@skrr-ai/cli 0.1.119 → 0.1.120

package/dist/commands/store/governance/publish-release.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const base_command_1 = require("../../../base-command");
 const governed_store_1 = require("../../../lib/governed-store");
 const commerce_command_1 = require("../../../lib/commerce-command");
+const core_1 = require("@oclif/core");
 /**
  * Publish one artifact release into the governed catalogue (admin).
  *
@@ -15,11 +16,39 @@ class StoreGovernancePublishRelease extends base_command_1.BaseCommand {
     static examples = [
         '<%= config.bin %> store governance publish-release --file ./release.json',
     ];
-    static flags = { ...commerce_command_1.jsonBodyFlags };
+    static flags = {
+        ...commerce_command_1.jsonBodyFlags,
+        'release-id': core_1.Flags.string({
+            description: 'Stable release identity for this exact evidence bundle; reuse it only for recovery inspection or retry',
+        }),
+        'expected-source-revision': core_1.Flags.string({
+            description: 'Reviewed source revision; reject publication if a source-bound artifact changed',
+        }),
+    };
     async run() {
         this.requireAuth();
         const { flags } = await this.parse(StoreGovernancePublishRelease);
         const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        if (flags['release-id'] && body.releaseId && body.releaseId !== flags['release-id']) {
+            this.error('--release-id must match releaseId in the reviewed file when both are present.', { exit: 2 });
+            return;
+        }
+        if (flags['expected-source-revision'] &&
+            body.expectedSourceRevision &&
+            body.expectedSourceRevision !== flags['expected-source-revision']) {
+            this.error('--expected-source-revision must match the reviewed file when both are present.', { exit: 2 });
+            return;
+        }
+        if (flags['release-id'])
+            body.releaseId = flags['release-id'];
+        if (flags['expected-source-revision'])
+            body.expectedSourceRevision = flags['expected-source-revision'];
+        if (typeof body.releaseId !== 'string' || !body.releaseId.trim()) {
+            this.error('A reviewed releaseId is required so an ambiguous publication can be inspected safely.', {
+                exit: 2,
+            });
+            return;
+        }
         let result;
         try {
             result = await (0, governed_store_1.publishGovernedStoreRelease)(body);

package/dist/commands/store/governance/release-receipt.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base-command';
+/** Admin-only read path for an immutable governed-release receipt. */
+export default class StoreGovernanceReleaseReceipt extends BaseCommand {
+    static description: string;
+    static args: {
+        releaseId: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/release-receipt.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/** Admin-only read path for an immutable governed-release receipt. */
+class StoreGovernanceReleaseReceipt extends base_command_1.BaseCommand {
+    static description = 'Read one immutable governed Store release receipt';
+    static args = {
+        releaseId: core_1.Args.string({ required: true, ignoreStdin: true, description: 'Store release ID' }),
+    };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernanceReleaseReceipt);
+        try {
+            const result = await (0, governed_store_1.getGovernedStoreReleaseReceipt)(args.releaseId);
+            if (flags.json)
+                this.printJsonResult(result);
+            else {
+                const execution = result.execution;
+                const receipt = execution?.receipt;
+                this.log(`Release ${result.releaseId}: ${String(receipt?.state || 'unknown')}`);
+                this.log(`Operation: ${String(execution?.operationId || 'unavailable')}`);
+            }
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+}
+exports.default = StoreGovernanceReleaseReceipt;

