+        const historySession = this.constructor.sessionReadPolicy === 'memory-history-v1' &&
+            (0, memory_history_session_1.hasMemoryHistoryRuntime)() ? (0, memory_history_session_1.memoryHistorySession)() : null;
+        let autonomousCredential = historySession
+            ? { token: historySession.token, source: 'env-token', kind: (0, auth_core_1.classifyTokenKind)(historySession.token) }
+            : (0, credential_resolver_1.resolveTrustedAutonomousCredential)();
         const boundSessionCommand = Boolean(autonomousCredential &&
             this.constructor.autonomousCredentialPolicy === 'bound-session');
         if ((0, delegated_cli_1.isDelegatedCliSession)() && !boundSessionCommand) {

package/dist/commands/actions/browse.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const action_listings_1 = require("../../lib/action-listings");
+const usd_micros_1 = require("../../lib/usd-micros");
 class ActionsBrowse extends base_command_1.BaseCommand {
     static description = 'Browse public agent-action marketplace listings';
     static examples = [
@@ -39,7 +40,7 @@ class ActionsBrowse extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(response), null, 2));
             return;
         }
         (0, action_listings_1.renderActionListings)(response.data, (line) => this.log(line));

package/dist/commands/actions/install.d.ts

@@ -9,6 +9,7 @@ export default class ActionsInstall extends BaseCommand {
         agent: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'expected-price': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/actions/install.js

@@ -5,6 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const prompt_1 = require("../../lib/prompt");
 const agent_actions_1 = require("../../lib/agent-actions");
+const usd_micros_1 = require("../../lib/usd-micros");
 class ActionsInstall extends base_command_1.BaseCommand {
     static description = 'Install an action listing into an agent. A paid listing shows its price and asks you to confirm first.';
     static examples = [
@@ -22,6 +23,10 @@ class ActionsInstall extends base_command_1.BaseCommand {
             char: 'y',
             description: 'Confirm a paid install without prompting. The price is still printed.',
         }),
+        'expected-price': core_1.Flags.string({
+            description: 'Refuse unless the install would charge exactly this USD amount (e.g. 4 or 2.50; 0 pins free). ' +
+                'Use it to pin the price the person named, not just the one read now.',
+        }),
     };
     async run() {
         this.requireAuth();
@@ -44,6 +49,21 @@ class ActionsInstall extends base_command_1.BaseCommand {
             // server would actually charge, not the sticker price.
             charge = 0;
         }
+        // A caller-pinned price binds the install to what the PERSON named, not
+        // just to what this command read (OSK-18256 — same convention as
+        // `store install`).
+        const expectedMicros = (0, usd_micros_1.expectedPriceFlagMicros)(flags['expected-price']);
+        if (expectedMicros === null) {
+            this.error(`--expected-price must be a USD amount with at most 2 decimals, e.g. 4 or 2.50 (got "${flags['expected-price']}")`, { exit: 2 });
+        }
+        if (expectedMicros !== undefined && expectedMicros !== charge) {
+            this.failWithCliError({
+                message: (0, usd_micros_1.expectedPriceMismatchMessage)(expectedMicros, charge),
+                code: 'EXPECTED_PRICE_MISMATCH',
+                exit: 1,
+                retryable: false,
+            });
+        }
         if (charge > 0) {
             const name = listing.displayName || listing.name || args.id;
             // Printed before any prompt and even with --yes, so a scripted purchase
@@ -76,7 +96,7 @@ class ActionsInstall extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(response), null, 2));
             return;
         }
         this.log(response.alreadyInstalled

package/dist/commands/actions/list.js

@@ -5,6 +5,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const action_listings_1 = require("../../lib/action-listings");
+const usd_micros_1 = require("../../lib/usd-micros");
 class ActionsList extends base_command_1.BaseCommand {
     static description = 'List your agent-action marketplace listings';
     static examples = [
@@ -39,7 +40,7 @@ class ActionsList extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.printJsonResult((0, list_output_1.listResult)(response));
+            this.printJsonResult((0, list_output_1.listResult)((0, usd_micros_1.withUsdPrices)(response)));
             return;
         }
         (0, action_listings_1.renderActionListings)(response.data, (line) => this.log(line));

