@skrr-ai/cli 0.1.119 → 0.1.121

package/dist/base-command.d.ts

@@ -5,6 +5,8 @@ import { dataService } from '@skrr-ai/data-provider';
 import { type WriteTarget } from './lib/write-target';
 import { type AssigneeResolution, type MemberKind, type SpaceMember } from './lib/assignee-resolver';
 import { type CliConfig } from './lib/config';
+import { type AuthResolutionDiagnostic } from './lib/auth-diagnostics';
+import { type CompletionCacheScope } from './lib/completion-index';
 import { type OutboxMethod } from './lib/outbox';
 import { type CredentialProvenance, type ResolvedCredential } from './lib/credential-resolver';
 import { type BrokerRefusalDescription } from './lib/daemonBrokerRefusal';
@@ -82,6 +84,15 @@ export declare abstract class BaseCommand extends Command {
     protected printJsonResult(value: unknown, options?: {
         ok?: boolean;
     }): void;
+    /**
+     * A task write the Space write policy HELD for approval (OSK-17988): the
+     * server answered `202 { status: 'pending_approval' }` and wrote nothing.
+     * Prints it as that, never as a created or updated task, and returns true so
+     * the command stops there (exit 0: the request was accepted, not refused).
+     */
+    protected reportHeldSpaceWrite(result: unknown, { json }?: {
+        json?: boolean;
+    }): boolean;
     private jsonOperationContext?;
     /** Opt in at the command boundary, including its existing structured errors. */
     protected setJsonOperation(options: Partial<CliOperationOptions>): void;
@@ -97,6 +108,8 @@ export declare abstract class BaseCommand extends Command {
      * from here.
      */
     protected resolvedCredential: ResolvedCredential;
+    /** Completion references follow the same principal and workspace as requests. */
+    protected completionCacheScope(): CompletionCacheScope | null;
     /** Re-authorize a long-lived transport using this command's credential
      * source. A daemon handoff is redeemed again; its refresh family is never
      * borrowed or written into the CLI's own login. */
@@ -109,6 +122,8 @@ export declare abstract class BaseCommand extends Command {
      */
     protected credentialProvenance: CredentialProvenance | null;
     protected bareMode: boolean;
+    /** Managed runtimes must never suggest a human's local credential store. */
+    private authManagedRuntime;
     /**
      * Set when the auto-broker reached a live daemon and it REFUSED the hand-off.
      * `requireAuth()` reports it instead of a bare "Not signed in", because the
@@ -351,6 +366,11 @@ export declare abstract class BaseCommand extends Command {
      * Returns `null` when not signed in.
      */
     protected credentialSourceLabel(): string | null;
+    /**
+     * A machine-readable explanation of credential resolution. This carries
+     * source metadata only; neither token material nor raw URLs may escape.
+     */
+    protected authResolution(): AuthResolutionDiagnostic;
     protected catch(err: Error & {
         code?: string;
         exitCode?: number;
@@ -636,6 +656,10 @@ type UnsupportedFlagRemedy = {
     fix: string;
     targets: readonly UnsupportedFlagRemedyTarget[];
 };
+type MissingFlagRemedy = {
+    fix: string;
+    targets: readonly UnsupportedFlagRemedyTarget[];
+};
 /**
  * Specific corrections for habitual flags that look plausible but do not belong
  * to the command that received them. Keep the replacement command and every
@@ -643,6 +667,13 @@ type UnsupportedFlagRemedy = {
  * manifest, so a useful refusal cannot slowly point at a removed form.
  */
 export declare const UNSUPPORTED_FLAG_REMEDIES: Readonly<Record<string, Readonly<Record<string, UnsupportedFlagRemedy>>>>;
+/**
+ * Required flags normally share a generic repair. A few have a meaningful
+ * choice that cannot be recovered from `<value>` alone; keep those remedies
+ * declarative and validate their referenced command flags alongside the
+ * habitual unsupported-flag corrections.
+ */
+export declare const MISSING_FLAG_REMEDIES: Readonly<Record<string, Readonly<Record<string, MissingFlagRemedy>>>>;
 /**
  * The hint for a `Nonexistent flags:` refusal, or null. Two cases:
  *  - a flag retired from THIS command, which this command does not define again: where it went;

