@skrr-ai/cli 0.1.119 → 0.1.121

package/dist/commands/tasks/approvals/list.js

@@ -67,10 +67,15 @@ function refusalsOf(run) {
     for (const entry of raw) {
         if (!entry || typeof entry !== 'object')
             continue;
-        const { tool, input } = entry;
-        if (typeof input !== 'string' || !input.trim())
+        const { tool, input, inputRecorded } = entry;
+        const text = typeof input === 'string' && input.trim() ? input.trim() : null;
+        if (text === null && inputRecorded !== true)
             continue;
-        out.push({ tool: typeof tool === 'string' && tool ? tool : null, input: input.trim() });
+        out.push({
+            tool: typeof tool === 'string' && tool ? tool : null,
+            input: text,
+            inputRecorded: true,
+        });
     }
     return out;
 }
@@ -117,7 +122,7 @@ function blockedRunSummary(run, bin = 'skrr', taskRef = '<task-id>') {
         ],
     };
 }
-const SHELL_TOOL = /^(bash|shell|local_shell|exec_command|commandexecution|command_execution)$/i;
+const SHELL_TOOL = /^(bash|shell|shell_command|local_shell|exec_command|commandexecution|command_execution)$/i;
 function toolLabel(tool) {
     if (!tool)
         return '';
@@ -135,8 +140,10 @@ function permissionBlockLines(run, bin = 'skrr', taskRef = '<task-id>') {
     // The sentence already quotes a lone refused input (shortened); list an
     // input only when the sentence does not already show it.
     const refusedLines = summary.refused
-        .filter((refusal) => !reason.includes(refusal.input.slice(0, 60)))
-        .map((refusal) => `  Refused: ${refusal.input}${toolLabel(refusal.tool)}`);
+        .filter((refusal) => refusal.input === null || !reason.includes(refusal.input.slice(0, 60)))
+        .map((refusal) => refusal.input === null
+        ? `  Refused: a call${toolLabel(refusal.tool)}; its input is kept in the run transcript`
+        : `  Refused: ${refusal.input}${toolLabel(refusal.tool)}`);
     const [chat, update, restart] = summary.remedies;
     return [
         `The latest run (${summary.runId}) is blocked on a permission, not on an approval request.`,

package/dist/commands/tasks/attachments/facts.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base-command';
+export default class TasksAttachmentsFacts extends BaseCommand {
+    static description: string;
+    static args: {
+        task: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        attachment: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tasks/attachments/facts.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const api_fetch_1 = require("../../../lib/api-fetch");
+const session_task_write_1 = require("../../../lib/session-task-write");
+class TasksAttachmentsFacts extends base_command_1.BaseCommand {
+    static description = 'Read literal declarations from an exact JSON attachment; never follows referenced files';
+    static args = {
+        task: core_1.Args.string({ required: true, ignoreStdin: true }),
+        attachment: core_1.Args.string({ required: true, ignoreStdin: true }),
+    };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output source facts JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args } = await this.parse(TasksAttachmentsFacts);
+        try {
+            const session = await (0, session_task_write_1.sessionTaskWrite)('attachment', args.task);
+            const task = session?.taskId || (await this.resolveEntityRef('task', args.task));
+            const prefix = session?.path || `/api/tasks/${encodeURIComponent(task)}/attachments`;
+            const facts = await (0, api_fetch_1.apiFetch)(`${prefix}/${encodeURIComponent(args.attachment)}/source-facts`, session ? { credential: session.credential } : undefined);
+            this.printJsonResult(facts);
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+}
+exports.default = TasksAttachmentsFacts;

package/dist/commands/tasks/attachments/upload.d.ts

@@ -8,6 +8,7 @@ export default class TasksAttachmentsUpload extends BaseCommand {
     static flags: {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         file: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'resume-attachment': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         role: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;