package/dist/commands/actions/show.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const action_listings_1 = require("../../lib/action-listings");
+const usd_micros_1 = require("../../lib/usd-micros");
 class ActionsShow extends base_command_1.BaseCommand {
     static description = 'Show an agent-action marketplace listing';
     static examples = [
@@ -27,7 +28,7 @@ class ActionsShow extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(listing, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(listing), null, 2));
             return;
         }
         (0, action_listings_1.renderActionListing)(listing, (line) => this.log(line));

package/dist/commands/memory/versions/list.d.ts

@@ -1,5 +1,7 @@
 import { ScopedMemoryCommand } from '../../../lib/scoped-memory-command';
 export default class MemoryVersionsList extends ScopedMemoryCommand {
+    static autonomousCredentialPolicy: "bound-session";
+    static sessionReadPolicy: "memory-history-v1";
     static description: string;
     static args: {
         memory: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;

package/dist/commands/memory/versions/list.js

@@ -4,14 +4,15 @@ const list_output_1 = require("../../../lib/list-output");
 const core_1 = require("@oclif/core");
 const scoped_memory_command_1 = require("../../../lib/scoped-memory-command");
 class MemoryVersionsList extends scoped_memory_command_1.ScopedMemoryCommand {
+    static autonomousCredentialPolicy = 'bound-session';
+    static sessionReadPolicy = 'memory-history-v1';
     static description = 'List immutable versions for one Memory topic';
     static args = { memory: core_1.Args.string({ required: true, ignoreStdin: true }) };
     static flags = { ...scoped_memory_command_1.scopedMemoryFlags, limit: core_1.Flags.integer({ default: 100 }) };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(MemoryVersionsList);
-        const store = await this.resolveStore(flags);
-        const result = await this.memoryApi(flags.agent, `/stores/${store.id}/versions${this.query(flags, { memoryId: args.memory, limit: flags.limit })}`);
+        const result = await this.memoryHistoryApi(flags, { memoryId: args.memory, limit: flags.limit });
         if (flags.json)
             return this.printJsonResult((0, list_output_1.listResult)(result, 'versions'));
         for (const version of result.versions)

package/dist/commands/memory/versions/show.d.ts

@@ -1,5 +1,7 @@
 import { ScopedMemoryCommand } from '../../../lib/scoped-memory-command';
 export default class MemoryVersionsShow extends ScopedMemoryCommand {
+    static autonomousCredentialPolicy: "bound-session";
+    static sessionReadPolicy: "memory-history-v1";
     static description: string;
     static args: {
         id: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;

package/dist/commands/memory/versions/show.js

@@ -3,14 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const scoped_memory_command_1 = require("../../../lib/scoped-memory-command");
 class MemoryVersionsShow extends scoped_memory_command_1.ScopedMemoryCommand {
+    static autonomousCredentialPolicy = 'bound-session';
+    static sessionReadPolicy = 'memory-history-v1';
     static description = 'Show one immutable MemoryVersion';
     static args = { id: core_1.Args.string({ required: true, ignoreStdin: true }) };
     static flags = scoped_memory_command_1.scopedMemoryFlags;
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(MemoryVersionsShow);
-        const store = await this.resolveStore(flags);
-        const result = await this.memoryApi(flags.agent, `/stores/${store.id}/versions/${encodeURIComponent(args.id)}${this.query(flags)}`);
+        const result = await this.memoryHistoryApi(flags, { versionId: args.id });
         this.print(result, flags.json, `${result.id}  ${result.operation}\n${JSON.stringify(result.payloadSnapshot, null, 2)}`);
     }
 }

