@skrr-ai/cli 0.1.121 → 0.1.123

package/dist/generated/agent-guides.json

@@ -691,7 +691,7 @@
                         "id": "delivery-statuses",
                         "title": "Delivery statuses",
                         "readWhen": "a send answered and you need to know what its status means",
-                        "tokens": 723,
+                        "tokens": 726,
                         "aliases": [],
                         "explains": [
                             "agent_not_authorized_for_session",
@@ -709,7 +709,7 @@
                 ]
             }
         ],
-        "hash": "dbdf1cf8629e980d7946574d0fb3b06dedc0a96a77c89d016f653b01eb6a8d9a",
+        "hash": "da48eab97c0c8b0102894a1256266cd67df3611313caec27ffff1ef2c2ec87ae",
         "tokens": 544
     },
     "routedIndex": {
@@ -2027,7 +2027,7 @@
             "routed": false,
             "aliases": [],
             "body": "## Concept model\n\nAn **Agent Update** is a deliberate owner-facing message. It is conversation, not\nrecord: what durably changed belongs to the work's own records, and the message\npoints at it.\n\n## Agent Updates\n\nProactively message the owner whenever it would improve their ability to steer the work, understand\na meaningful change, or stay confidently involved. Adapt to the task, uncertainty and stakes, the\nuser's engagement, what you have already communicated, and any per-agent style direction. Do not\nfollow a fixed schedule or manufacture status chatter.\n\n- Choose the semantic kind: `milestone` for a meaningful completed stage, `status` for a\n  useful non-blocking checkpoint, `decision` for a concrete choice, `blocker` when user action is needed to\n  continue, and one `result` for the terminal outcome (including failure).\n- Declare the attention intent with `--attention ambient|notify|interrupt`: `ambient` stays in\n  the durable timeline by default, `notify` is worth seeing soon, and `interrupt` is reserved for\n  work that is blocked or genuinely time-sensitive. The system and the user choose delivery channels and native\n  presentation; attention never directly selects an Android channel, iOS interruption level, sound, or critical\n  alert, and never bypasses notification preferences, quiet hours, Focus, or rate limits.\n- Say what is newly true and what it changes for the work. Include the next step, decision, or\n  uncertainty when it would help the user; do not force every message into a fixed template.\n- Write like a capable teammate giving a busy owner a real, in-the-moment briefing — not like a\n  system log, a customer-service script, or a task template. Open on the thing itself, never on a\n  subject line (\"Status on the refactor:\", \"Quick update:\"). In the user's language, lead with the\n  fresh fact, decision, or risk; then make clear why it matters and what happens next. Where the\n  evidence is available, ground the update in one or two useful specifics: the affected thing, the\n  evidence, the timing, or the trade-off.\n  Use plain, varied sentences and only the confidence the evidence earns. Keep them short: where a\n  dash would staple two clauses into one, use two sentences instead. Be warm and direct, but\n  never manufacture familiarity, emotion, certainty, or colour that is not true. Avoid AI-shaped\n  filler such as \"I am pleased to report\", \"completed / in progress / next step\" recaps,\n  \"I will continue to monitor\", \"feel free to let me know\", ceremonial thanks, and vague claims\n  such as \"the optimization is complete\". Say the thing instead: \"The migration is in; the\n  slowest query fell from 2.8s to 420ms. I am running the full regression now and will flag any\n  breakage before merge.\" Treat that as a standard of specificity, not a rigid script. Do not make\n  a message longer merely to sound human.\n- Task context and card presentation are separate. A managed session's task context is derived\n  server-side, but a message shows no Task Card unless you explicitly choose `--attach-task-card`\n  (or `presentation.taskCard: true`). Use a card when it materially helps the user open or follow the\n  live task; omit it for ordinary conversational updates.\n- In a hand-started session, use `skrr agent message context --agent <id>` when recent\n  updates, read state, or a user's reply would help your judgment. It supplies observations, not a\n  schedule or a command to send.\n- In a skrr-managed session, do not pass task, run, or session identity: skrr derives it.\n  In a hand-started session, add `--task <task-id>` only when you know the correct task; it is\n  declared context.\n- Prefer one message for one thought. For a conversational owner DM — such as a pitch, invitation,\n  question, or progress update — when a draft exceeds roughly 320 characters or contains two independent thoughts,\n  normally use a 2–4 message human-scale sequence with `--part \"<next thought>\"` and one explicit semantic\n  `--idempotency-key`. Do not fragment a single thought merely to send more messages, and never split text\n  mechanically: choose the semantic boundaries yourself. If one part does not reach the user, the remaining parts\n  are deliberately not sent — the user would otherwise read your thoughts out of order.