package/dist/commands/tasks/attachments/upload.js

@@ -16,6 +16,9 @@ class TasksAttachmentsUpload extends base_command_1.BaseCommand {
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         file: core_1.Flags.string({ description: 'Path to the file to upload', required: true }),
+        'resume-attachment': core_1.Flags.string({
+            description: 'Resume this exact existing multipart attachment with the same file. Creates no replacement upload.',
+        }),
         role: core_1.Flags.string({
             description: 'Asset role: evidence (supports an Update/Result), deliverable (the media is the product), or input (forwarded into every future Run — only a person may add one; a person promotes an agent upload with `attachments set-role`). Defaults to evidence when an agent uploads, input when a person does.',
             options: ['input', 'evidence', 'deliverable'],
@@ -34,9 +37,22 @@ class TasksAttachmentsUpload extends base_command_1.BaseCommand {
                 taskId: taskRef,
                 filePath: flags.file,
                 role: flags.role,
+                ...(flags['resume-attachment'] !== undefined ? { resumeAttachmentId: flags['resume-attachment'] } : {}),
             });
         }
         catch (err) {
+            const recovery = (0, task_asset_upload_1.taskAssetUploadRecovery)(err);
+            if (recovery) {
+                const failure = err;
+                this.failWithCliError({
+                    message: failure.message,
+                    code: failure.code || 'TASK_ASSET_UPLOAD_INCOMPLETE',
+                    status: failure.status,
+                    retryable: false,
+                    exit: 1,
+                    details: { upload: recovery, suggestion: 'Resume this attachment with --resume-attachment and the same --file after resolving the reported failure.' },
+                });
+            }
             this.handleApiError(err);
         }
         if (flags.json) {

package/dist/commands/tasks/bulk-update.js

@@ -7,6 +7,7 @@ const web_url_1 = require("../../lib/web-url");
 const prompt_1 = require("../../lib/prompt");
 const dry_run_plans_1 = require("../../lib/dry-run-plans");
 const task_batch_1 = require("../../lib/task-batch");
+const space_write_policy_1 = require("../../lib/space-write-policy");
 const write_target_1 = require("../../lib/write-target");
 const tasks_1 = require("../../lib/tasks");
 class TasksBulkUpdate extends base_command_1.BaseCommand {
@@ -117,6 +118,17 @@ class TasksBulkUpdate extends base_command_1.BaseCommand {
                 let task = null;
                 if (Object.keys(row.patch).length > 0) {
                     const batched = batchByRow.get(index);
+                    // Held for approval by the Space write policy (OSK-17988): this row
+                    // changed nothing yet, and its status move is not sent on top of it.
+                    if (usedBatch && batched?.status === 'pending_approval') {
+                        results.push({
+                            id: row.id,
+                            ok: true,
+                            status: 'pending_approval',
+                            proposal: batched.proposal,
+                        });
+                        continue;
+                    }
                     if (usedBatch && batched) {
                         if (!batched.ok) {
                             throw Object.assign(new Error(batched.error?.message ?? 'Update failed'), {
@@ -138,6 +150,15 @@ class TasksBulkUpdate extends base_command_1.BaseCommand {
                             taskId: row.id,
                             data: row.patch,
                         });
+                        if ((0, space_write_policy_1.isSpaceWritePendingResponse)(task)) {
+                            results.push({
+                                id: row.id,
+                                ok: true,
+                                status: 'pending_approval',
+                                proposal: task.proposal,
+                            });
+                            continue;
+                        }
                     }
                 }
                 if (row.status !== undefined) {
@@ -151,6 +172,15 @@ class TasksBulkUpdate extends base_command_1.BaseCommand {
                         taskId: row.id,
                         status: row.status,
                     });
+                    if ((0, space_write_policy_1.isSpaceWritePendingResponse)(task)) {
+                        results.push({
+                            id: row.id,
+                            ok: true,
+                            status: 'pending_approval',
+                            proposal: task.proposal,
+                        });
+                        continue;
+                    }
                 }
                 if (!task) {
                     task = await data_provider_1.dataService.getTask(row.id, { enrich: false });
@@ -202,7 +232,11 @@ class TasksBulkUpdate extends base_command_1.BaseCommand {
         else {
             this.log(`Bulk update complete: ${summary.succeeded}/${summary.requested} succeeded, ${summary.failed} failed.`);
             for (const result of results) {
-                if (result.ok) {
+                if (result.status === 'pending_approval') {
+                    const proposal = result.proposal;
+                    this.log(`- held for approval ${result.id}: nothing changed yet (bundle ${proposal?.id}, item ${proposal?.itemId})`);
+                }
+                else if (result.ok) {
                     this.log(`- updated ${(0, tasks_1.formatTaskLabel)(result.task)}`);
                 }
                 else {