package/dist/commands/skills/browse.js

@@ -6,6 +6,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
+const usd_micros_1 = require("../../lib/usd-micros");
 function skillBrowseDescription(skill) {
     const description = String(skill.description ?? '').trim();
     if (description && description !== '>' && description !== '|')
@@ -64,7 +65,7 @@ class SkillsBrowse extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(response), null, 2));
             return;
         }
         const r = response;

package/dist/commands/skills/details.js

@@ -4,6 +4,8 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const local_skills_1 = require("../../lib/local-skills");
+const store_listing_1 = require("../../lib/store-listing");
+const usd_micros_1 = require("../../lib/usd-micros");
 class SkillsDetails extends base_command_1.BaseCommand {
     static description = 'Show full details for a skill';
     static examples = [
@@ -49,7 +51,7 @@ class SkillsDetails extends base_command_1.BaseCommand {
             await this.failOnStoreMiss(err, args.id);
         }
         if (flags.json) {
-            this.log(JSON.stringify(skill, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(skill), null, 2));
             return;
         }
         const s = skill;
@@ -59,7 +61,7 @@ class SkillsDetails extends base_command_1.BaseCommand {
         this.log(`Author:       ${s.authorName ?? s.author ?? '-'}`);
         this.log(`Rating:       ${s.rating != null ? s.rating.toFixed(1) : '-'} (${s.ratingCount ?? 0} reviews)`);
         this.log(`Installs:     ${s.installCount ?? 0}`);
-        this.log(`Price:        ${s.price ? `${s.price} credits` : 'Free'}`);
+        this.log(`Price:        ${(0, store_listing_1.formatListingPrice)(typeof s.price === 'number' ? s.price : null)}`);
         this.log(`Public:       ${s.isPublic ? 'yes' : 'no'}`);
         this.log(`Created:      ${s.createdAt ?? '-'}`);
         if (s.description) {

package/dist/commands/skills/featured.js

@@ -5,6 +5,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
+const usd_micros_1 = require("../../lib/usd-micros");
 const browse_1 = require("./browse");
 function featuredSkillIndex(response, limit) {
     const envelope = response;
@@ -41,7 +42,7 @@ class SkillsFeatured extends base_command_1.BaseCommand {
         }
         const index = featuredSkillIndex(response, flags.limit);
         if (flags.json)
-            return void this.log(JSON.stringify(index, null, 2));
+            return void this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(index), null, 2));
         const items = index.data;
         if (items.length === 0) {
             this.log('No featured skills.');

package/dist/commands/skills/install.d.ts

@@ -10,6 +10,7 @@ export default class SkillsInstall extends BaseCommand {
         agent: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         service: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'expected-price': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     /** A store 404 for a name that may be a skill on the caller's machine. */
     private failOnStoreMiss;

