@skrr-ai/cli 0.1.119 → 0.1.120

package/dist/commands/tasks/create-tree.js

@@ -205,7 +205,10 @@ class TasksCreateTree extends base_command_1.BaseCommand {
             description: 'After applying, reread every confirmed Task and report declared structured-field mismatches and read failures. This checks declarations, not whether Expectations are met. No repair or retry is performed by the readback.',
             exclusive: ['verify', 'verify-spec', 'dry-run'],
         }),
-        unassigned: core_1.Flags.boolean({ description: 'Explicitly clear assignees on every node, suppressing session/parent/Space defaults while retaining any declared executor intent. Does not start tasks.', exclusive: ['default-agent'] }),
+        unassigned: core_1.Flags.boolean({
+            description: 'Explicitly clear assignees on every node, suppressing session/parent/Space defaults while retaining any declared executor intent. Does not start tasks.',
+            exclusive: ['default-agent'],
+        }),
         'external-key-prefix': core_1.Flags.string({
             description: 'Generate externalKey for nodes that omit one; enables idempotent re-runs. Defaults to a prefix derived from the file content (see --fresh)',
         }),
@@ -232,10 +235,18 @@ class TasksCreateTree extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { flags } = await this.parse(TasksCreateTree);
-        this.setJsonOperation({ command: 'tasks:create-tree', mode: flags['verify-spec'] || flags.verify ? 'verify' : flags['dry-run'] ? 'dry_run' : 'execute' });
+        this.setJsonOperation({
+            command: 'tasks:create-tree',
+            mode: flags['verify-spec'] || flags.verify ? 'verify' : flags['dry-run'] ? 'dry_run' : 'execute',
+        });
         const unassignmentError = (0, tasks_1.taskUnassignmentFlagError)(flags);
         if (unassignmentError)
-            this.failWithCliError({ message: unassignmentError, code: 'TASK_UNASSIGNED_CONFLICT', exit: 2, retryable: false });
+            this.failWithCliError({
+                message: unassignmentError,
+                code: 'TASK_UNASSIGNED_CONFLICT',
+                exit: 2,
+                retryable: false,
+            });
         let input = {};
         try {
             input = await (0, prompt_1.readJsonBody)(flags['from-json']);
@@ -287,7 +298,9 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         for (const item of planned) {
             try {
                 (0, tasks_1.applyExplicitTaskUnassignment)(item.payload, Boolean(flags.unassigned));
-                const parentSpace = item.parentKey ? plannedByKey.get(item.parentKey)?.payload.spaceId : undefined;
+                const parentSpace = item.parentKey
+                    ? plannedByKey.get(item.parentKey)?.payload.spaceId
+                    : undefined;
                 if (!item.payload.spaceId && typeof parentSpace === 'string')
                     item.payload.spaceId = parentSpace;
                 await this.resolveTaskResourceReferences(item.payload);
@@ -424,7 +437,9 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         // Say so before anything is written, not only inside a dry run (OSK-S-440 #9).
         const agentAssignment = describeDefaultAgentAssignment(defaultAgentResolutions);
         const noteworthyAssignment = agentAssignment ? [agentAssignment] : [];
-        const target = await this.assertWriteTarget(flags['expect-target'], { preview: flags['dry-run'] });
+        const target = await this.assertWriteTarget(flags['expect-target'], {
+            preview: flags['dry-run'],
+        });
         if (flags['dry-run']) {
             const result = {
                 object: 'task_create_tree_dry_run',
@@ -483,6 +498,9 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         // a request can continue on the server after its client is interrupted.
         const mapping = {};
         const results = [];
+        // Nodes the Space write policy held for approval (OSK-17988), and the nodes
+        // waiting on them: not written, not failed.
+        const heldRows = [];
         const startedAt = Date.now();
         let rounds = 0;
         const next = this.nextCommand(flags);
@@ -501,11 +519,26 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                     (0, node_fs_1.writeSync)(2, `Confirmed mapping: ${JSON.stringify(mapping)}\n`);
                 if (flags.json)
                     (0, node_fs_1.writeSync)(1, JSON.stringify((0, json_output_1.withCliOperation)({
-                        object: 'task_create_tree_result', ok: false, interrupted: true, signal,
-                        total: planned.length, count: confirmed, mapping: { ...mapping }, target,
-                        summary: { confirmed, unknown, notAttempted: planned.length - confirmed - unknown },
+                        object: 'task_create_tree_result',
+                        ok: false,
+                        interrupted: true,
+                        signal,
+                        total: planned.length,
+                        count: confirmed,
+                        mapping: { ...mapping },
+                        target,
+                        summary: {
+                            confirmed,
+                            unknown,
+                            notAttempted: planned.length - confirmed - unknown,
+                        },
                         recovery,
-                    }, { command: 'tasks:create-tree', mode: 'execute', outcome: 'failed', writeState: 'unknown' }), null, 2) + '\n');
+                    }, {
+                        command: 'tasks:create-tree',
+                        mode: 'execute',
+                        outcome: 'failed',
+                        writeState: 'unknown',
+                    }), null, 2) + '\n');
             }
             finally {
                 process.exit(signal === 'SIGINT' ? 130 : 143);
@@ -519,15 +552,25 @@ class TasksCreateTree extends base_command_1.BaseCommand {
             // A half-applied tree reports the ids it did create; the only way back.
             const reportPartial = (item, failure, err, failures) => {
                 if (failure.code === 'PROJECT_NOT_FOUND') {
-                    failure = { ...failure, message: `Project '${String(item.payload.projectId)}' was not found in space '${String(item.payload.spaceId)}'. Correct --project or the node's projectId` };
+                    failure = {
+                        ...failure,
+                        message: `Project '${String(item.payload.projectId)}' was not found in space '${String(item.payload.spaceId)}'. Correct --project or the node's projectId`,
+                    };
                 }
-                const failureRows = failures ?? [{
+                const failureRows = failures ?? [
+                    {
                         tempId: item.key,
                         externalKey: item.payload.externalKey,