package/dist/base-command.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Flags = exports.UNSUPPORTED_FLAG_REMEDIES = exports.BaseCommand = exports.resolveProfileFromArgv = void 0;
+exports.Flags = exports.MISSING_FLAG_REMEDIES = exports.UNSUPPORTED_FLAG_REMEDIES = exports.BaseCommand = exports.resolveProfileFromArgv = void 0;
 exports.assigneePayloadNeedsResolution = assigneePayloadNeedsResolution;
 exports.parseGlobalFlags = parseGlobalFlags;
 exports.refusalCodeOf = refusalCodeOf;
@@ -22,6 +22,7 @@ exports.errorBodyMessage = errorBodyMessage;
 exports.envelopeDetails = envelopeDetails;
 exports.retiredFlagHint = retiredFlagHint;
 exports.parseErrorRemedy = parseErrorRemedy;
+const space_write_policy_1 = require("./lib/space-write-policy");
 const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
 Object.defineProperty(exports, "Flags", { enumerable: true, get: function () { return core_1.Flags; } });
@@ -32,6 +33,7 @@ const json_mode_1 = require("./lib/json-mode");
 const failed_lookup_1 = require("./lib/failed-lookup");
 const internal_id_1 = require("./lib/internal-id");
 const http_error_1 = require("./lib/http-error");
+const api_error_reason_1 = require("./lib/api-error-reason");
 const guide_pointer_1 = require("./lib/guide-pointer");
 // Re-exported from its home in `lib/keychain`, beside the other profile
 // functions. It lived here while `init()` was its only caller; a lib module
@@ -40,6 +42,7 @@ const guide_pointer_1 = require("./lib/guide-pointer");
 var keychain_1 = require("./lib/keychain");
 Object.defineProperty(exports, "resolveProfileFromArgv", { enumerable: true, get: function () { return keychain_1.resolveProfileFromArgv; } });
 const data_provider_1 = require("@skrr-ai/data-provider");
+const cli_client_identity_1 = require("./lib/cli-client-identity");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const auth_failure_1 = require("./lib/auth-failure");
 const list_output_1 = require("./lib/list-output");
@@ -49,6 +52,9 @@ const task_ref_resolver_1 = require("./lib/task-ref-resolver");
 const space_resolver_1 = require("./lib/space-resolver");
 const projects_1 = require("./lib/projects");
 const config_1 = require("./lib/config");
+const auth_diagnostics_1 = require("./lib/auth-diagnostics");
+const completion_index_1 = require("./lib/completion-index");
+const workspace_header_1 = require("./lib/workspace-header");
 const cli_id_1 = require("./lib/cli-id");
 const keychain_2 = require("./lib/keychain");
 const outbox_1 = require("./lib/outbox");
@@ -205,6 +211,25 @@ class BaseCommand extends core_1.Command {
     printJsonResult(value, options = {}) {
         this.log(JSON.stringify((0, json_output_1.withOk)(value, options.ok ?? true), null, 2));
     }
+    /**
+     * A task write the Space write policy HELD for approval (OSK-17988): the
+     * server answered `202 { status: 'pending_approval' }` and wrote nothing.
+     * Prints it as that, never as a created or updated task, and returns true so
+     * the command stops there (exit 0: the request was accepted, not refused).
+     */
+    reportHeldSpaceWrite(result, { json } = {}) {
+        if (!(0, space_write_policy_1.isSpaceWritePendingResponse)(result))
+            return false;
+        if (json) {
+            this.printJsonOperation(result, { writeState: 'not_attempted' });
+        }
+        else {
+            for (const line of (0, space_write_policy_1.spaceWritePendingLines)(result, { binName: this.config.bin })) {
+                this.log(line);
+            }
+        }
+        return true;
+    }
     jsonOperationContext;
     /** Opt in at the command boundary, including its existing structured errors. */
     setJsonOperation(options) {