\n- An idempotency key names ONE update for this agent permanently, so make it specific to this run\n  (for example `<task-id>:verify-complete`). Reuse it only to retry that same update: reused with\n  the same text it is dropped as a duplicate, and with different text it is rejected.\n- A non-`delivered` status (`held`, `approval_required`, `duplicate`, `dropped`) is a policy\n  outcome, not an error. It is never a reason to bypass this command with a direct DM or Slack\n  call — this is the only sanctioned agent-to-user path.\n\n## Authority\n\n| Actor | May do | Only a person may do |\n| --- | --- | --- |\n| Agent | Decide to message; declare kind, attention intent, task context and a task card | Choose the delivery channel or native presentation; release a held or approval-gated intent |\n| Person | Everything an Agent may do | — |\n\n## Live state\n\n- `skrr agent message context --agent <id>` — recent updates, read state and owner engagement, as observations for the decision above.\n\n## Related guides\n\n- `tasks` — the records an update points at, and the durable version of what changed.\n- `agents` — which Agent a session speaks as; its `identity` section owns the agent-context refusals.",
-            "hash": "40d317231d49b148679d13df5c33673a8bcdafd8053602f3e050e618315f78c9",
+            "hash": "2ca0bfacfd5ac8edcfe5e36ca344d8698f02874e2786646c4f03bea28ca623d9",
             "tokens": 1359,
             "sections": [
                 {
@@ -2073,7 +2073,7 @@
                     "id": "delivery-statuses",
                     "title": "Delivery statuses",
                     "readWhen": "a send answered and you need to know what its status means",
-                    "tokens": 723,
+                    "tokens": 726,
                     "aliases": [],
                     "explains": [
                         "agent_not_authorized_for_session",
@@ -8053,7 +8053,7 @@
                     "id": "delivery-statuses",
                     "title": "Delivery statuses",
                     "readWhen": "a send answered and you need to know what its status means",
-                    "tokens": 723,
+                    "tokens": 726,
                     "aliases": [],
                     "explains": [
                         "agent_not_authorized_for_session",
@@ -8130,7 +8130,7 @@
                     "id": "delivery-statuses",
                     "title": "Delivery statuses",
                     "readWhen": "a send answered and you need to know what its status means",
-                    "tokens": 723,
+                    "tokens": 726,
                     "aliases": [],
                     "explains": [
                         "agent_not_authorized_for_session",
@@ -8206,7 +8206,7 @@
                     "id": "delivery-statuses",
                     "title": "Delivery statuses",
                     "readWhen": "a send answered and you need to know what its status means",
-                    "tokens": 723,
+                    "tokens": 726,
                     "aliases": [],
                     "explains": [
                         "agent_not_authorized_for_session",
@@ -8244,9 +8244,9 @@
                 "delivery_mode_ask_first",
                 "delivery_policy_unavailable"
             ],
-            "body": "Read this when a send answered and you need to know what its status means.\n\n| Status | Meaning |\n| --- | --- |\n| `submitted` | recorded, not yet dispatched — still owned by the platform |\n| `held` | policy withheld it for now; it may still be delivered — `reason` says why |\n| `re_evaluation` | being re-checked against policy — still owned by the platform |\n| `approval_required` | waiting on the person’s approval; `initiativeId` names what they act on |\n| `authorized` | cleared for dispatch — still owned by the platform |\n| `dispatching` | being delivered right now |\n| `delivered` | reached the user |\n| `transport_failed` | delivery errored; `retryable` and `retryAfter` say whether to try again |\n| `dropped` | will not be delivered — read `reason` and change the request before resending |\n| `expired` | outlived its window before delivery |\n| `cancelled` | withdrawn before delivery |\n| `duplicate` | the idempotency key already carried this identical update — the earlier send stands |\n| `accepted` | an earlier send already delivered this update |\n| `failed` | the transport could not deliver; `retryable` says whether a retry can help |\n| `queued_offline` | held by the local daemon until it can reach the platform — still in flight |\n| `refused` | a guard declined the send; `reason` names it |\n| `unknown` | the transport could not certify the outcome |\n\nA `held`, `approval_required` or `dropped` result carries `reason`; an approval\ncarries `initiativeId` for the person to act on; a transport failure carries\n`retryable` and `retryAfter`. The exit code is `0` while the platform still owns\nthe outcome — `3` is retryable non-delivery, `4` terminal.