-                        outcome: !failure.status || failure.status === 408 || failure.status >= 500 ? 'unknown' : 'failed',
+                        outcome: !failure.status || failure.status === 408 || failure.status >= 500
+                            ? 'unknown'
+                            : 'failed',
                         error: failure,
-                    }];
-                const accountedFor = new Set([...Object.keys(mapping), ...failureRows.map((row) => String(row.tempId))]);
+                    },
+                ];
+                const accountedFor = new Set([
+                    ...Object.keys(mapping),
+                    ...failureRows.map((row) => String(row.tempId)),
+                ]);
                 for (const node of planned) {
                     if (accountedFor.has(node.key))
                         continue;
@@ -535,7 +578,10 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                         tempId: node.key,
                         externalKey: node.payload.externalKey,
                         outcome: 'not_attempted',
-                        error: { message: 'Not attempted because an earlier node stopped the tree', retryable: true },
+                        error: {
+                            message: 'Not attempted because an earlier node stopped the tree',
+                            retryable: true,
+                        },
                     });
                 }
                 const partial = partialFailureResult({
@@ -555,7 +601,10 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                     },
                 });
                 if (flags.json) {
-                    this.printJsonOperation({ ...partial, target }, { outcome: 'failed', writeState: partial.summary.unknown > 0 ? 'unknown' : 'confirmed' });
+                    this.printJsonOperation({ ...partial, target }, {
+                        outcome: 'failed',
+                        writeState: partial.summary.unknown > 0 ? 'unknown' : 'confirmed',
+                    });
                     process.exitCode = partial.failedAt.error.retryable ? 5 : 1;
                     this.exit(partial.failedAt.error.retryable ? 5 : 1);
                 }
@@ -710,6 +759,16 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                                 },
                             });
                         }
+                        for (const row of outcome.held) {
+                            const node = byKey.get(row.key);
+                            heldRows.push({
+                                tempId: row.key,
+                                parentTempId: node?.parentKey,
+                                action: row.reason === 'pending_approval' ? 'pending_approval' : 'waiting_on_approval',
+                                title: node?.payload.title,
+                                ...(row.proposal ? { proposal: row.proposal } : {}),
+                            });
+                        }
                         const failure = outcome.failures.find((f) => !f.skipped) ?? outcome.failures[0];
                         if (failure) {
                             const node = byKey.get(failure.key);
@@ -773,6 +832,7 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                 timing: { elapsedMs: Date.now() - startedAt, requests: rounds },
                 mapping,
                 results,
+                ...(heldRows.length > 0 ? { held: heldRows } : {}),
                 ...(verification ? { verification } : {}),
             };
             if (flags.json) {
@@ -788,6 +848,15 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                 if (item.url)
                     this.log(`  ${item.url}`);
             }
+            if (heldRows.length > 0) {
+                this.log(`Held for approval by the Space write policy (${heldRows.length} node(s), nothing written for them):`);
+                for (const row of heldRows) {
+                    const proposal = row.proposal;
+                    this.log(`- ${row.tempId}: ${row.action === 'pending_approval'
+                        ? `held in approval bundle ${proposal?.id} (item ${proposal?.itemId})`
+                        : 'waits on a held node; send it again once that node exists'}`);
+                }
+            }
             if (verification)
                 this.printSpecificationSummary(verification);
             if (verification && !verification.ok)
@@ -799,18 +868,23 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         }
     }
     async readbackSpecifications(planned, mapping) {
-        const inputs = planned.map(item => {
+        // A node held for approval has no id yet; there is nothing to read back.
+        const inputs = planned
+            .filter((item) => mapping[item.key])
+            .map((item) => {
             const expected = { ...item.payload };
             if (item.parentKey)
                 expected.parentId = mapping[item.parentKey];
             if (item.blockerKeys?.length)
-                expected.blockedByIds = [...new Set([
+                expected.blockedByIds = [
+                    ...new Set([
                         ...(expected.blockedByIds ?? []),
-                        ...item.blockerKeys.map(key => mapping[key]),
-                    ])];
+                        ...item.blockerKeys.map((key) => mapping[key]),
+                    ]),
+                ];
             return { tempId: item.key, id: mapping[item.key], expected };
         });
-        return (0, task_spec_verification_1.verifyTaskSpecifications)(inputs, id => data_provider_1.dataService.getTask(id, { enrich: false }));
+        return (0, task_spec_verification_1.verifyTaskSpecifications)(inputs, (id) => data_provider_1.dataService.getTask(id, { enrich: false }));
     }
     printSpecificationSummary(verification) {
         const { summary } = verification;
@@ -863,12 +937,12 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         }
         let verification;
         if (flags['verify-spec']) {
-            const mapping = Object.fromEntries(existing.map(row => [String(row.tempId), String(row.id)]));
+            const mapping = Object.fromEntries(existing.map((row) => [String(row.tempId), String(row.id)]));
             const checkable = [];
             for (const item of planned) {
                 if (!mapping[item.key] || cannotCheck.has(item.key))
                     continue;
-                const unresolved = [item.parentKey, ...(item.blockerKeys ?? [])].filter(key => key && !mapping[key]);
+                const unresolved = [item.parentKey, ...(item.blockerKeys ?? [])].filter((key) => key && !mapping[key]);
                 if (unresolved.length) {
                     cannotCheck.set(item.key, `Cannot resolve related node(s): ${unresolved.join(', ')}`);
                     continue;