@@ -236,6 +261,16 @@ class BaseCommand extends core_1.Command {
      * from here.
      */
     resolvedCredential;
+    /** Completion references follow the same principal and workspace as requests. */
+    completionCacheScope() {
+        return (0, completion_index_1.createCompletionCacheScope)({
+            configRoot: (0, config_1.configRoot)(),
+            profile: (0, keychain_2.getActiveProfile)(),
+            baseURL: this.cliConfig.baseURL,
+            workspaceId: (0, workspace_header_1.withWorkspaceHeader)({})['X-Workspace-Id'],
+            token: this.resolvedCredential?.token,
+        });
+    }
     /** Re-authorize a long-lived transport using this command's credential
      * source. A daemon handoff is redeemed again; its refresh family is never
      * borrowed or written into the CLI's own login. */
@@ -268,6 +303,8 @@ class BaseCommand extends core_1.Command {
      */
     credentialProvenance = null;
     bareMode = false;
+    /** Managed runtimes must never suggest a human's local credential store. */
+    authManagedRuntime = false;
     /**
      * Set when the auto-broker reached a live daemon and it REFUSED the hand-off.
      * `requireAuth()` reports it instead of a bare "Not signed in", because the
@@ -276,6 +313,11 @@ class BaseCommand extends core_1.Command {
     brokerRefusal = null;
     async init() {
         await super.init();
+        // Task Agent Context compatibility is meaningful only when the API can
+        // distinguish a real CLI build from a generic HTTP caller. This is still
+        // telemetry/presentation metadata: the server must never treat it as an
+        // execution or authorization claim.
+        (0, cli_client_identity_1.configureCliClientIdentity)(this.config.pjson?.version);
         // The profile is resolved from raw argv, BEFORE oclif parses anything.
         //
         // It has to be. `parseBaseFlags()` runs far below, after migration and
@@ -392,6 +434,7 @@ class BaseCommand extends core_1.Command {
         // from the daemon and never owns the person's stored session, so the
         // commands that create, replace or end that session are not its to run.
         const harnessContext = (0, harness_context_1.isHarnessCliContext)();
+        this.authManagedRuntime = harnessContext;
         if (harnessContext && this.id && harness_context_1.HARNESS_REFUSED_AUTH_COMMANDS.has(this.id)) {
             this.failWithCliError({
                 message: `\`${this.config.bin} ${this.id}\` is not available here: this process was started by the skrr ` +
@@ -424,7 +467,12 @@ class BaseCommand extends core_1.Command {
         // us `bare` and `token` without each subclass having to re-plumb
         // them.
         const parsed = await this.parseBaseFlags();
-        this.bareMode = parsed.bare;
+        // Keep the orchestration path aligned with credential-resolver: an
+        // environment-enabled bare invocation skips stored credentials just as an
+        // explicit `--bare` invocation does, so its diagnostic and broker policy
+        // must say the same thing.
+        this.bareMode =
+            parsed.bare || ['1', 'true', 'TRUE', 'yes'].includes(process.env.OVERSKY_BARE_MODE ?? '');
         if (parsed.workspace)
             process.env.OVERSKY_WORKSPACE_ID = parsed.workspace;
         this.cliConfig = (0, config_1.loadConfig)();
@@ -997,6 +1045,7 @@ class BaseCommand extends core_1.Command {
     /** Abort the command with a helpful message if the user isn't signed in. */
     requireAuth() {
         if (!this.resolvedCredential?.token) {
+            const diagnostic = this.authResolution();
             const refusal = this.brokerRefusal;
             if (refusal) {
                 // Same code as the plain case — scripts branch on NOT_SIGNED_IN — with