\n\n## Refusals\n\n| Code | Cause | Fix |\n| --- | --- | --- |\n| `agent_not_authorized_for_session` | The send names an agent the session is not bound to | Drop `--agent`, or send as the agent the session runs |\n| `session_claim_required` | No session or claim authorizes the send | Run inside the managed session, or sign in and send as the person |\n| `context_task_not_authorized_for_session` | The declared `--task` is not this session's | Omit `--task`; a managed session derives it |\n| `task_context_forbidden` | The declared task is not accessible to the sender | Omit `--task`, or name a task you can see |\n| `main_chat_disabled` | The owner's main chat is off | Tell the person; do not route around it |\n| `destination_not_allowed` | Workspace policy excludes this destination | Send to an allowed destination, or ask the person to change policy |\n| `delivery_mode_off` | The owner's delivery mode delivers nothing | Do not resend; say it in the conversation instead |\n| `delivery_mode_suggestions_only` | Policy keeps the update as a suggestion | Leave it — the person sees it in-product |\n| `delivery_mode_ask_first` | Policy wants the person's approval first | Wait for the approval; do not resend |\n| `delivery_policy_unavailable` | Policy could not be read, so the send failed closed | Retry once; if it repeats, tell the person |",
-            "hash": "9275d762097f417bca3fc2f5b8d643036cd818af68438ed72cd6374cb134df99",
-            "tokens": 723,
+            "body": "Read this when a send answered and you need to know what its status means.\n\n| Status | Meaning |\n| --- | --- |\n| `submitted` | recorded, not yet dispatched — still owned by the platform |\n| `held` | policy withheld it for now; it may still be delivered — `reason` says why |\n| `re_evaluation` | being re-checked against policy — still owned by the platform |\n| `approval_required` | waiting on the person’s approval; `initiativeId` names what they act on |\n| `authorized` | cleared for dispatch — still owned by the platform |\n| `dispatching` | being delivered right now |\n| `delivered` | reached the user |\n| `transport_failed` | delivery errored; `retryable` and `retryAfter` say whether to try again |\n| `dropped` | will not be delivered — read `reason` and change the request before resending |\n| `expired` | outlived its window before delivery |\n| `cancelled` | withdrawn before delivery |\n| `duplicate` | the idempotency key already carried this identical update — the earlier send stands |\n| `accepted` | an earlier send already delivered this update |\n| `failed` | the transport could not deliver; `retryable` says whether a retry can help |\n| `queued_offline` | held by the local daemon until it can reach the platform — still in flight |\n| `refused` | a guard declined the send; `reason` names it |\n| `unknown` | the transport could not certify the outcome |\n\nA `held`, `approval_required` or `dropped` result carries `reason`; an approval\ncarries `initiativeId` for the person to act on; a transport failure carries\n`retryable` and `retryAfter`. The exit code is `0` while the platform still owns\nthe outcome — `3` is retryable non-delivery, `4` terminal.\n\n## Refusals\n\n| Code | Cause | Fix |\n| --- | --- | --- |\n| `agent_not_authorized_for_session` | The send names an agent the session is not bound to | Drop `--agent`, or send as the agent the session runs |\n| `session_claim_required` | No session or claim authorizes the send | Run inside the managed session, or sign in and send as the person |\n| `context_task_not_authorized_for_session` | The declared `--task` is not this session's | Omit `--task`; a managed session derives it |\n| `task_context_forbidden` | The declared task was not found or is not accessible in this workspace | Check the task and workspace, or omit `--task` |\n| `main_chat_disabled` | The owner's main chat is off | Tell the person; do not route around it |\n| `destination_not_allowed` | Workspace policy excludes this destination | Send to an allowed destination, or ask the person to change policy |\n| `delivery_mode_off` | The owner's delivery mode delivers nothing | Do not resend; say it in the conversation instead |\n| `delivery_mode_suggestions_only` | Policy keeps the update as a suggestion | Leave it — the person sees it in-product |\n| `delivery_mode_ask_first` | Policy wants the person's approval first | Wait for the approval; do not resend |\n| `delivery_policy_unavailable` | Policy could not be read, so the send failed closed | Retry once; if it repeats, tell the person |",
+            "hash": "ccd29be3e464db42898f221deca9c8f831c1929d0370d05a0c333def57172a3d",
+            "tokens": 726,
             "sections": [
                 {
                     "id": "writing",
@@ -8291,7 +8291,7 @@
                     "id": "delivery-statuses",
                     "title": "Delivery statuses",
                     "readWhen": "a send answered and you need to know what its status means",
-                    "tokens": 723,
+                    "tokens": 726,
                     "aliases": [],
                     "explains": [
                         "agent_not_authorized_for_session",