package/dist/commands/tasks/approvals/list.d.ts

@@ -30,10 +30,16 @@ export declare function approvalRow(a: Record<string, unknown>): {
  * on an older run that a later run got past is history, not the current state.
  */
 export declare function permissionBlockedRun(runs: Array<Record<string, unknown>>): Record<string, unknown> | null;
-/** One refused call: the tool and its input, as the run recorded them. */
+/**
+ * One refused call. The server keeps the refused input (a command line, a
+ * path) in the run transcript only, so the run record says whether one was
+ * recorded (`inputRecorded`) and carries `input` itself only when talking to a
+ * server that still returns it.
+ */
 export type PermissionRefusal = {
     tool: string | null;
-    input: string;
+    input: string | null;
+    inputRecorded: boolean;
 };
 /** One way forward, as a command a person or a script can run. */
 export type PermissionBlockRemedy = {
@@ -53,9 +59,9 @@ export type BlockedRunSummary = {
     reason: string | null;
     agentId: string | null;
     /**
-     * The refused calls with their inputs. Empty when the run recorded none
-     * (runs finalized before the server kept them, or evidence without an input
-     * preview). Never inferred.
+     * The refused calls: the tool, and the input when the server returns it.
+     * Empty when the run recorded none (runs finalized before the server kept
+     * them, or evidence without an input preview). Never inferred.
      */
     refused: PermissionRefusal[];
     remedies: PermissionBlockRemedy[];

package/dist/commands/tasks/approvals/list.js

@@ -67,10 +67,15 @@ function refusalsOf(run) {
     for (const entry of raw) {
         if (!entry || typeof entry !== 'object')
             continue;
-        const { tool, input } = entry;
-        if (typeof input !== 'string' || !input.trim())
+        const { tool, input, inputRecorded } = entry;
+        const text = typeof input === 'string' && input.trim() ? input.trim() : null;
+        if (text === null && inputRecorded !== true)
             continue;
-        out.push({ tool: typeof tool === 'string' && tool ? tool : null, input: input.trim() });
+        out.push({
+            tool: typeof tool === 'string' && tool ? tool : null,
+            input: text,
+            inputRecorded: true,
+        });
     }
     return out;
 }
@@ -117,7 +122,7 @@ function blockedRunSummary(run, bin = 'skrr', taskRef = '<task-id>') {
         ],
     };
 }
-const SHELL_TOOL = /^(bash|shell|local_shell|exec_command|commandexecution|command_execution)$/i;
+const SHELL_TOOL = /^(bash|shell|shell_command|local_shell|exec_command|commandexecution|command_execution)$/i;
 function toolLabel(tool) {
     if (!tool)
         return '';
@@ -135,8 +140,10 @@ function permissionBlockLines(run, bin = 'skrr', taskRef = '<task-id>') {
     // The sentence already quotes a lone refused input (shortened); list an
     // input only when the sentence does not already show it.
     const refusedLines = summary.refused
-        .filter((refusal) => !reason.includes(refusal.input.slice(0, 60)))
-        .map((refusal) => `  Refused: ${refusal.input}${toolLabel(refusal.tool)}`);
+        .filter((refusal) => refusal.input === null || !reason.includes(refusal.input.slice(0, 60)))
+        .map((refusal) => refusal.input === null
+        ? `  Refused: a call${toolLabel(refusal.tool)}; its input is kept in the run transcript`
+        : `  Refused: ${refusal.input}${toolLabel(refusal.tool)}`);
     const [chat, update, restart] = summary.remedies;
     return [
         `The latest run (${summary.runId}) is blocked on a permission, not on an approval request.`,

package/dist/commands/tasks/attachments/facts.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base-command';
+export default class TasksAttachmentsFacts extends BaseCommand {
+    static description: string;
+    static args: {
+        task: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        attachment: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tasks/attachments/facts.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const api_fetch_1 = require("../../../lib/api-fetch");
+const session_task_write_1 = require("../../../lib/session-task-write");
+class TasksAttachmentsFacts extends base_command_1.BaseCommand {
+    static description = 'Read literal declarations from an exact JSON attachment; never follows referenced files';
+    static args = {
+        task: core_1.Args.string({ required: true, ignoreStdin: true }),
+        attachment: core_1.Args.string({ required: true, ignoreStdin: true }),
+    };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output source facts JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args } = await this.parse(TasksAttachmentsFacts);
+        try {
+            const session = await (0, session_task_write_1.sessionTaskWrite)('attachment', args.task);
+            const task = session?.taskId || (await this.resolveEntityRef('task', args.task));
+            const prefix = session?.path || `/api/tasks/${encodeURIComponent(task)}/attachments`;
+            const facts = await (0, api_fetch_1.apiFetch)(`${prefix}/${encodeURIComponent(args.attachment)}/source-facts`, session ? { credential: session.credential } : undefined);
+            this.printJsonResult(facts);
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+}
+exports.default = TasksAttachmentsFacts;