package/dist/commands/tasks/create.js

@@ -116,7 +116,9 @@ function taskMatchesCreateIdentity(task, payload) {
         if (!Array.isArray(payload[field]))
             continue;
         const requested = [...new Set(payload[field].map(String))].sort();
-        const actual = [...new Set(Array.isArray(task[field]) ? task[field].map(String) : [])].sort();
+        const actual = [
+            ...new Set(Array.isArray(task[field]) ? task[field].map(String) : []),
+        ].sort();
         if (JSON.stringify(actual) !== JSON.stringify(requested))
             return false;
     }
@@ -426,6 +428,9 @@ class TasksCreate extends base_command_1.BaseCommand {
             catch (err) {
                 this.failTaskCreate(err, payload, flags.goal !== undefined);
             }
+            // Held for approval by the Space write policy: nothing was instantiated.
+            if (this.reportHeldSpaceWrite(instantiated, { json: flags.json }))
+                return;
             const root = instantiated.rootTask ||
                 (instantiated.rootTasks || [])[0];
             const url = root ? (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, root) : undefined;
@@ -603,6 +608,9 @@ class TasksCreate extends base_command_1.BaseCommand {
                 this.failTaskCreate(retryErr, payload, flags.goal !== undefined);
             }
         }
+        // Held for approval by the Space write policy: nothing was created.
+        if (this.reportHeldSpaceWrite(created, { json: flags.json }))
+            return;
         const url = (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, created);
         // Before either output path, and via `warn` so it reaches stderr — `--json`
         // stdout stays a parseable task row.