package/dist/lib/agentic-stream.d.ts

@@ -11,11 +11,31 @@ import { type PublicProjection, type AssistantTextJoiner } from '@skrr-ai/data-p
  * — consent nobody gave, on a form nobody saw (OSK-10274).
  */
 export declare const NON_INTERACTIVE_QUESTION_DISMISSAL: string;
+/**
+ * A terminal that has printed the header and nothing else for several seconds looks hung. The
+ * first line comes after this long with no output at all, and then again at this interval
+ * (OSK-20427). Typical waits are 4 to 6 seconds before the first words, so a quick reply
+ * prints nothing extra.
+ */
+export declare const WAITING_NOTICE_AFTER_MS = 2500;
+export declare const WAITING_NOTICE_EVERY_MS = 10000;
 export type AgenticStreamEvent = {
     type: string;
     sessionId?: string;
     [key: string]: unknown;
 };
+/**
+ * The sentence a failed run's terminal event gives for why it failed.
+ *
+ * The server's failure funnel (`handleSessionFailure`) sends `errors: [<sentence>]`
+ * and a short `reason`, never a `message`; other terminal events carry `message`,
+ * and a few an `error` string. Every reader used to look at `message` alone, so a
+ * run the platform refused ("no valid release package", "insufficient balance", a
+ * runtime that was not there) ended as `Error: Agent run failed` with the reason
+ * sitting unread in the same event (OSK-20410). One reader, in one order: the
+ * explicit `message`, then `error`, then the first entry of `errors`.
+ */
+export declare function terminalFailureMessage(event: Record<string, unknown> | null | undefined): string | undefined;
 export type AgenticStreamResult = {
     sessionId: string;
     responseMessageId?: string;
@@ -161,6 +181,12 @@ export type AgenticStreamOptions = {
     /** Action-required notices when stdout is reserved for a final result. */
     statusOutput?: NodeJS.WritableStream;
     jsonl?: boolean;
+    /**
+     * With `jsonl`, a `text.delta` carries only the characters it adds (`delta`), not the whole
+     * answer so far, and not the envelopes `session.output` already carries. A rewrite that is not
+     * an append arrives as `replace`, the new full text. `run.result` still holds the whole answer.
+     */
+    incrementalText?: boolean;
     approveTools?: boolean;
     input?: NodeJS.ReadableStream;
     output?: NodeJS.WritableStream;
@@ -579,6 +605,12 @@ export declare class AgenticStreamClient {
     private readonly openQuestionPrompts;
     /** Text already written to the terminal, for suffix-only rendering. */
     private renderedText;
+    /** The "still waiting" line for a terminal run with no output yet (OSK-20427). */
+    private waitingTimer;
+    private waitingStartedAt;
+    private outputSeen;
+    /** The cumulative text of the last `text.delta` written as JSON, for `delta`/`replace`. */
+    private lastJsonlText;
     private idleTimer;
     /** Releases a connect wait still in flight; `close()` calls it. */
     private abandonConnectWait;
@@ -777,6 +809,20 @@ export declare class AgenticStreamClient {
      * passed through, preserving prior behaviour.
      */
     private emitToolEvent;
+    /**
+     * Say so when a terminal run has been quiet since it started. Human output only: a script
+     * reading --jsonl has the events, and --quiet asked for nothing but the answer.
+     */
+    private trackWaiting;
+    private stopWaiting;
+    /**
+     * A `text.delta` is named for a delta and carries the whole answer so far (`text`), so a long
+     * answer written as JSON lines grows with the square of its length: 207 events for a 2.4 KB
+     * answer came to about 250 KB (OSK-20428). The contract stays, since scripts take the last one;
+     * `delta` is added to it, and `incrementalText` turns the cumulative text and the duplicated
+     * envelopes off for a consumer that wants only what is new.
+     */
+    private jsonlView;
     private emit;
     /**
      * Human-mode lines for the hand-over wait. Returns true when the event is