package/dist/commands/tasks/attachments/upload.d.ts

@@ -8,6 +8,7 @@ export default class TasksAttachmentsUpload extends BaseCommand {
     static flags: {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         file: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'resume-attachment': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         role: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;

package/dist/commands/tasks/attachments/upload.js

@@ -16,6 +16,9 @@ class TasksAttachmentsUpload extends base_command_1.BaseCommand {
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         file: core_1.Flags.string({ description: 'Path to the file to upload', required: true }),
+        'resume-attachment': core_1.Flags.string({
+            description: 'Resume this exact existing multipart attachment with the same file. Creates no replacement upload.',
+        }),
         role: core_1.Flags.string({
             description: 'Asset role: evidence (supports an Update/Result), deliverable (the media is the product), or input (forwarded into every future Run — only a person may add one; a person promotes an agent upload with `attachments set-role`). Defaults to evidence when an agent uploads, input when a person does.',
             options: ['input', 'evidence', 'deliverable'],
@@ -34,9 +37,22 @@ class TasksAttachmentsUpload extends base_command_1.BaseCommand {
                 taskId: taskRef,
                 filePath: flags.file,
                 role: flags.role,
+                ...(flags['resume-attachment'] !== undefined ? { resumeAttachmentId: flags['resume-attachment'] } : {}),
             });
         }
         catch (err) {
+            const recovery = (0, task_asset_upload_1.taskAssetUploadRecovery)(err);
+            if (recovery) {
+                const failure = err;
+                this.failWithCliError({
+                    message: failure.message,
+                    code: failure.code || 'TASK_ASSET_UPLOAD_INCOMPLETE',
+                    status: failure.status,
+                    retryable: false,
+                    exit: 1,
+                    details: { upload: recovery, suggestion: 'Resume this attachment with --resume-attachment and the same --file after resolving the reported failure.' },
+                });
+            }
             this.handleApiError(err);
         }
         if (flags.json) {

package/dist/commands/tasks/bulk-update.js

@@ -7,6 +7,7 @@ const web_url_1 = require("../../lib/web-url");
 const prompt_1 = require("../../lib/prompt");
 const dry_run_plans_1 = require("../../lib/dry-run-plans");
 const task_batch_1 = require("../../lib/task-batch");
+const space_write_policy_1 = require("../../lib/space-write-policy");
 const write_target_1 = require("../../lib/write-target");
 const tasks_1 = require("../../lib/tasks");
 class TasksBulkUpdate extends base_command_1.BaseCommand {
@@ -117,6 +118,17 @@ class TasksBulkUpdate extends base_command_1.BaseCommand {
                 let task = null;
                 if (Object.keys(row.patch).length > 0) {
                     const batched = batchByRow.get(index);
+                    // Held for approval by the Space write policy (OSK-17988): this row
+                    // changed nothing yet, and its status move is not sent on top of it.
+                    if (usedBatch && batched?.status === 'pending_approval') {
+                        results.push({
+                            id: row.id,
+                            ok: true,
+                            status: 'pending_approval',
+                            proposal: batched.proposal,
+                        });
+                        continue;
+                    }
                     if (usedBatch && batched) {
                         if (!batched.ok) {
                             throw Object.assign(new Error(batched.error?.message ?? 'Update failed'), {
@@ -138,6 +150,15 @@ class TasksBulkUpdate extends base_command_1.BaseCommand {
                             taskId: row.id,
                             data: row.patch,
                         });
+                        if ((0, space_write_policy_1.isSpaceWritePendingResponse)(task)) {
+                            results.push({
+                                id: row.id,
+                                ok: true,
+                                status: 'pending_approval',
+                                proposal: task.proposal,
+                            });
+                            continue;
+                        }
                     }
                 }
                 if (row.status !== undefined) {
@@ -151,6 +172,15 @@ class TasksBulkUpdate extends base_command_1.BaseCommand {
                         taskId: row.id,
                         status: row.status,
                     });
+                    if ((0, space_write_policy_1.isSpaceWritePendingResponse)(task)) {
+                        results.push({
+                            id: row.id,
+                            ok: true,
+                            status: 'pending_approval',
+                            proposal: task.proposal,
+                        });
+                        continue;
+                    }
                 }
                 if (!task) {
                     task = await data_provider_1.dataService.getTask(row.id, { enrich: false });
@@ -202,7 +232,11 @@ class TasksBulkUpdate extends base_command_1.BaseCommand {
         else {
             this.log(`Bulk update complete: ${summary.succeeded}/${summary.requested} succeeded, ${summary.failed} failed.`);
             for (const result of results) {
-                if (result.ok) {
+                if (result.status === 'pending_approval') {
+                    const proposal = result.proposal;
+                    this.log(`- held for approval ${result.id}: nothing changed yet (bundle ${proposal?.id}, item ${proposal?.itemId})`);
+                }
+                else if (result.ok) {
                     this.log(`- updated ${(0, tasks_1.formatTaskLabel)(result.task)}`);
                 }
                 else {