package/dist/commands/skills/install.js

@@ -5,6 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const prompt_1 = require("../../lib/prompt");
 const local_skills_1 = require("../../lib/local-skills");
+const usd_micros_1 = require("../../lib/usd-micros");
 class SkillsInstall extends base_command_1.BaseCommand {
     static description = 'Install a skill from the store to a service (agent). A paid skill shows its price and asks you to confirm first.';
     static examples = [
@@ -31,6 +32,10 @@ class SkillsInstall extends base_command_1.BaseCommand {
             char: 'y',
             description: 'Confirm a paid install without prompting. The price is still printed.',
         }),
+        'expected-price': core_1.Flags.string({
+            description: 'Refuse unless the install would charge exactly this USD amount (e.g. 4 or 2.50; 0 pins free). ' +
+                'Use it to pin the price the person named, not just the one read now.',
+        }),
     };
     /** A store 404 for a name that may be a skill on the caller's machine. */
     async failOnStoreMiss(err, id) {
@@ -74,6 +79,21 @@ class SkillsInstall extends base_command_1.BaseCommand {
             return await this.failOnStoreMiss(err, args.id);
         }
         const charge = Number(listing.price) || 0;
+        // A caller-pinned price binds the install to what the PERSON named, not
+        // just to what this command read (OSK-18256 — same convention as
+        // `store install`).
+        const expectedMicros = (0, usd_micros_1.expectedPriceFlagMicros)(flags['expected-price']);
+        if (expectedMicros === null) {
+            this.error(`--expected-price must be a USD amount with at most 2 decimals, e.g. 4 or 2.50 (got "${flags['expected-price']}")`, { exit: 2 });
+        }
+        if (expectedMicros !== undefined && expectedMicros !== charge) {
+            this.failWithCliError({
+                message: (0, usd_micros_1.expectedPriceMismatchMessage)(expectedMicros, charge),
+                code: 'EXPECTED_PRICE_MISMATCH',
+                exit: 1,
+                retryable: false,
+            });
+        }
         if (charge > 0) {
             const name = listing.displayName || listing.name || args.id;
             // Printed before any prompt and even with --yes, so a scripted purchase
@@ -106,7 +126,7 @@ class SkillsInstall extends base_command_1.BaseCommand {
             return await this.failOnStoreMiss(err, args.id);
         }
         if (flags.json) {
-            this.log(JSON.stringify(result, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(result), null, 2));
             return;
         }
         const r = result;

package/dist/commands/skills/search.js

@@ -5,6 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
 const search_query_1 = require("../../lib/search-query");
+const usd_micros_1 = require("../../lib/usd-micros");
 class SkillsSearch extends base_command_1.BaseCommand {
     static description = 'Search skills in the skrr store by keyword (same as `search skills`)';
     static examples = [
@@ -53,7 +54,7 @@ class SkillsSearch extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(response), null, 2));
             return;
         }
         const r = response;

package/dist/commands/store/acquisitions/list.js

@@ -5,6 +5,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
 const store_acquisition_1 = require("../../../lib/store-acquisition");
+const usd_micros_1 = require("../../../lib/usd-micros");
 /**
  * Every purchase or install an agent asked to make for you, newest first
  * (OSK-13403). Before this, a request was only reachable by its id — one from
@@ -42,7 +43,7 @@ class StoreAcquisitionsList extends base_command_1.BaseCommand {
         }
         const requests = result?.requests ?? [];
         if (flags.json) {
-            this.printJsonResult((0, list_output_1.listResult)(result, 'requests'));
+            this.printJsonResult((0, list_output_1.listResult)((0, usd_micros_1.withUsdPrices)(result), 'requests'));
             return;
         }
         if (requests.length === 0) {

package/dist/commands/store/acquisitions/show.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
 const store_acquisition_1 = require("../../../lib/store-acquisition");
+const usd_micros_1 = require("../../../lib/usd-micros");
 /**
  * A purchase an agent asked to make, read from the server's stored request
  * (OSK-12240) — the same data the web approval card shows.
@@ -38,7 +39,7 @@ class StoreAcquisitionsShow extends base_command_1.BaseCommand {
             this.error('The purchase request could not be read.', { exit: 1 });
         }
         if (flags.json) {
-            this.log(JSON.stringify(request, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(request), null, 2));
             return;
         }
         for (const line of (0, store_acquisition_1.describeAcquisitionRequestLines)(request)) {

package/dist/commands/store/browse.js

@@ -4,6 +4,8 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
+const store_listing_1 = require("../../lib/store-listing");
+const usd_micros_1 = require("../../lib/usd-micros");
 class StoreBrowse extends base_command_1.BaseCommand {
     static description = 'Browse published agents in the store';
     static examples = [
@@ -63,7 +65,7 @@ class StoreBrowse extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(response), null, 2));
             return;
         }
         const r = response;
@@ -77,7 +79,7 @@ class StoreBrowse extends base_command_1.BaseCommand {
             name: String(a.name ?? '-'),
             // Price is a property of the LISTING, so it is read from the listing
             // row rather than from anything the agent carries.
-            price: a.price ? String(a.price) : 'free',
+            price: (0, store_listing_1.formatListingPrice)(typeof a.price === 'number' ? a.price : null),
             rating: a.rating ? `${Number(a.rating).toFixed(1)} (${a.ratingCount ?? 0})` : '-',
             installs: String(a.installCount ?? 0),
             author: String(a.authorName ?? '-'),