package/dist/lib/agentic-stream.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgenticStreamClient = exports.USER_CONNECTION_CAP_CODE = exports.CODEX_DECLINED_TOOL_OUTPUTS = exports.TYPE_AHEAD_DISCARD_MS = exports.HANDOVER_POLL_INTERVAL_MS = exports.DAEMON_HANDOVER_REASON = exports.WORKER_REPLACED_CODE = exports.NON_INTERACTIVE_QUESTION_DISMISSAL = void 0;
+exports.AgenticStreamClient = exports.USER_CONNECTION_CAP_CODE = exports.CODEX_DECLINED_TOOL_OUTPUTS = exports.TYPE_AHEAD_DISCARD_MS = exports.HANDOVER_POLL_INTERVAL_MS = exports.DAEMON_HANDOVER_REASON = exports.WORKER_REPLACED_CODE = exports.WAITING_NOTICE_EVERY_MS = exports.WAITING_NOTICE_AFTER_MS = exports.NON_INTERACTIVE_QUESTION_DISMISSAL = void 0;
+exports.terminalFailureMessage = terminalFailureMessage;
 exports.isDaemonHandoverFailure = isDaemonHandoverFailure;
 exports.formatWaitDuration = formatWaitDuration;
 exports.writeJsonLine = writeJsonLine;
@@ -46,6 +47,47 @@ const dpop_auth_1 = require("./dpop-auth");
  */
 exports.NON_INTERACTIVE_QUESTION_DISMISSAL = 'No answer: this turn was started non-interactively (no terminal), so nobody can reply to ' +
     'questions. Proceed with your best judgement, or finish by stating exactly what you need.';
+/**
+ * A terminal that has printed the header and nothing else for several seconds looks hung. The
+ * first line comes after this long with no output at all, and then again at this interval
+ * (OSK-20427). Typical waits are 4 to 6 seconds before the first words, so a quick reply
+ * prints nothing extra.
+ */
+exports.WAITING_NOTICE_AFTER_MS = 2500;
+exports.WAITING_NOTICE_EVERY_MS = 10_000;
+/** What counts as the run having said something, so the waiting line stops. */
+const OUTPUT_EVENT_TYPES = new Set([
+    'text.delta',
+    'tool.started',
+    'tool.completed',
+    'session.notice',
+    'permission.requested',
+    'run.completed',
+    'run.failed',
+    'run.aborted',
+    'run.handed_over',
+]);
+/**
+ * The sentence a failed run's terminal event gives for why it failed.
+ *
+ * The server's failure funnel (`handleSessionFailure`) sends `errors: [<sentence>]`
+ * and a short `reason`, never a `message`; other terminal events carry `message`,
+ * and a few an `error` string. Every reader used to look at `message` alone, so a
+ * run the platform refused ("no valid release package", "insufficient balance", a
+ * runtime that was not there) ended as `Error: Agent run failed` with the reason
+ * sitting unread in the same event (OSK-20410). One reader, in one order: the
+ * explicit `message`, then `error`, then the first entry of `errors`.
+ */
+function terminalFailureMessage(event) {
+    if (!event)
+        return undefined;
+    const sentence = (value) => typeof value === 'string' && value.trim() ? value : undefined;
+    const entryText = (entry) => sentence(entry) ?? sentence(entry?.message);
+    const fromList = Array.isArray(event.errors)
+        ? event.errors.map(entryText).find((entry) => entry !== undefined)
+        : undefined;
+    return sentence(event.message) ?? sentence(event.error) ?? fromList;
+}
 /**
  * OSK-13517 / OSK-13543 — the one failure that is not an ending.
  *
@@ -807,6 +849,12 @@ class AgenticStreamClient {
     openQuestionPrompts = new Map();
     /** Text already written to the terminal, for suffix-only rendering. */
     renderedText = '';
+    /** The "still waiting" line for a terminal run with no output yet (OSK-20427). */
+    waitingTimer = null;
+    waitingStartedAt = 0;
+    outputSeen = false;
+    /** The cumulative text of the last `text.delta` written as JSON, for `delta`/`replace`. */
+    lastJsonlText = '';
     idleTimer = null;
     /** Releases a connect wait still in flight; `close()` calls it. */
     abandonConnectWait = null;
@@ -1012,6 +1060,7 @@ class AgenticStreamClient {
         if (this.replayTimer)
             clearTimeout(this.replayTimer);
         this.replayTimer = null;
+        this.stopWaiting();
         this.stopHandoverTimers();
         this.pendingEnvelopes.clear();
         this.browserPermissionRequests.clear();
@@ -1079,10 +1128,7 @@ class AgenticStreamClient {
         const deadlineTimer = setTimeout(() => void this.expireHandover(), opts.maxWaitMs);
         const pollTimer = setInterval(() => this.requestHandoverRead(), opts.pollIntervalMs ?? exports.HANDOVER_POLL_INTERVAL_MS);
         this.handover = { event, startedAt, deadlineTimer, pollTimer, reading: null, readAgain: false };
-        const firstError = Array.isArray(event.errors) && typeof event.errors[0] === 'string'
-            ? event.errors[0]
-            : undefined;
-        const message = typeof event.message === 'string' && event.message ? event.message : firstError;
+        const message = terminalFailureMessage(event);
         this.emit({
             type: 'run.handed_over',
             sessionId: this.options.sessionId,
@@ -1745,6 +1791,10 @@ class AgenticStreamClient {
             return;
         }
         if (!this.options.approveTools || !this.socket) {
+            // This CLI makes the decision and nobody is asked, so it says so FIRST. The bound path used
+            // to return before any event, and the only lines a person saw were the server's "The
+            // response was admitted. Tool execution is not confirmed.", which read like an approval.
+            this.emit({ ...event, type: 'permission.denied', reason: 'noninteractive_or_not_enabled' });
             if (event.toolUseId) {
                 if (await this.sendBoundPermissionDecision(event, false, { reason: 'CLI was not started with --approve-tools', automatic: true }))
                     return;
@@ -1759,7 +1809,6 @@ class AgenticStreamClient {
                     automatic: true,
                 });
             }
-            this.emit({ ...event, type: 'permission.denied', reason: 'noninteractive_or_not_enabled' });
             return;
         }
         /**
@@ -1782,6 +1831,14 @@ class AgenticStreamClient {
          */
         const interactive = this.options.input !== undefined || Boolean(process.stdin.isTTY);
         if (!interactive) {