@@ -1010,14 +1059,24 @@ class BaseCommand extends core_1.Command {
                     code: 'NOT_SIGNED_IN',
                     exit: 2,
                     retryable: refusal.transient,
-                    details: { broker: refusal.broker, suggestion: refusal.remedy },
+                    details: {
+                        broker: refusal.broker,
+                        auth: diagnostic,
+                        server: diagnostic.server,
+                        suggestion: refusal.remedy,
+                    },
                 });
             }
             this.failWithCliError({
-                message: `Not signed in. Run \`${this.config.bin} login\` first.`,
+                message: (0, auth_diagnostics_1.describeMissingCredential)(diagnostic, this.config.bin),
                 code: 'NOT_SIGNED_IN',
                 exit: 2,
                 retryable: false,
+                details: {
+                    auth: diagnostic,
+                    server: diagnostic.server,
+                    suggestion: diagnostic.suggestion,
+                },
             });
         }
         const incompatibleScope = incompatibleCliCredentialScope(this.resolvedCredential.token);
@@ -1275,6 +1334,19 @@ class BaseCommand extends core_1.Command {
             return null;
         return (0, credential_resolver_1.describeCredentialSource)(this.resolvedCredential.source, this.credentialProvenance);
     }
+    /**
+     * A machine-readable explanation of credential resolution. This carries
+     * source metadata only; neither token material nor raw URLs may escape.
+     */
+    authResolution() {
+        return (0, auth_diagnostics_1.authResolutionDiagnostic)({
+            credential: this.resolvedCredential,
+            bareMode: this.bareMode,
+            managedRuntime: this.authManagedRuntime,
+            baseURL: this.cliConfig?.baseURL,
+            bin: this.config?.bin ?? 'skrr',
+        });
+    }
     async catch(err) {
         if (isOclifExitError(err)) {
             return super.catch(err);
@@ -1291,6 +1363,10 @@ class BaseCommand extends core_1.Command {
         if (unsupportedFlagHint && !err.message.includes(unsupportedFlagHint.fix)) {
             err.message = `${err.message}\n\n${unsupportedFlagHint.fix}`;
         }
+        const missingFlagHint = missingFlagRemedyForMessage(err.message || '', this.id);
+        if (missingFlagHint && !err.message.includes(missingFlagHint.fix)) {
+            err.message = `${err.message}\n\n${missingFlagHint.fix}`;
+        }
         // Sibling domains spell one lifecycle differently (`in_progress` for a
         // space, `active` for a goal), and oclif's enum refusal named neither the
         // difference nor the value to use (OSK-9735).
@@ -1556,11 +1632,14 @@ class BaseCommand extends core_1.Command {
                 const renewal = refreshRefusal
                     ? refreshRefusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
                     : "This CLI's own sign-in could not be renewed.";
+                const authDiagnostic = this.authResolution();
                 const details = {
                     ...(refreshRefusal && bodyCode ? { accessTokenCode: bodyCode } : {}),
                     ...(brokerRefusal
                         ? { broker: brokerRefusal.broker, suggestion: brokerRefusal.remedy }
                         : {}),
+                    auth: authDiagnostic,
+                    server: authDiagnostic.server,
                 };
                 let authMessage;
                 if (presentedCiToken) {
@@ -1644,7 +1723,7 @@ class BaseCommand extends core_1.Command {
                     code: bodyCode || 'FORBIDDEN',