package/dist/commands/store/install.d.ts

@@ -12,6 +12,7 @@ export default class StoreInstall extends BaseCommand {
         'include-bootstrap': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'include-memory': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'expected-price': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'run-on': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'share-outcomes': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };

package/dist/commands/store/install.js

@@ -5,6 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const agent_ref_1 = require("../../lib/agent-ref");
 const prompt_1 = require("../../lib/prompt");
+const usd_micros_1 = require("../../lib/usd-micros");
 /**
  * One line per placement, said the same way the web install rail says it: the
  * difference is whether a stranger's instructions may reach a connected
@@ -23,6 +24,7 @@ class StoreInstall extends base_command_1.BaseCommand {
         '<%= config.bin %> store install agent_abc123 --run-on local',
         '<%= config.bin %> store install agent_abc123 --share-outcomes',
         '<%= config.bin %> store install agent_abc123 --yes --json',
+        '<%= config.bin %> store install agent_abc123 --yes --expected-price 4',
     ];
     static args = {
         agent: core_1.Args.string({
@@ -45,6 +47,10 @@ class StoreInstall extends base_command_1.BaseCommand {
             char: 'y',
             description: 'Confirm a paid purchase without prompting. The price and refund terms are still printed.',
         }),
+        'expected-price': core_1.Flags.string({
+            description: 'Refuse unless the purchase would charge exactly this USD amount (e.g. 4 or 2.50; 0 pins free). ' +
+                'Use it to pin the price the person named, not just the one read now.',
+        }),
         'run-on': core_1.Flags.string({
             description: 'Where its tools may run. cloud (the default) keeps tools off connected machines; ' +
                 'local lets tools use an available connected machine in your account, selected at run time. The agent runs in the cloud either way',
@@ -121,6 +127,21 @@ class StoreInstall extends base_command_1.BaseCommand {
             });
         }
         const charge = Number(quote.charge) || 0;
+        // A caller-pinned price binds the purchase to what the PERSON named, not
+        // just to what this command read: a listing that moved, or a pin that
+        // never matched, refuses here before anything is charged (OSK-18256).
+        const expectedMicros = (0, usd_micros_1.expectedPriceFlagMicros)(flags['expected-price']);
+        if (expectedMicros === null) {
+            this.error(`--expected-price must be a USD amount with at most 2 decimals, e.g. 4 or 2.50 (got "${flags['expected-price']}")`, { exit: 2 });
+        }
+        if (expectedMicros !== undefined && expectedMicros !== charge) {
+            this.failWithCliError({
+                message: (0, usd_micros_1.expectedPriceMismatchMessage)(expectedMicros, charge),
+                code: 'EXPECTED_PRICE_MISMATCH',
+                exit: 1,
+                retryable: false,
+            });
+        }
         if (charge > 0) {
             const name = quote.listingName || agentId;
             const version = quote.versionLabel ? ` v${quote.versionLabel}` : '';
@@ -134,8 +155,11 @@ class StoreInstall extends base_command_1.BaseCommand {
             this.logToStderr(`  Buyer terms:  ${quote.buyerTerms
                 ? `${quote.buyerTerms.termsVersion} — ${quote.buyerTerms.artifactUri}`
                 : 'not configured'}`);
+            // This path records no acceptance — answering yes buys only. Without a
+            // prior acceptance the server refuses MARKETPLACE_TERMS_ACCEPTANCE_REQUIRED.
+            this.logToStderr('  Buying requires those terms already accepted; a yes here does not accept them.');
             this.logToStderr(`  Offer:        ${quote.offerVersionId}`);
-            const confirmed = await (0, prompt_1.confirmDestructive)(`Buy ${name} for ${(0, data_provider_1.formatStoreAcquisitionPrice)(charge)} and accept the buyer terms?`, flags.yes).catch((err) => this.error(err.message, { exit: err.exit ?? 1 }));
+            const confirmed = await (0, prompt_1.confirmDestructive)(`Buy ${name} for ${(0, data_provider_1.formatStoreAcquisitionPrice)(charge)}?`, flags.yes).catch((err) => this.error(err.message, { exit: err.exit ?? 1 }));
             if (!confirmed) {
                 this.log('Cancelled. Nothing was bought.');
                 return;
@@ -168,7 +192,7 @@ class StoreInstall extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(response), null, 2));
             return;
         }
         const installedId = response?.installedAgentId;