+            // Announced before it is sent, as the denial is: the bound path used to return first, so
+            // "allowed by --approve-tools" never reached a person who used the flag.
+            this.emit({
+                ...event,
+                type: 'permission.approved',
+                auto: true,
+                reason: 'approved by --approve-tools, which was given with no terminal to ask at',
+            });
             if (await this.sendBoundPermissionDecision(event, true))
                 return;
             this.socket.emit('permission:approve', {
@@ -1789,12 +1846,6 @@ class AgenticStreamClient {
                 toolUseId: event.toolUseId,
                 toolName: event.toolName,
             });
-            this.emit({
-                ...event,
-                type: 'permission.approved',
-                auto: true,
-                reason: 'approved by --approve-tools, which was given with no terminal to ask at',
-            });
             return;
         }
         const prompt = new AbortController();
@@ -2084,6 +2135,60 @@ class AgenticStreamClient {
             return;
         this.emit(event);
     }
+    /**
+     * Say so when a terminal run has been quiet since it started. Human output only: a script
+     * reading --jsonl has the events, and --quiet asked for nothing but the answer.
+     */
+    trackWaiting(event, output) {
+        if (OUTPUT_EVENT_TYPES.has(event.type)) {
+            this.outputSeen = true;
+            this.stopWaiting();
+            return;
+        }
+        if (event.type !== 'run.started' || this.outputSeen || this.waitingTimer)
+            return;
+        this.waitingStartedAt = Date.now();
+        const schedule = (first) => {
+            this.waitingTimer = setTimeout(() => {
+                this.waitingTimer = null;
+                if (this.outputSeen || this.closed)
+                    return;
+                const seconds = Math.floor((Date.now() - this.waitingStartedAt) / 1000);
+                output.write(first
+                    ? '[run] waiting for the agent to start answering…\n'
+                    : `[run] still waiting for the agent (${seconds} s)…\n`);
+                schedule(false);
+            }, first ? exports.WAITING_NOTICE_AFTER_MS : exports.WAITING_NOTICE_EVERY_MS);
+            // A reminder must never be the reason the process stays alive.
+            this.waitingTimer.unref?.();
+        };
+        schedule(true);
+    }
+    stopWaiting() {
+        if (this.waitingTimer)
+            clearTimeout(this.waitingTimer);
+        this.waitingTimer = null;
+    }
+    /**
+     * A `text.delta` is named for a delta and carries the whole answer so far (`text`), so a long
+     * answer written as JSON lines grows with the square of its length: 207 events for a 2.4 KB
+     * answer came to about 250 KB (OSK-20428). The contract stays, since scripts take the last one;
+     * `delta` is added to it, and `incrementalText` turns the cumulative text and the duplicated
+     * envelopes off for a consumer that wants only what is new.
+     */
+    jsonlView(event) {
+        if (event.type !== 'text.delta' || typeof event.text !== 'string')
+            return event;
+        const previous = this.lastJsonlText;
+        const text = event.text;
+        this.lastJsonlText = text;
+        const appended = text.startsWith(previous) ? text.slice(previous.length) : undefined;
+        if (!this.options.incrementalText) {
+            return appended === undefined ? event : { ...event, delta: appended };
+        }
+        const { text: _text, envelopes: _envelopes, ...rest } = event;
+        return appended === undefined ? { ...rest, replace: text } : { ...rest, delta: appended };
+    }
     emit(event) {
         this.lastEvent = event;
         this.options.onEvent?.(event);
@@ -2108,9 +2213,10 @@ class AgenticStreamClient {
             return;
         const output = this.options.output ?? process.stdout;
         if (this.options.jsonl) {
-            writeJsonLine(output, event);
+            writeJsonLine(output, this.jsonlView(event));
             return;
         }
+        this.trackWaiting(event, output);
         if (event.type === 'run.started') {
             const permission = describeRunPermission(event);
             if (permission)
@@ -2192,6 +2298,12 @@ class AgenticStreamClient {
             output.write(`\n[question] ${why}\n`);
             this.renderedText = this.answerText();
         }
+        else if (event.type === 'permission.denied' && event.reason === 'noninteractive_or_not_enabled') {
+            // Said out loud, because nobody was asked and the agent will not say it plainly: this run
+            // had no terminal to ask at and was not given --approve-tools, so the call was refused.
+            output.write(`\n[permission] ${describePermission(event)} denied: nobody could be asked, and this run was not started with --approve-tools\n`);
+            this.renderedText = this.answerText();
+        }
         else if (event.type === 'permission.approved' && event.auto === true) {
             // Said out loud, because nobody was asked: the flag approved it, and a
             // reader of this log should see which tools that covered (OSK-10323).
@@ -2379,7 +2491,16 @@ class AgenticStreamClient {
                 output.write(append);
             output.write('\n');
         }
-        this.emit({ ...event, type: `run.${status}` });
+        // A failed run states why under the one key a script reads (`message`), whichever
+        // shape the terminal event used. `lastEvent` below stays the event as received.
+        const failureMessage = status === 'failed' && !(typeof event.message === 'string' && event.message.trim())
+            ? terminalFailureMessage(event)
+            : undefined;
+        this.emit({
+            ...event,
+            ...(failureMessage ? { message: failureMessage } : {}),
+            type: `run.${status}`,
+        });
         this.close();
         this.terminalResult = {
             sessionId: this.options.sessionId,