package/dist/commands/tasks/context.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base-command';
+/** Print the server-authorized, read-only Agent Context for one Task. */
+export default class TasksContext extends BaseCommand {
+    static description: string;
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        task: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    static examples: string[];
+    run(): Promise<void>;
+    protected wantsJsonOutput(): boolean;
+}

package/dist/commands/tasks/context.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const task_resolver_1 = require("../../lib/task-resolver");
+const task_agent_context_compatibility_1 = require("../../lib/task-agent-context-compatibility");
+/** Print the server-authorized, read-only Agent Context for one Task. */
+class TasksContext extends base_command_1.BaseCommand {
+    static description = 'Read the server-authorized, redacted Agent Context for a Task without starting execution';
+    static args = {
+        id: core_1.Args.string({ description: 'Task ID/ref; defaults to the current Task runtime', ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the machine-readable Agent Context as JSON' }),
+        task: core_1.Flags.string({ description: 'Task ID/ref; overrides current Task runtime context' }),
+    };
+    static examples = [
+        '<%= config.bin %> tasks context OSK-123 --json',
+        '<%= config.bin %> tasks context --task OSK-123 --json',
+    ];
+    async run() {
+        this.setJsonOperation({ command: 'tasks:context', mode: 'read', writeState: 'not_attempted' });
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksContext);
+        let identity;
+        try {
+            identity = (0, task_resolver_1.resolveTaskIdentity)({ positionalId: args.id, flagTask: flags.task });
+        }
+        catch (error) {
+            const failure = (0, task_resolver_1.taskResolutionFailure)(error);
+            this.failWithCliError({
+                message: failure.message,
+                code: failure.code,
+                exit: 2,
+                retryable: false,
+                details: failure.suggestion ? { suggestion: failure.suggestion } : undefined,
+            });
+        }
+        // `resolveTaskIdentity` decides which INPUT wins; it does no lookup. This
+        // turns whatever it picked into something the API can resolve — a UUID and
+        // an OSK-2423 ref pass through untouched, a title is searched.
+        const taskId = await this.resolveTaskReference(identity.id);
+        try {
+            const context = await data_provider_1.dataService.getTaskAgentContext(taskId, {
+                headers: (0, task_agent_context_compatibility_1.taskAgentContextRequestHeaders)(this.config.root),
+            });
+            if (!context?.task?.id) {
+                this.failWithCliError({
+                    message: 'The server did not return a canonical Task identity for this Agent Context.',
+                    code: 'TASK_AGENT_CONTEXT_IDENTITY_UNCONFIRMED',
+                    exit: 2,
+                    retryable: false,
+                });
+            }
+            this.printJsonOperation(context, {
+                resource: { kind: 'task', id: context.task.id },
+                task: { id: context.task.id },
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+    wantsJsonOutput() {
+        return true;
+    }
+}
+exports.default = TasksContext;