package/dist/commands/store/releases.js

@@ -4,6 +4,8 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
+const store_listing_1 = require("../../lib/store-listing");
+const usd_micros_1 = require("../../lib/usd-micros");
 /**
  * What versions of a published agent exist.
  *
@@ -34,7 +36,7 @@ class StoreReleases extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(response), null, 2));
             return;
         }
         const items = response?.data ?? [];
@@ -45,7 +47,7 @@ class StoreReleases extends base_command_1.BaseCommand {
         (0, format_1.renderTable)(items.map((r) => ({
             id: String(r.id ?? '-'),
             version: String(r.versionLabel ?? '-'),
-            price: r.price ? String(r.price) : 'free',
+            price: (0, store_listing_1.formatListingPrice)(typeof r.price === 'number' ? r.price : null),
             published: r.publishedAt ? String(r.publishedAt).slice(0, 10) : '-',
             changelog: String(r.changelog ?? ''),
         })), [

package/dist/commands/store/show.js

@@ -6,6 +6,7 @@ const base_command_1 = require("../../base-command");
 const agent_ref_1 = require("../../lib/agent-ref");
 const format_1 = require("../../lib/format");
 const store_listing_1 = require("../../lib/store-listing");
+const usd_micros_1 = require("../../lib/usd-micros");
 const web_url_1 = require("../../lib/web-url");
 /** How many releases the detail view lists; `store releases` lists them all. */
 const RECENT_RELEASES = 5;
@@ -88,7 +89,7 @@ class StoreShow extends base_command_1.BaseCommand {
         const listingUrl = (0, web_url_1.webUrl)(this.cliConfig.baseURL, { kind: 'storeListing', agentId });
         const releaseRows = (releases.value?.data ?? []).slice(0, RECENT_RELEASES);
         if (flags.json) {
-            this.log(JSON.stringify({
+            this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)({
                 agent: listing,
                 publisher: {
                     handle,
@@ -102,7 +103,7 @@ class StoreShow extends base_command_1.BaseCommand {
                 ...(releases.error ? { releasesError: releases.error } : {}),
                 url: listingUrl,
                 installCommand,
-            }, null, 2));
+            }), null, 2));
             return;
         }
         const version = listing.versionLabel ? `v${listing.versionLabel}` : 'no version label';

package/dist/commands/store/tip.js

@@ -42,12 +42,12 @@ class StoreTip extends base_command_1.BaseCommand {
         try {
             const result = await data_provider_1.dataService.tipStoreAgent(args.agentId, { amountMicros, tipId });
             if (flags.json) {
-                this.log(JSON.stringify(result, null, 2));
+                this.log(JSON.stringify((0, usd_micros_1.withUsdPrices)(result), null, 2));
                 return;
             }
             this.log(result.replayed
                 ? `Already tipped under ${tipId}; nothing new was charged.`
-                : `Tipped $${(result.amountMicros / 1_000_000).toFixed(2)} (tip ${tipId}).`);
+                : `Tipped ${(0, data_provider_1.formatStoreAcquisitionPrice)(result.amountMicros)} (tip ${tipId}).`);
         }
         catch (err) {
             this.handleApiError(err);