package/dist/commands/tasks/deliverable/add.js

@@ -268,16 +268,13 @@ class TasksDeliverableAdd extends base_command_1.BaseCommand {
                     expectationIds: opts.expectationIds,
                 },
             });
+            assertArchivedDeliverableReceipt(asset);
         }
         catch (err) {
             this.handleApiError(err);
             return false;
         }
         const { resourceReceipt, ...archived } = asset;
-        if (!resourceReceipt?.link.id) {
-            this.warn('The file was archived, but this server did not return its Deliverable link. ' +
-                `Run skrr tasks deliverable list ${opts.taskId} --json to find the exact version before submitting a Result.`);
-        }
         if (opts.json) {
             // `--status` is overridden for an archived copy, and --json used to say nothing of it: the
             // receipt's observation read `available` and the requested status appeared nowhere (OSK-15437).
@@ -288,15 +285,13 @@ class TasksDeliverableAdd extends base_command_1.BaseCommand {
                 identity: opts.identity,
                 ...(notes ? { requestedStatus: opts.requestedStatus, notes: [notes] } : {}),
             }, {
-                resource: { kind: 'task_resource_link', id: resourceReceipt?.link.id },
-                task: { id: resourceReceipt?.link?.taskId },
+                resource: { kind: 'task_resource_link', id: resourceReceipt.link.id },
+                task: { id: resourceReceipt.link.taskId },
             });
             return true;
         }
-        const recorded = resourceReceipt?.link.id
-            ? `Recorded Deliverable ${resourceReceipt.link.id}: ${opts.identity}`
-            : `Archived ${opts.identity}`;
-        const version = resourceReceipt?.version.id ? `version ${resourceReceipt.version.id}; ` : '';
+        const recorded = `Recorded Deliverable ${resourceReceipt.link.id}: ${opts.identity}`;
+        const version = `version ${resourceReceipt.version.id}; `;
         this.log(`${recorded} — archived copy ${asset.id} ` +
             `(${version}sha256 pinned; observed available; self reported).`);
         const notApplied = statusNotApplied(opts.requestedStatus);
@@ -309,6 +304,21 @@ class TasksDeliverableAdd extends base_command_1.BaseCommand {
     }
 }
 exports.default = TasksDeliverableAdd;
+/** Availability and a named Resource version require the server's complete archive receipt. */
+function assertArchivedDeliverableReceipt(asset) {
+    const receipt = asset?.resourceReceipt;
+    const ids = [asset?.id, receipt?.resource?.id, receipt?.version?.id, receipt?.link?.id,
+        receipt?.observation?.id];
+    const stored = asset?.digest;
+    const versionDigest = receipt?.version?.contentDigest;
+    if (asset?.status !== 'ready' || ids.some((id) => typeof id !== 'string' || !id.trim()) ||
+        receipt?.observation?.status !== 'available' || typeof stored !== 'string' ||
+        !/^[a-f0-9]{64}$/i.test(stored) || typeof versionDigest !== 'string' ||
+        versionDigest.toLowerCase() !== `sha256:${stored.toLowerCase()}`) {
+        throw new Error('The server did not confirm a ready archived Deliverable with its exact Resource receipt. ' +
+            'Re-read the Task attachments and Deliverables before retrying.');
+    }
+}
 /** The sentence for a `--status` an archived copy overrides, or null when nothing was overridden. */
 function statusNotApplied(requestedStatus) {
     return requestedStatus && requestedStatus !== 'available'