package/dist/commands/tasks/copy.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../base-command';
+/** A deliberate cross-Space handoff; distinct from in-Space duplicate-pipeline. */
+export default class TasksCopy extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        space: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        title: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'idempotency-key': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tasks/copy.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const web_url_1 = require("../../lib/web-url");
+/** A deliberate cross-Space handoff; distinct from in-Space duplicate-pipeline. */
+class TasksCopy extends base_command_1.BaseCommand {
+    static description = 'Copy a task brief into another Space without source assignments, history, attachments, or media references';
+    static examples = [
+        '<%= config.bin %> tasks copy <task-id> --space <target-space> --dry-run',
+        '<%= config.bin %> tasks copy <task-id> --space <target-space> --idempotency-key handoff-2026-10-23',
+        '<%= config.bin %> tasks copy <task-id> --space <target-space> --title "Partner handoff" --json',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Source task ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the transfer plan or copied task as JSON' }),
+        space: core_1.Flags.string({
+            description: 'Destination Space ID (required; source and destination must differ)',
+            required: true,
+        }),
+        title: core_1.Flags.string({ description: 'Optional title override for the destination task' }),
+        description: core_1.Flags.string({
+            description: 'Optional description override. Task-asset and space-file references are always removed from a cross-Space copy.',
+        }),
+        'dry-run': core_1.Flags.boolean({
+            description: 'Validate source VIEW and target EDIT, then print the exact safe transfer plan without writing',
+        }),
+        'idempotency-key': core_1.Flags.string({
+            description: 'Required for a real handoff: a stable key for this exact copy. Reuse it after an ambiguous response to replay rather than creating another copy.',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksCopy);
+        if (!flags['dry-run'] && !flags['idempotency-key']) {
+            this.failWithCliError({
+                message: 'A real cross-Space copy requires --idempotency-key <stable-key> so an interrupted handoff can be retried without creating another task. Run --dry-run first to inspect the transfer plan.',
+                code: 'IDEMPOTENCY_KEY_REQUIRED',
+                exit: 2,
+                retryable: false,
+            });
+        }
+        const sourceTaskId = await this.resolveEntityRef('task', args.id);
+        const targetSpaceId = await this.resolveEntityRef('space', flags.space);
+        const idempotencyKey = flags['idempotency-key'];
+        let result;
+        try {
+            result = await data_provider_1.dataService.copyTask(sourceTaskId, {
+                spaceId: targetSpaceId,
+                ...(flags.title ? { title: flags.title } : {}),
+                ...(flags.description !== undefined ? { description: flags.description } : {}),
+                ...(flags['dry-run'] ? { dryRun: true } : {}),
+            }, flags['dry-run'] ? undefined : { idempotencyKey });
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        const task = result.task;
+        const payload = {
+            ...result,
+            ...(flags['dry-run'] ? {} : { idempotencyKey }),
+            ...(task ? { url: (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, task) } : {}),
+        };
+        if (flags.json) {
+            this.printJsonResult(payload);
+            return;
+        }
+        if (result.dryRun) {
+            this.log(`Copy plan is valid: ${sourceTaskId} → Space ${targetSpaceId}`);
+            this.log(`Will carry: ${result.copiedFields.join(', ')}`);
+            this.log(`Will omit: ${result.omittedFields.join(', ')}`);
+            return;
+        }
+        this.log(`Copied task ${sourceTaskId} → ${task?.id ?? '-'} in Space ${targetSpaceId}`);
+        this.log(`Idempotency key: ${idempotencyKey}`);
+        const taskUrl = task ? (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, task) : null;
+        if (taskUrl)
+            this.log(taskUrl);
+    }
+}
+exports.default = TasksCopy;