                     status: e.status,
                     exit: 3,
-                    retryable: edgeRefusal,
+                    retryable: typeof body?.retryable === 'boolean' ? body.retryable : edgeRefusal,
                 });
             }
             else if (e.status === 404) {
@@ -2151,6 +2230,12 @@ function refusalCodeOf(body) {
     const direct = stringProp(body ?? null, 'code') || stringProp(body ?? null, 'errorType');
     if (direct)
         return direct;
+    // Session-scoped Task routes return `{ok:false, reason}`. This is an
+    // application refusal, not a bodyless edge error. Preserve its spelling so
+    // an Agent can distinguish a stale session from a Task authorization stop.
+    const reason = (0, api_error_reason_1.reasonOnlyCode)(body);
+    if (reason)
+        return reason;
     const legacy = stringProp(body ?? null, 'error');
     return legacy && LEGACY_ERROR_FIELD_CODE.test(legacy) ? legacy.toUpperCase() : undefined;
 }
@@ -2618,7 +2703,9 @@ function errorBodyMessage(body) {
     const nested = record.error && typeof record.error === 'object' && !Array.isArray(record.error)
         ? record.error.message
         : undefined;
-    return text(record.message) ?? text(record.error) ?? text(nested);
+    const reason = (0, api_error_reason_1.reasonOnlyCode)(record);
+    return text(record.message) ?? text(record.error) ?? text(nested) ??
+        (reason ? `Request refused: ${reason}` : undefined);
 }
 /**
  * The `details` of a CLI error envelope, in ONE shape. The server's refusal body becomes the
@@ -2677,13 +2764,35 @@ exports.UNSUPPORTED_FLAG_REMEDIES = {
         },
     },
 };
+/**
+ * Required flags normally share a generic repair. A few have a meaningful
+ * choice that cannot be recovered from `<value>` alone; keep those remedies
+ * declarative and validate their referenced command flags alongside the
+ * habitual unsupported-flag corrections.
+ */
+exports.MISSING_FLAG_REMEDIES = {
+    'tasks:ready': {
+        for: {
+            fix: 'Choose who can move the work: pass `--for agent` or `--for human`. ' +
+                'For a Space, run `skrr tasks ready --for agent --space <space-id>`.',
+            targets: [{ command: 'tasks:ready', flags: ['for', 'space'] }],
+        },
+    },
+};
 function unsupportedFlagRemedy(commandId, flag) {
     return commandId ? exports.UNSUPPORTED_FLAG_REMEDIES[commandId]?.[flag] : undefined;
 }
+function missingFlagRemedy(commandId, flag) {
+    return commandId ? exports.MISSING_FLAG_REMEDIES[commandId]?.[flag] : undefined;
+}
 function unsupportedFlagRemedyForMessage(message, commandId) {
     const match = /Nonexistent flag[s]?:?\s*(-{1,2}[\w-]+)/i.exec(message);
     return match ? unsupportedFlagRemedy(commandId, match[1].replace(/^-+/, '')) : undefined;
 }
+function missingFlagRemedyForMessage(message, commandId) {
+    const match = /Missing required flag[s]?:?\s*(?:\n\s*)?-{0,2}([a-z][\w-]*)/i.exec(message);
+    return match ? missingFlagRemedy(commandId, match[1]) : undefined;
+}
 /**
  * The hint for a `Nonexistent flags:` refusal, or null. Two cases:
  *  - a flag retired from THIS command, which this command does not define again: where it went;
@@ -2728,9 +2837,11 @@ function parseErrorRemedy(err, commandId, bin = 'skrr') {
     const missingFlag = /Missing required flag[s]?:?\s*(?:\n\s*)?-{0,2}([a-z][\w-]*)/i.exec(message);
     if (missingFlag) {
         const flag = missingFlag[1];
+        const missingFlagHint = missingFlagRemedy(commandId, flag);
         return {
             flag,
             fix: suggestion ??
+                missingFlagHint?.fix ??
                 `Pass --${flag} <value>. Run \`${helpCommand}\` for its description and accepted values.`,
         };
     }