package/dist/commands/tasks/move.js

@@ -131,6 +131,10 @@ class TasksMove extends base_command_1.BaseCommand {
                         force: flags.force === true ? true : undefined,
                     });
                 }
+                // Held for approval by the Space write policy: nothing moved, and the
+                // project change below is not sent on top of a held move.
+                if (this.reportHeldSpaceWrite(updated, { json: flags.json }))
+                    return;
             }
             if (projectId !== undefined) {
                 // Project membership is an ordinary task field — PATCH /tasks/:id.
@@ -139,6 +143,8 @@ class TasksMove extends base_command_1.BaseCommand {
                     taskId: taskRef,
                     data: { projectId },
                 });
+                if (this.reportHeldSpaceWrite(updated, { json: flags.json }))
+                    return;
             }
         }
         catch (err) {
@@ -155,7 +161,8 @@ class TasksMove extends base_command_1.BaseCommand {
         }
         if (flags.json) {
             this.printJsonOperation((0, web_url_1.withTaskUrl)(this.cliConfig.baseURL, updated), {
-                resource: { kind: 'task', id: updated?.id }, task: { id: updated?.id },
+                resource: { kind: 'task', id: updated?.id },
+                task: { id: updated?.id },
             });
             return;
         }

package/dist/commands/tasks/operations/show.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../../../base-command';
+/** Inspect one durable Task Operation without replaying it or changing execution. */
+export default class TasksOperationsShow extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        task: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'operation-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'request-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tasks/operations/show.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const task_resolver_1 = require("../../../lib/task-resolver");
+/** Inspect one durable Task Operation without replaying it or changing execution. */
+class TasksOperationsShow extends base_command_1.BaseCommand {
+    static description = 'Inspect one server-authoritative Task operation by its operation ID or original request ID. Read-only; never replays work.';
+    static examples = [
+        '<%= config.bin %> tasks operations show <task-id> --operation-id opr_…',
+        '<%= config.bin %> tasks operations show <task-id> --request-id task-retry:deploy-42',
+        '<%= config.bin %> tasks operations show <task-id> --request-id task-start:deploy-42 --json',
+    ];
+    static args = {
+        id: core_1.Args.string({
+            description: 'Task ID; defaults to OVERSKY_SESSION_TASK_ID in task runtimes',
+            required: false,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        task: core_1.Flags.string({ description: 'Task ID; overrides daemon runtime context' }),
+        'operation-id': core_1.Flags.string({ description: 'Opaque operation ID returned by the server' }),
+        'request-id': core_1.Flags.string({
+            description: 'Original start/retry request ID, when the operation response was lost',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output the full operation projection as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksOperationsShow);
+        let taskIdentity;
+        try {
+            taskIdentity = (0, task_resolver_1.resolveTaskIdentity)({ positionalId: args.id, flagTask: flags.task });
+        }
+        catch (err) {
+            const failure = (0, task_resolver_1.taskResolutionFailure)(err);
+            this.failWithCliError({
+                message: failure.message,
+                code: failure.code,
+                exit: 2,
+                retryable: false,
+                details: { suggestion: failure.suggestion, context: failure.details },
+            });
+        }
+        const operationId = flags['operation-id'];
+        const requestId = flags['request-id'];
+        if ((operationId && requestId) || (!operationId && !requestId)) {
+            this.error('Provide exactly one of --operation-id or --request-id.', { exit: 2 });
+        }
+        // `resolveTaskIdentity` decides which INPUT wins; it does no lookup. This
+        // turns whatever it picked into something the API can resolve — a UUID and
+        // an OSK-2423 ref pass through untouched, a title is searched.
+        const taskId = await this.resolveTaskReference(taskIdentity.id);
+        // Published CLI builds can lag the data-provider declaration during an
+        // additive rollout. The methods are still runtime functions exported by
+        // this same package, so this narrow cast preserves compatibility.
+        const service = data_provider_1.dataService;
+        let operation;
+        try {
+            operation = operationId
+                ? await service.getTaskOperation(taskId, operationId)
+                : await service.getTaskOperationByRequest(taskId, requestId);
+        }
+        catch (error) {
+            this.handleApiError(error, { subject: `Task ${taskId} operation` });
+        }
+        if (flags.json) {
+            this.printJsonResult(operation);
+            return;
+        }
+        this.log(`Operation ${operation.operationId}: ${operation.state}`);
+        this.log(`Intent: ${operation.intent}`);
+        this.log(`Phase: ${operation.phase}`);
+        if (operation.outcome)
+            this.log(`Outcome: ${operation.outcome}`);
+        this.log(`Task: ${operation.task.identifier || operation.task.id}`);
+        if (operation.task.state.workflowGeneration !== undefined) {
+            this.log(`Workflow generation: ${operation.task.state.workflowGeneration}`);
+        }
+        if (operation.receipt?.requestId)
+            this.log(`Request receipt: ${operation.receipt.requestId}`);
+        if (operation.executionReference?.runId)
+            this.log(`Execution Run: ${operation.executionReference.runId}`);
+        const attempt = operation.execution?.run.activeExecutorAttemptRef ||
+            operation.execution?.run.terminalExecutorAttemptRef;
+        if (attempt) {
+            this.log(`Executor attempt: ${attempt.kind}/${attempt.runId} #${attempt.attempt} generation ${attempt.generation}`);
+        }
+        if (operation.provenance.code)
+            this.log(`Observation: ${operation.provenance.code}`);
+        this.log(operation.recovery.disposition === 'do_not_resend'
+            ? 'This operation is not confirmed. Do not resend it; inspect the same operation or execution state.'
+            : 'This is inspect-only. Use execution-state for current execution authority.');
+    }
+}
+exports.default = TasksOperationsShow;