package/dist/commands/tasks/create-tree.js

@@ -205,7 +205,10 @@ class TasksCreateTree extends base_command_1.BaseCommand {
             description: 'After applying, reread every confirmed Task and report declared structured-field mismatches and read failures. This checks declarations, not whether Expectations are met. No repair or retry is performed by the readback.',
             exclusive: ['verify', 'verify-spec', 'dry-run'],
         }),
-        unassigned: core_1.Flags.boolean({ description: 'Explicitly clear assignees on every node, suppressing session/parent/Space defaults while retaining any declared executor intent. Does not start tasks.', exclusive: ['default-agent'] }),
+        unassigned: core_1.Flags.boolean({
+            description: 'Explicitly clear assignees on every node, suppressing session/parent/Space defaults while retaining any declared executor intent. Does not start tasks.',
+            exclusive: ['default-agent'],
+        }),
         'external-key-prefix': core_1.Flags.string({
             description: 'Generate externalKey for nodes that omit one; enables idempotent re-runs. Defaults to a prefix derived from the file content (see --fresh)',
         }),
@@ -232,10 +235,18 @@ class TasksCreateTree extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { flags } = await this.parse(TasksCreateTree);
-        this.setJsonOperation({ command: 'tasks:create-tree', mode: flags['verify-spec'] || flags.verify ? 'verify' : flags['dry-run'] ? 'dry_run' : 'execute' });
+        this.setJsonOperation({
+            command: 'tasks:create-tree',
+            mode: flags['verify-spec'] || flags.verify ? 'verify' : flags['dry-run'] ? 'dry_run' : 'execute',
+        });
         const unassignmentError = (0, tasks_1.taskUnassignmentFlagError)(flags);
         if (unassignmentError)
-            this.failWithCliError({ message: unassignmentError, code: 'TASK_UNASSIGNED_CONFLICT', exit: 2, retryable: false });
+            this.failWithCliError({
+                message: unassignmentError,
+                code: 'TASK_UNASSIGNED_CONFLICT',
+                exit: 2,
+                retryable: false,
+            });
         let input = {};
         try {
             input = await (0, prompt_1.readJsonBody)(flags['from-json']);
@@ -287,7 +298,9 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         for (const item of planned) {
             try {
                 (0, tasks_1.applyExplicitTaskUnassignment)(item.payload, Boolean(flags.unassigned));
-                const parentSpace = item.parentKey ? plannedByKey.get(item.parentKey)?.payload.spaceId : undefined;
+                const parentSpace = item.parentKey
+                    ? plannedByKey.get(item.parentKey)?.payload.spaceId
+                    : undefined;
                 if (!item.payload.spaceId && typeof parentSpace === 'string')
                     item.payload.spaceId = parentSpace;
                 await this.resolveTaskResourceReferences(item.payload);
@@ -424,7 +437,9 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         // Say so before anything is written, not only inside a dry run (OSK-S-440 #9).
         const agentAssignment = describeDefaultAgentAssignment(defaultAgentResolutions);
         const noteworthyAssignment = agentAssignment ? [agentAssignment] : [];
-        const target = await this.assertWriteTarget(flags['expect-target'], { preview: flags['dry-run'] });
+        const target = await this.assertWriteTarget(flags['expect-target'], {
+            preview: flags['dry-run'],
+        });
         if (flags['dry-run']) {
             const result = {
                 object: 'task_create_tree_dry_run',
@@ -483,6 +498,9 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         // a request can continue on the server after its client is interrupted.
         const mapping = {};
         const results = [];
+        // Nodes the Space write policy held for approval (OSK-17988), and the nodes
+        // waiting on them: not written, not failed.
+        const heldRows = [];
         const startedAt = Date.now();
         let rounds = 0;
         const next = this.nextCommand(flags);
@@ -501,11 +519,26 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                     (0, node_fs_1.writeSync)(2, `Confirmed mapping: ${JSON.stringify(mapping)}\n`);
                 if (flags.json)
                     (0, node_fs_1.writeSync)(1, JSON.stringify((0, json_output_1.withCliOperation)({
-                        object: 'task_create_tree_result', ok: false, interrupted: true, signal,
-                        total: planned.length, count: confirmed, mapping: { ...mapping }, target,
-                        summary: { confirmed, unknown, notAttempted: planned.length - confirmed - unknown },
+                        object: 'task_create_tree_result',
+                        ok: false,
+                        interrupted: true,
+                        signal,
+                        total: planned.length,
+                        count: confirmed,
+                        mapping: { ...mapping },
+                        target,
+                        summary: {
+                            confirmed,
+                            unknown,
+                            notAttempted: planned.length - confirmed - unknown,
+                        },
                         recovery,
-                    }, { command: 'tasks:create-tree', mode: 'execute', outcome: 'failed', writeState: 'unknown' }), null, 2) + '\n');
+                    }, {
+                        command: 'tasks:create-tree',
+                        mode: 'execute',
+                        outcome: 'failed',
+                        writeState: 'unknown',
+                    }), null, 2) + '\n');
             }
             finally {
                 process.exit(signal === 'SIGINT' ? 130 : 143);
@@ -519,15 +552,25 @@ class TasksCreateTree extends base_command_1.BaseCommand {
             // A half-applied tree reports the ids it did create; the only way back.
             const reportPartial = (item, failure, err, failures) => {
                 if (failure.code === 'PROJECT_NOT_FOUND') {
-                    failure = { ...failure, message: `Project '${String(item.payload.projectId)}' was not found in space '${String(item.payload.spaceId)}'. Correct --project or the node's projectId` };
+                    failure = {
+                        ...failure,
+                        message: `Project '${String(item.payload.projectId)}' was not found in space '${String(item.payload.spaceId)}'. Correct --project or the node's projectId`,
+                    };
                 }
-                const failureRows = failures ?? [{
+                const failureRows = failures ?? [
+                    {
                         tempId: item.key,
                         externalKey: item.payload.externalKey,