package/dist/commands/agent/message/context.d.ts

@@ -14,6 +14,7 @@ export default class AgentMessageContext extends BaseCommand {
         agent: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         task: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         run: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/agent/message/context.js

@@ -26,8 +26,9 @@ class AgentMessageContext extends base_command_1.BaseCommand {
         run: core_1.Flags.string({
             description: 'Optional run context to narrow recent updates (refused inside a daemon session — the session path is already bound to its own run)',
         }),
-        // No `--json` flag: these observations exist to be parsed, so JSON is the
-        // only output. A flag that cannot be turned off is a lie in `--help`.
+        json: core_1.Flags.boolean({
+            description: 'Accepted for consistency; this command always outputs JSON',
+        }),
     };
     async run() {
         const { args, flags } = await this.parse(AgentMessageContext);

package/dist/commands/commands.js

@@ -60,6 +60,17 @@ class Commands extends base_command_1.BaseCommand {
             else {
                 this.log(`Command hygiene: ${report.ok ? 'OK' : 'FAILED'} ` +
                     `(${report.counts.errors} error(s), ${report.counts.warnings} warning(s))`);
+                this.log('Execution contracts: ' +
+                    report.execution.classified +
+                    '/' +
+                    report.execution.candidates +
+                    ' classified, ' +
+                    report.execution.humanOnlyExemptions +
+                    ' human-only exemption(s), ' +
+                    report.execution.missingReceipts +
+                    ' receipt gap(s), ' +
+                    report.execution.missingRecoveryGuidance +
+                    ' recovery gap(s).');
                 for (const issue of report.issues) {
                     const location = issue.command ? ` ${issue.command}` : '';
                     this.log(`[${issue.severity}] ${issue.code}${location}: ${issue.message}`);

package/dist/commands/commitments/action-proposal.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base-command';
+/** Read the exact Action Bundle execution receipt before any retry. */
+export default class CommitmentsActionProposal extends BaseCommand {
+    static description: string;
+    static args: {
+        commitmentId: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        proposalId: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commitments/action-proposal.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const commitments_1 = require("../../lib/commitments");
+/** Read the exact Action Bundle execution receipt before any retry. */
+class CommitmentsActionProposal extends base_command_1.BaseCommand {
+    static description = 'Show one frozen Action Bundle and its execution receipt';
+    static args = {
+        commitmentId: core_1.Args.string({ ignoreStdin: true, description: 'Commitment ID', required: true }),
+        proposalId: core_1.Args.string({
+            ignoreStdin: true,
+            description: 'Action Proposal ID',
+            required: true,
+        }),
+    };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output as JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(CommitmentsActionProposal);
+        try {
+            const result = await commitments_1.commitmentApi.actionProposal(args.commitmentId, args.proposalId);
+            if (flags.json)
+                this.printJsonResult(result);
+            else {
+                const proposal = result.proposal;
+                const execution = result.execution;
+                this.log(`Action Bundle: ${String(proposal?.status || 'unknown')}`);
+                this.log(`Operation: ${String(execution?.operationId || 'unavailable')}`);
+                const receipt = execution?.receipt;
+                this.log(`Receipt: ${String(receipt?.state || 'unknown')}`);
+            }
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+}
+exports.default = CommitmentsActionProposal;

package/dist/commands/commitments/action-proposals/decide.js

@@ -50,7 +50,14 @@ class CommitmentsActionProposalsDecide extends base_command_1.BaseCommand {
                     : {}),
             });
             const execution = decision === 'approve' && decided.status === 'approved'
-                ? await commitments_1.commitmentApi.executeActionProposal(args.commitmentId, args.proposalId)
+                ? await commitments_1.commitmentApi.executeActionProposal(args.commitmentId, args.proposalId, proposal.snapshotDigest && Number.isInteger(proposal.bundleVersion)
+                    ? {
+                        // Keep the automatic hand-off fenced to the same Action
+                        // Bundle the human decision just approved.
+                        expectedBundleVersion: proposal.bundleVersion,
+                        expectedSnapshotDigest: proposal.snapshotDigest,
+                    }
+                    : {})
                 : undefined;
             result = { decision: decided, ...(execution ? { execution } : {}) };
         }