package/dist/commands/tasks/context.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base-command';
+/** Print the server-authorized, read-only Agent Context for one Task. */
+export default class TasksContext extends BaseCommand {
+    static description: string;
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        task: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    static examples: string[];
+    run(): Promise<void>;
+    protected wantsJsonOutput(): boolean;
+}

package/dist/commands/tasks/context.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const task_resolver_1 = require("../../lib/task-resolver");
+const task_agent_context_compatibility_1 = require("../../lib/task-agent-context-compatibility");
+/** Print the server-authorized, read-only Agent Context for one Task. */
+class TasksContext extends base_command_1.BaseCommand {
+    static description = 'Read the server-authorized, redacted Agent Context for a Task without starting execution';
+    static args = {
+        id: core_1.Args.string({ description: 'Task ID/ref; defaults to the current Task runtime', ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the machine-readable Agent Context as JSON' }),
+        task: core_1.Flags.string({ description: 'Task ID/ref; overrides current Task runtime context' }),
+    };
+    static examples = [
+        '<%= config.bin %> tasks context OSK-123 --json',
+        '<%= config.bin %> tasks context --task OSK-123 --json',
+    ];
+    async run() {
+        this.setJsonOperation({ command: 'tasks:context', mode: 'read', writeState: 'not_attempted' });
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksContext);
+        let identity;
+        try {
+            identity = (0, task_resolver_1.resolveTaskIdentity)({ positionalId: args.id, flagTask: flags.task });
+        }
+        catch (error) {
+            const failure = (0, task_resolver_1.taskResolutionFailure)(error);
+            this.failWithCliError({
+                message: failure.message,
+                code: failure.code,
+                exit: 2,
+                retryable: false,
+                details: failure.suggestion ? { suggestion: failure.suggestion } : undefined,
+            });
+        }
+        // `resolveTaskIdentity` decides which INPUT wins; it does no lookup. This
+        // turns whatever it picked into something the API can resolve — a UUID and
+        // an OSK-2423 ref pass through untouched, a title is searched.
+        const taskId = await this.resolveTaskReference(identity.id);
+        try {
+            const context = await data_provider_1.dataService.getTaskAgentContext(taskId, {
+                headers: (0, task_agent_context_compatibility_1.taskAgentContextRequestHeaders)(this.config.root),
+            });
+            if (!context?.task?.id) {
+                this.failWithCliError({
+                    message: 'The server did not return a canonical Task identity for this Agent Context.',
+                    code: 'TASK_AGENT_CONTEXT_IDENTITY_UNCONFIRMED',
+                    exit: 2,
+                    retryable: false,
+                });
+            }
+            this.printJsonOperation(context, {
+                resource: { kind: 'task', id: context.task.id },
+                task: { id: context.task.id },
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+    wantsJsonOutput() {
+        return true;
+    }
+}
+exports.default = TasksContext;