package/dist/commands/tasks/operations/wait.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Wait on a Task Operation's server-owned projection. This is intentionally a
+ * read-only command: it never retries, redrives, changes Task workflow, or
+ * reconstructs an action from the operation's intent.
+ */
+export default class TasksOperationsWait extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        task: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        operation: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        interval: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        timeout: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private printCheckpoint;
+}

package/dist/commands/tasks/operations/wait.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const task_resolver_1 = require("../../../lib/task-resolver");
+const task_operation_watch_1 = require("../../../lib/task-operation-watch");
+/**
+ * Wait on a Task Operation's server-owned projection. This is intentionally a
+ * read-only command: it never retries, redrives, changes Task workflow, or
+ * reconstructs an action from the operation's intent.
+ */
+class TasksOperationsWait extends base_command_1.BaseCommand {
+    static description = 'Wait read-only for one immutable Task Operation; never retries or dispatches another run';
+    static examples = [
+        '<%= config.bin %> tasks operations wait <task-id> --operation task-retry:deploy-42',
+        '<%= config.bin %> tasks operations wait <task-id> --operation task-start:deploy-42 --timeout 10m --json',
+    ];
+    static args = {
+        id: core_1.Args.string({
+            description: 'Task ID; defaults to OVERSKY_SESSION_TASK_ID in task runtimes',
+            required: false,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        task: core_1.Flags.string({ description: 'Task ID; overrides daemon runtime context' }),
+        operation: core_1.Flags.string({ description: 'Immutable Task Operation ID to observe', required: true }),
+        interval: core_1.Flags.integer({ description: 'Polling interval in seconds', default: 5 }),
+        timeout: core_1.Flags.string({ description: 'Timeout such as 30s, 10m, 2h' }),
+        json: core_1.Flags.boolean({ description: 'Emit newline-delimited JSON operation checkpoints' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksOperationsWait);
+        let taskIdentity;
+        try {
+            taskIdentity = (0, task_resolver_1.resolveTaskIdentity)({ positionalId: args.id, flagTask: flags.task });
+        }
+        catch (error) {
+            const failure = (0, task_resolver_1.taskResolutionFailure)(error);
+            this.failWithCliError({
+                code: failure.code,
+                message: failure.message,
+                exit: 2,
+                retryable: false,
+                details: failure.suggestion ? { suggestion: failure.suggestion } : undefined,
+            });
+        }
+        const taskId = await this.resolveTaskReference(taskIdentity.id);
+        let timeoutMs;
+        try {
+            timeoutMs = (0, task_operation_watch_1.parseTaskOperationWatchDuration)(flags.timeout);
+        }
+        catch (error) {
+            this.error(error.message, { exit: 2 });
+            return;
+        }
+        const operationId = flags.operation.trim();
+        if (!operationId || operationId.length > 200) {
+            this.error('--operation must be a non-empty operation ID of at most 200 characters.', { exit: 2 });
+            return;
+        }
+        const getTaskOperation = data_provider_1.dataService.getTaskOperation;
+        if (!getTaskOperation) {
+            this.failWithCliError({
+                code: 'TASK_OPERATION_READER_UNAVAILABLE',
+                message: 'This CLI build cannot read Task Operations. Update skrr before waiting on this operation.',
+                exit: 2,
+                retryable: false,
+            });
+        }
+        try {
+            const result = await (0, task_operation_watch_1.watchTaskOperation)({
+                taskId,
+                operationId,
+                intervalMs: Math.max(1, flags.interval) * 1000,
+                timeoutMs,
+                read: getTaskOperation,
+                onCheckpoint: (checkpoint) => this.printCheckpoint(checkpoint, Boolean(flags.json)),
+            });
+            if (result.result === 'failed')
+                this.exit(1);
+        }
+        catch (error) {
+            const candidate = error;
+            if (candidate?.code === 'TASK_OPERATION_WAIT_TIMEOUT') {
+                this.exit(124);
+                return;
+            }
+            if (candidate?.code === 'TASK_OPERATION_TERMINAL_UNKNOWN') {
+                this.failWithCliError({
+                    code: 'TASK_OPERATION_TERMINAL_UNKNOWN',
+                    message: 'The Task Operation is terminal but does not report a recognized outcome. Inspect it; do not issue a fresh operation by guesswork.',
+                    exit: 2,
+                    retryable: false,
+                    details: { taskId, operationId },
+                });
+                return;
+            }
+            this.handleApiError(error, { subject: `Task operation ${operationId}` });
+        }
+    }
+    printCheckpoint(checkpoint, json) {
+        if (json) {
+            this.log(JSON.stringify(checkpoint));
+            return;
+        }
+        if (checkpoint.changed || checkpoint.terminal || checkpoint.observation === 'timeout') {
+            this.log((0, task_operation_watch_1.taskOperationCheckpointLine)(checkpoint));
+        }
+    }
+}
+exports.default = TasksOperationsWait;