package/dist/commands/commitments/action-proposals/execute.js

@@ -19,7 +19,17 @@ class CommitmentsActionProposalsExecute extends base_command_1.BaseCommand {
         const { args, flags } = await this.parse(CommitmentsActionProposalsExecute);
         let result;
         try {
-            result = await commitments_1.commitmentApi.executeActionProposal(args.commitmentId, args.proposalId);
+            // Read the frozen bundle first. The server compares both coordinates in
+            // its claim CAS, so a re-proposed bundle cannot inherit this nudge.
+            const inspected = await commitments_1.commitmentApi.actionProposal(args.commitmentId, args.proposalId);
+            const proposal = inspected.proposal;
+            if (!proposal || typeof proposal.bundleVersion !== 'number' || typeof proposal.snapshotDigest !== 'string') {
+                throw new Error('The Action Bundle inspection did not include its reviewed revision.');
+            }
+            result = await commitments_1.commitmentApi.executeActionProposal(args.commitmentId, args.proposalId, {
+                expectedBundleVersion: proposal.bundleVersion,
+                expectedSnapshotDigest: proposal.snapshotDigest,
+            });
         }
         catch (error) {
             this.handleApiError(error);

package/dist/commands/commitments/create.js

@@ -183,7 +183,7 @@ function commitmentActivationRefusal(err, { id, bin }) {
  */
 class CommitmentsCreate extends base_command_1.BaseCommand {
     static description = 'Create a commitment (a durable agent contract). Its cadence is manual, an interval or daily clock times; ' +
-        'it has no weekday, holiday, business-day or trading-calendar fields';
+        'activeHours and daysOfWeek in --from-json select hours and weekdays. No holiday, business-day or trading-calendar fields';
     static examples = [
         '<%= config.bin %> commitments create --agent <agent-id> --title "Ship v2" --outcome "v2 is live for all users" --cadence 6h --activate',
         '<%= config.bin %> commitments create --agent <agent-id> --title "Hiring loop" --outcome "Every candidate hears back in 48h" --watch tasks --watch email --cadence 12h',
@@ -199,7 +199,7 @@ cat > commitment.json <<'JSON'
   "title": "Daily queue review",
   "status": "draft",
   "target": { "outcome": "Queue changes are reviewed" },
-  "cadence": { "mode": "daily", "times": ["09:15", "17:45"], "timezone": "Asia/Shanghai" },
+  "cadence": { "mode": "interval", "intervalMs": 3600000, "activeHours": { "start": "09:00", "end": "22:00" }, "daysOfWeek": ["mon", "tue", "wed", "thu", "fri"], "timezone": "Asia/Shanghai" },
   "watchedSources": [{
     "source": "agent_run",
     "config": { "keys": [

package/dist/commands/commitments/doctor.d.ts

@@ -8,6 +8,14 @@ export declare function doctorVerdict(input: {
     next: string;
     why?: string;
 };
+/**
+ * The Space loop line (OSK-17989): a Commitment homed in a Space runs only while
+ * that Space's execution principal admits it. Empty for a Commitment that is not
+ * a loop. A refused loop is also the operating state's first blocker, so the
+ * verdict and next step above already say what to do; this line says which
+ * Space and why.
+ */
+export declare function spaceLoopLine(value: unknown): string;
 export default class CommitmentsDoctor extends BaseCommand {
     static description: string;
     static args: {

package/dist/commands/commitments/doctor.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.doctorVerdict = doctorVerdict;
+exports.spaceLoopLine = spaceLoopLine;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -69,6 +70,24 @@ function doctorVerdict(input) {
         ...(typeof stop?.detail === 'string' && stop.detail ? { why: stop.detail } : {}),
     };
 }
+/**
+ * The Space loop line (OSK-17989): a Commitment homed in a Space runs only while
+ * that Space's execution principal admits it. Empty for a Commitment that is not
+ * a loop. A refused loop is also the operating state's first blocker, so the
+ * verdict and next step above already say what to do; this line says which
+ * Space and why.
+ */
+function spaceLoopLine(value) {
+    if (!value || typeof value !== 'object')
+        return '';
+    const loop = value;
+    const status = loop.status || 'unreadable';
+    let detail = loop.reason ? ` (${loop.reason})` : '';
+    if (status === 'admitted') {
+        detail = loop.principalVersion ? ` (principal v${loop.principalVersion})` : '';
+    }
+    return `Space loop: ${status}${loop.spaceId ? ` · ${loop.spaceId}` : ''}${detail}`;
+}
 class CommitmentsDoctor extends base_command_1.BaseCommand {
     static description = 'Summarize commitment readiness and the next operator action';
     static args = {
@@ -106,6 +125,9 @@ class CommitmentsDoctor extends base_command_1.BaseCommand {
             const knowledge = operatingState.knowledge;
             this.log(`Space knowledge: ${knowledge.status || 'unavailable'}${knowledge.spaceId ? ` · ${knowledge.spaceId}` : ''}${knowledge.source ? ` (${knowledge.source})` : ''}; prospective scope, not a completed memory mount`);
         }
+        const loopLine = spaceLoopLine(operatingState.spaceLoop);
+        if (!flags.json && loopLine)
+            this.log(loopLine);
         if (flags.json)
             this.log(JSON.stringify(report, null, 2));
         else {