-                        outcome: !failure.status || failure.status === 408 || failure.status >= 500 ? 'unknown' : 'failed',
+                        outcome: !failure.status || failure.status === 408 || failure.status >= 500
+                            ? 'unknown'
+                            : 'failed',
                         error: failure,
-                    }];
-                const accountedFor = new Set([...Object.keys(mapping), ...failureRows.map((row) => String(row.tempId))]);
+                    },
+                ];
+                const accountedFor = new Set([
+                    ...Object.keys(mapping),
+                    ...failureRows.map((row) => String(row.tempId)),
+                ]);
                 for (const node of planned) {
                     if (accountedFor.has(node.key))
                         continue;
@@ -535,7 +578,10 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                         tempId: node.key,
                         externalKey: node.payload.externalKey,
                         outcome: 'not_attempted',
-                        error: { message: 'Not attempted because an earlier node stopped the tree', retryable: true },
+                        error: {
+                            message: 'Not attempted because an earlier node stopped the tree',
+                            retryable: true,
+                        },
                     });
                 }
                 const partial = partialFailureResult({
@@ -555,7 +601,10 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                     },
                 });
                 if (flags.json) {
-                    this.printJsonOperation({ ...partial, target }, { outcome: 'failed', writeState: partial.summary.unknown > 0 ? 'unknown' : 'confirmed' });
+                    this.printJsonOperation({ ...partial, target }, {
+                        outcome: 'failed',
+                        writeState: partial.summary.unknown > 0 ? 'unknown' : 'confirmed',
+                    });
                     process.exitCode = partial.failedAt.error.retryable ? 5 : 1;
                     this.exit(partial.failedAt.error.retryable ? 5 : 1);
                 }
@@ -710,6 +759,16 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                                 },
                             });
                         }
+                        for (const row of outcome.held) {
+                            const node = byKey.get(row.key);
+                            heldRows.push({
+                                tempId: row.key,
+                                parentTempId: node?.parentKey,
+                                action: row.reason === 'pending_approval' ? 'pending_approval' : 'waiting_on_approval',
+                                title: node?.payload.title,
+                                ...(row.proposal ? { proposal: row.proposal } : {}),
+                            });
+                        }
                         const failure = outcome.failures.find((f) => !f.skipped) ?? outcome.failures[0];
                         if (failure) {
                             const node = byKey.get(failure.key);
@@ -773,6 +832,7 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                 timing: { elapsedMs: Date.now() - startedAt, requests: rounds },
                 mapping,
                 results,
+                ...(heldRows.length > 0 ? { held: heldRows } : {}),
                 ...(verification ? { verification } : {}),
             };
             if (flags.json) {
@@ -788,6 +848,15 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                 if (item.url)
                     this.log(`  ${item.url}`);
             }
+            if (heldRows.length > 0) {
+                this.log(`Held for approval by the Space write policy (${heldRows.length} node(s), nothing written for them):`);
+                for (const row of heldRows) {
+                    const proposal = row.proposal;
+                    this.log(`- ${row.tempId}: ${row.action === 'pending_approval'
+                        ? `held in approval bundle ${proposal?.id} (item ${proposal?.itemId})`
+                        : 'waits on a held node; send it again once that node exists'}`);
+                }
+            }
             if (verification)
                 this.printSpecificationSummary(verification);
             if (verification && !verification.ok)
@@ -799,18 +868,23 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         }
     }
     async readbackSpecifications(planned, mapping) {
-        const inputs = planned.map(item => {
+        // A node held for approval has no id yet; there is nothing to read back.
+        const inputs = planned
+            .filter((item) => mapping[item.key])
+            .map((item) => {
             const expected = { ...item.payload };
             if (item.parentKey)
                 expected.parentId = mapping[item.parentKey];
             if (item.blockerKeys?.length)
-                expected.blockedByIds = [...new Set([
+                expected.blockedByIds = [
+                    ...new Set([
                         ...(expected.blockedByIds ?? []),
-                        ...item.blockerKeys.map(key => mapping[key]),
-                    ])];
+                        ...item.blockerKeys.map((key) => mapping[key]),
+                    ]),
+                ];
             return { tempId: item.key, id: mapping[item.key], expected };
         });
-        return (0, task_spec_verification_1.verifyTaskSpecifications)(inputs, id => data_provider_1.dataService.getTask(id, { enrich: false }));
+        return (0, task_spec_verification_1.verifyTaskSpecifications)(inputs, (id) => data_provider_1.dataService.getTask(id, { enrich: false }));
     }
     printSpecificationSummary(verification) {
         const { summary } = verification;
@@ -863,12 +937,12 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         }
         let verification;
         if (flags['verify-spec']) {
-            const mapping = Object.fromEntries(existing.map(row => [String(row.tempId), String(row.id)]));
+            const mapping = Object.fromEntries(existing.map((row) => [String(row.tempId), String(row.id)]));
             const checkable = [];
             for (const item of planned) {
                 if (!mapping[item.key] || cannotCheck.has(item.key))
                     continue;
-                const unresolved = [item.parentKey, ...(item.blockerKeys ?? [])].filter(key => key && !mapping[key]);
+                const unresolved = [item.parentKey, ...(item.blockerKeys ?? [])].filter((key) => key && !mapping[key]);
                 if (unresolved.length) {
                     cannotCheck.set(item.key, `Cannot resolve related node(s): ${unresolved.join(', ')}`);
                     continue;