package/dist/lib/auth-failure.js

@@ -98,6 +98,18 @@ function describeRefreshRefusal(refusal, opts) {
                 `server treats that as possible theft and revokes the whole family. ${relogin}`,
         };
     }
+    // The server wanted a device proof and this machine had no key to sign one
+    // with. `skrr login` signs the CLI in on its own and never creates a device
+    // key, so naming it here sends the person round the same loop (OSK-20472): the
+    // daemon's interactive sign-in is what mints a key and re-pins the server to it.
+    if (code === 'DEVICE_KEY_UNAVAILABLE') {
+        return {
+            code,
+            message: `This sign-in could not be renewed${said}. This machine's device key is missing or ` +
+                `unreadable, so requests carry no device proof. \`${bin} login\` cannot create one; ` +
+                `sign the background service in again with \`${bin} daemon login\`.`,
+        };
+    }
     return {
         code,
         message: `This sign-in could not be renewed${said}. ${relogin}`,

package/dist/lib/command-miss.js

@@ -105,6 +105,7 @@ function describeTaskCommandRedirect(config, parts, typedWords) {
     if (lower[0] === 'tasks' &&
         lower[1] === 'search' &&
         hasTopic(config, 'tasks') &&
+        config.findCommand('tasks:search') === undefined &&
         config.findCommand(exports.TASK_COMMAND_MISS_TARGETS.search) !== undefined) {
         const query = typedWords.slice(2).join(' ').trim();
         const target = `${config.bin} tasks list --q ${query ? JSON.stringify(query) : '<query>'}`;

package/dist/lib/exec-runtime-binary.d.ts

@@ -65,6 +65,15 @@ export declare function normalizeRuntimeGlobalArgs(args: readonly string[]): str
  * part of a copy sweep.
  */
 export declare function notInstalledMessage(): string;
+/**
+ * Marks the `skrrd` process that `skrr daemon …` launches, so the daemon can print its recovery
+ * commands in the spelling the person can run: `skrr daemon login`, not `skrrd login`. The
+ * daemon lives in `~/.skrr/bin`, which this wrapper finds by itself and nothing puts on PATH.
+ * Spelled the same in `daemon/src/auth/login-hint.ts`; `scripts/__tests__/invoked-via-parity.spec.js`
+ * holds the two together.
+ */
+export declare const INVOKED_VIA_ENV = "SKRR_INVOKED_VIA";
+export declare const INVOKED_VIA_CLI = "skrr-cli";
 /**
  * Spawn `oversky <args>` with stdio inherited. Resolves with the child's
  * exit code so the caller can `process.exit()` with the same code,

package/dist/lib/exec-runtime-binary.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RUNTIME_BINARY_NAMES = void 0;
+exports.INVOKED_VIA_CLI = exports.INVOKED_VIA_ENV = exports.RUNTIME_BINARY_NAMES = void 0;
 exports.forwardedFlagsNote = forwardedFlagsNote;
 exports.findRuntimeBinary = findRuntimeBinary;
 exports.isCurrentRuntimeBinary = isCurrentRuntimeBinary;
@@ -206,6 +206,18 @@ function notInstalledMessage() {
         'Once installed, re-run your command.',
     ].join('\n');
 }
+/**
+ * Marks the `skrrd` process that `skrr daemon …` launches, so the daemon can print its recovery
+ * commands in the spelling the person can run: `skrr daemon login`, not `skrrd login`. The
+ * daemon lives in `~/.skrr/bin`, which this wrapper finds by itself and nothing puts on PATH.
+ * Spelled the same in `daemon/src/auth/login-hint.ts`; `scripts/__tests__/invoked-via-parity.spec.js`
+ * holds the two together.
+ */
+exports.INVOKED_VIA_ENV = 'SKRR_INVOKED_VIA';
+exports.INVOKED_VIA_CLI = 'skrr-cli';
+function runtimeEnv() {
+    return { ...process.env, [exports.INVOKED_VIA_ENV]: exports.INVOKED_VIA_CLI };
+}
 /**
  * Spawn `oversky <args>` with stdio inherited. Resolves with the child's
  * exit code so the caller can `process.exit()` with the same code,
@@ -230,6 +242,7 @@ function execRuntimeBinary(args, opts = {}) {
         const isWinShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(bin);
         const child = (0, node_child_process_1.spawn)(bin, normalizeRuntimeGlobalArgs(args), {
             stdio: 'inherit',
+            env: runtimeEnv(),
             ...(isWinShim ? { shell: true } : {}),
         });
         child.on('error', reject);
@@ -261,6 +274,7 @@ function execRuntimeBinaryCapture(args, opts = {}) {
         const isWinShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(bin);
         const child = (0, node_child_process_1.spawn)(bin, normalizeRuntimeGlobalArgs(args), {
             stdio: ['ignore', 'pipe', 'pipe'],
+            env: runtimeEnv(),
             ...(isWinShim ? { shell: true } : {}),
         });
         let stdout = '';