package/dist/commands/tasks/preflight.d.ts

@@ -8,6 +8,7 @@ export default class TasksPreflight extends BaseCommand {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         task: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         skill: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        capability: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     static examples: string[];
     run(): Promise<void>;

package/dist/commands/tasks/preflight.js

@@ -14,6 +14,10 @@ class TasksPreflight extends base_command_1.BaseCommand {
         json: core_1.Flags.boolean({ description: 'Output native observations, uncertainty, and CLI verification metadata as JSON' }),
         task: core_1.Flags.string({ description: 'Task ID/ref; overrides current Task runtime context' }),
         skill: core_1.Flags.string({ description: 'Skill ID for the existing server execution preview' }),
+        capability: core_1.Flags.string({
+            multiple: true,
+            description: 'Capability required of the execution target. Repeat for every requirement.',
+        }),
     };
     static examples = [
         '<%= config.bin %> tasks preflight OSK-123',
@@ -56,7 +60,13 @@ class TasksPreflight extends base_command_1.BaseCommand {
         }
         const report = await (0, task_preflight_1.readTaskPreflight)(taskId, {
             workflow: () => data_provider_1.dataService.getTaskActionability(taskId),
-            execution: () => data_provider_1.dataService.previewTaskStart(taskId, flags.skill ? { skillId: flags.skill } : undefined),
+            execution: () => {
+                const options = {
+                    ...(flags.skill ? { skillId: flags.skill } : {}),
+                    ...(flags.capability?.length ? { requestedCapabilities: flags.capability } : {}),
+                };
+                return data_provider_1.dataService.previewTaskStart(taskId, Object.keys(options).length ? options : undefined);
+            },
         });
         // Only native diagnostic responses establish an identity for _cli; a
         // requested ref is not itself a confirmed Task record.

package/dist/commands/tasks/rearm-recurrence.js

@@ -56,6 +56,10 @@ class TasksRearmRecurrence extends base_command_1.BaseCommand {
             }, null, 2));
             return;
         }
+        if (result.pending === true) {
+            this.log(result.message);
+            return;
+        }
         const finished = result.task;
         const from = finished.identifier || finished.id || taskRef;
         const next = result.successor.identifier || result.successor.id;