package/dist/commands/tasks/create.js

@@ -116,7 +116,9 @@ function taskMatchesCreateIdentity(task, payload) {
         if (!Array.isArray(payload[field]))
             continue;
         const requested = [...new Set(payload[field].map(String))].sort();
-        const actual = [...new Set(Array.isArray(task[field]) ? task[field].map(String) : [])].sort();
+        const actual = [
+            ...new Set(Array.isArray(task[field]) ? task[field].map(String) : []),
+        ].sort();
         if (JSON.stringify(actual) !== JSON.stringify(requested))
             return false;
     }
@@ -426,6 +428,9 @@ class TasksCreate extends base_command_1.BaseCommand {
             catch (err) {
                 this.failTaskCreate(err, payload, flags.goal !== undefined);
             }
+            // Held for approval by the Space write policy: nothing was instantiated.
+            if (this.reportHeldSpaceWrite(instantiated, { json: flags.json }))
+                return;
             const root = instantiated.rootTask ||
                 (instantiated.rootTasks || [])[0];
             const url = root ? (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, root) : undefined;
@@ -603,6 +608,9 @@ class TasksCreate extends base_command_1.BaseCommand {
                 this.failTaskCreate(retryErr, payload, flags.goal !== undefined);
             }
         }
+        // Held for approval by the Space write policy: nothing was created.
+        if (this.reportHeldSpaceWrite(created, { json: flags.json }))
+            return;
         const url = (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, created);
         // Before either output path, and via `warn` so it reaches stderr — `--json`
         // stdout stays a parseable task row.