package/dist/commands/commitments/execute-remediation.js

@@ -18,7 +18,18 @@ class CommitmentsExecuteRemediation extends base_command_1.BaseCommand {
         const { args, flags } = await this.parse(CommitmentsExecuteRemediation);
         let result;
         try {
-            result = await commitments_1.commitmentApi.executeRemediationProposal(args.commitmentId, args.proposalId, flags['retry-executing'] === true);
+            const inspected = await commitments_1.commitmentApi.remediationProposal(args.commitmentId, args.proposalId);
+            const proposal = inspected.proposal;
+            if (!proposal || typeof proposal.proposalVersion !== 'number') {
+                throw new Error('The remediation proposal inspection did not include its reviewed revision.');
+            }
+            result = await commitments_1.commitmentApi.executeRemediationProposal(args.commitmentId, args.proposalId, {
+                retryExecuting: flags['retry-executing'] === true,
+                expectedRevision: proposal.proposalVersion,
+                ...(typeof proposal.updatedAt === 'string'
+                    ? { expectedUpdatedAt: proposal.updatedAt }
+                    : {}),
+            });
         }
         catch (error) {
             this.handleApiError(error);

package/dist/commands/commitments/observations.js

@@ -131,7 +131,7 @@ class CommitmentsObservations extends base_command_1.BaseCommand {
                 this.handleApiError(err);
             }
             if (flags.json)
-                this.log(JSON.stringify(response, null, 2));
+                this.printJsonResult(response);
             else
                 renderObservationWindow(response, (line) => this.log(line));
             return;
@@ -152,7 +152,7 @@ class CommitmentsObservations extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.printJsonResult(response);
         }
         else {
             // "The commitment has none" and "your filter matched none" are different

package/dist/commands/commitments/pack/bind.d.ts

@@ -5,6 +5,11 @@ import { BaseCommand } from '../../../base-command';
  * Binding is idempotent by design — the API answers 200 with `reused: true`
  * rather than minting a second draft, because a retried bind used to leave
  * duplicate Commitments behind (OSK-5763).
+ *
+ * `--space` binds the Pack into a Space as that Space's loop: held by the
+ * Space's lead unless `--agent` names another member, owned by the person
+ * binding, who must be the Space's execution-principal user and hold SHARE on
+ * it. The server refuses, and writes nothing, when the Space cannot take it.
  */
 export default class CommitmentsPackBind extends BaseCommand {
     static description: string;
@@ -13,7 +18,10 @@ export default class CommitmentsPackBind extends BaseCommand {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         pack: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'pack-version': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        agent: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        agent: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        space: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        goal: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'interval-minutes': import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
         repository: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'required-check': import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'installation-id': import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -22,3 +30,12 @@ export default class CommitmentsPackBind extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * The Space knowledge default a loop's home link reports
+ * (`CommitmentSpaceLoop.KNOWLEDGE_DEFAULT_OUTCOMES`), in words. Empty for an
+ * outcome this CLI does not know, rather than a guess.
+ */
+export declare function describeKnowledgeDefault(scope: {
+    default?: string;
+    enabled?: boolean;
+} | undefined): string;