package/dist/lib/followups.d.ts

@@ -49,6 +49,8 @@ export interface FollowUpRow {
     kind?: string;
     form?: string | null;
     producer?: string;
+    /** The producer in words (`describeFollowUpProducer`), so no surface prints a bare enum. */
+    producerLabel?: string;
     why?: string;
     /** A reminder's own words. */
     content?: string | null;
@@ -86,7 +88,18 @@ export interface FollowUpCreateResponse {
     proposal?: boolean;
     budget?: Json;
     fallbackTriggerId?: string | null;
+    /**
+     * Set when the credential could not carry the producer the request claimed: the
+     * server recorded `recorded` instead (never a higher one) and says why.
+     */
+    producerDowngraded?: {
+        requested: string;
+        recorded: string;
+        note: string;
+    };
 }
+/** One line telling a person the follow-up was recorded with weaker provenance than claimed. */
+export declare function producerDowngradeNotice(response: FollowUpCreateResponse): string | undefined;
 export interface FollowUpObservability {
     generatedAt?: string;
     agents?: Array<{

package/dist/lib/followups.js

@@ -4,6 +4,7 @@ exports.followupsApi = exports.FOLLOWUP_SUBJECT_FLAG_HELP = exports.FOLLOWUP_SUB
 exports.whenFlagProblem = whenFlagProblem;
 exports.settledLine = settledLine;
 exports.recipeWatchBoundsRefusal = recipeWatchBoundsRefusal;
+exports.producerDowngradeNotice = producerDowngradeNotice;
 exports.resolveFollowUpAgent = resolveFollowUpAgent;
 exports.parseSubjectRef = parseSubjectRef;
 exports.followupSummaryLine = followupSummaryLine;
@@ -127,6 +128,13 @@ function recipeWatchBoundsRefusal(waitKind, passed) {
             : 'A recipe watch ends through its --wait.',
     ].join(' ');
 }
+/** One line telling a person the follow-up was recorded with weaker provenance than claimed. */
+function producerDowngradeNotice(response) {
+    const downgraded = response.producerDowngraded;
+    if (!downgraded)
+        return undefined;
+    return `Note: recorded as ${downgraded.recorded}, not ${downgraded.requested}. ${downgraded.note}`;
+}
 /**
  * A trigger subject becomes a durable concurrency key, so it cannot be prose.
  * Keep this grammar aligned with TriggerEngine's subject validation and the

package/dist/lib/profile-machine-identity-guard.js

@@ -5,6 +5,7 @@ exports.describeLegacySharedProfile = describeLegacySharedProfile;
 const machine_uuid_1 = require("@skrr-ai/auth-core/machine-uuid");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const keychain_1 = require("./keychain");
+const daemon_command_hint_1 = require("./daemon-command-hint");
 /** An old profile may still share the default machine row and its device pin. */
 function legacyProfileSharesDefaultMachine() {
     const profile = (0, keychain_1.getActiveProfile)();
@@ -47,6 +48,6 @@ function describeLegacySharedProfile(profile) {
             `computer the same machine identity, and it still has it. ${why}Signing in here would replace the default ` +
             "profile's device-key pin and sign the default daemon out. Nothing was changed.",
         `Use a new profile name instead: skrr login --profile ${next}`,
-        `(For the background service alone: skrrd --profile ${next} login)`,
+        `(For the background service alone: ${(0, daemon_command_hint_1.daemonCommandHint)('login', { profile: next })})`,
     ];
 }

package/dist/lib/runtime-start-verification.js

@@ -49,7 +49,12 @@ function parseRuntimeStartStatus(value, fallbackProfile) {
     return {
         profile: asString(profile?.name) ?? fallbackProfile,
         serverUrl: asString(root.serverUrl),
-        cwd: asString(root.cwd),
+        // `root.cwd` is where THIS `status` ran from (the person's shell), not where
+        // the daemon runs. The recovery command binds a login to its `--cwd`, and
+        // `skrrd status` itself prints `effectiveCwd` (live daemon, then installed
+        // service, then the stored binding) for exactly that. A runtime binary that
+        // predates `effectiveCwd` only has `cwd`.
+        cwd: asString(root.effectiveCwd) ?? asString(root.cwd),
         reauth: {
             needed: reauth?.needed === true,
             reason: asString(reauth?.reason),