package/dist/commands/tasks/copy.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../base-command';
+/** A deliberate cross-Space handoff; distinct from in-Space duplicate-pipeline. */
+export default class TasksCopy extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        space: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        title: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'idempotency-key': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tasks/copy.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const web_url_1 = require("../../lib/web-url");
+/** A deliberate cross-Space handoff; distinct from in-Space duplicate-pipeline. */
+class TasksCopy extends base_command_1.BaseCommand {
+    static description = 'Copy a task brief into another Space without source assignments, history, attachments, or media references';
+    static examples = [
+        '<%= config.bin %> tasks copy <task-id> --space <target-space> --dry-run',
+        '<%= config.bin %> tasks copy <task-id> --space <target-space> --idempotency-key handoff-2026-10-23',
+        '<%= config.bin %> tasks copy <task-id> --space <target-space> --title "Partner handoff" --json',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Source task ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the transfer plan or copied task as JSON' }),
+        space: core_1.Flags.string({
+            description: 'Destination Space ID (required; source and destination must differ)',
+            required: true,
+        }),
+        title: core_1.Flags.string({ description: 'Optional title override for the destination task' }),
+        description: core_1.Flags.string({
+            description: 'Optional description override. Task-asset and space-file references are always removed from a cross-Space copy.',
+        }),
+        'dry-run': core_1.Flags.boolean({
+            description: 'Validate source VIEW and target EDIT, then print the exact safe transfer plan without writing',
+        }),
+        'idempotency-key': core_1.Flags.string({
+            description: 'Required for a real handoff: a stable key for this exact copy. Reuse it after an ambiguous response to replay rather than creating another copy.',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksCopy);
+        if (!flags['dry-run'] && !flags['idempotency-key']) {
+            this.failWithCliError({
+                message: 'A real cross-Space copy requires --idempotency-key <stable-key> so an interrupted handoff can be retried without creating another task. Run --dry-run first to inspect the transfer plan.',
+                code: 'IDEMPOTENCY_KEY_REQUIRED',
+                exit: 2,
+                retryable: false,
+            });
+        }
+        const sourceTaskId = await this.resolveEntityRef('task', args.id);
+        const targetSpaceId = await this.resolveEntityRef('space', flags.space);
+        const idempotencyKey = flags['idempotency-key'];
+        let result;
+        try {
+            result = await data_provider_1.dataService.copyTask(sourceTaskId, {
+                spaceId: targetSpaceId,
+                ...(flags.title ? { title: flags.title } : {}),
+                ...(flags.description !== undefined ? { description: flags.description } : {}),
+                ...(flags['dry-run'] ? { dryRun: true } : {}),
+            }, flags['dry-run'] ? undefined : { idempotencyKey });
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        const task = result.task;
+        const payload = {
+            ...result,
+            ...(flags['dry-run'] ? {} : { idempotencyKey }),
+            ...(task ? { url: (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, task) } : {}),
+        };
+        if (flags.json) {
+            this.printJsonResult(payload);
+            return;
+        }
+        if (result.dryRun) {
+            this.log(`Copy plan is valid: ${sourceTaskId} → Space ${targetSpaceId}`);
+            this.log(`Will carry: ${result.copiedFields.join(', ')}`);
+            this.log(`Will omit: ${result.omittedFields.join(', ')}`);
+            return;
+        }
+        this.log(`Copied task ${sourceTaskId} → ${task?.id ?? '-'} in Space ${targetSpaceId}`);
+        this.log(`Idempotency key: ${idempotencyKey}`);
+        const taskUrl = task ? (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, task) : null;
+        if (taskUrl)
+            this.log(taskUrl);
+    }
+}
+exports.default = TasksCopy;