@skrr-ai/cli 0.1.125 → 0.1.127

package/dist/commands/agents/chat.d.ts

@@ -25,6 +25,28 @@ export declare const DETACH_EXIT_CODE = 130;
  * answers true.
  */
 export declare const STREAM_LOST_EXIT_CODE = 75;
+/**
+ * The signals that stop a running chat.
+ *
+ * Ctrl-C was the only one handled (OSK-2938). SIGTERM (a CI cancel, `timeout`, a process manager) and
+ * SIGHUP (the terminal closing) killed the CLI in under 100 ms with no cancel sent, so the agent kept
+ * running tools on the person's machine with nobody watching and held the folder, and the next message
+ * was refused as `managed_task_workspace_busy` (OSK-20677). `machines dedicated cp` already treats all
+ * three as cancel and exits as a shell would; this does the same.
+ */
+export declare const INTERRUPT_SIGNALS: readonly ["SIGINT", "SIGTERM", "SIGHUP"];
+export type InterruptSignal = (typeof INTERRUPT_SIGNALS)[number];
+/** 128 plus the signal's number, as a shell reports a process the signal killed: 130, 143, 129. */
+export declare function interruptExitCode(signal: InterruptSignal | null): number;
+/**
+ * The cancel notice, in words that fit the signal. "Press Ctrl-C again" is wrong advice after a
+ * SIGTERM, and after SIGHUP nobody is looking: the terminal that would show it is gone.
+ */
+export declare function cancelNotice(input: {
+    signal: InterruptSignal;
+    sessionId: string;
+    graceSeconds: number;
+}): string | null;
 /**
  * Exit code for a streamed run that reached its terminal state: 1 when it
  * failed, 0 otherwise.

package/dist/commands/agents/chat.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_HANDOVER_WAIT_SECONDS = exports.DEFAULT_HANDOVER_WAIT_SECONDS = exports.STREAM_LOST_EXIT_CODE = exports.DETACH_EXIT_CODE = void 0;
+exports.MAX_HANDOVER_WAIT_SECONDS = exports.DEFAULT_HANDOVER_WAIT_SECONDS = exports.INTERRUPT_SIGNALS = exports.STREAM_LOST_EXIT_CODE = exports.DETACH_EXIT_CODE = void 0;
+exports.interruptExitCode = interruptExitCode;
+exports.cancelNotice = cancelNotice;
 exports.streamedResultExitCode = streamedResultExitCode;
 exports.interruptedDetachMessage = interruptedDetachMessage;
 exports.jsonlTextForm = jsonlTextForm;
@@ -49,6 +51,35 @@ exports.DETACH_EXIT_CODE = 130;
  * answers true.
  */
 exports.STREAM_LOST_EXIT_CODE = 75;
+/**
+ * The signals that stop a running chat.
+ *
+ * Ctrl-C was the only one handled (OSK-2938). SIGTERM (a CI cancel, `timeout`, a process manager) and
+ * SIGHUP (the terminal closing) killed the CLI in under 100 ms with no cancel sent, so the agent kept
+ * running tools on the person's machine with nobody watching and held the folder, and the next message
+ * was refused as `managed_task_workspace_busy` (OSK-20677). `machines dedicated cp` already treats all
+ * three as cancel and exits as a shell would; this does the same.
+ */
+exports.INTERRUPT_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+/** 128 plus the signal's number, as a shell reports a process the signal killed: 130, 143, 129. */
+function interruptExitCode(signal) {
+    if (signal === 'SIGTERM')
+        return 143;
+    if (signal === 'SIGHUP')
+        return 129;
+    return exports.DETACH_EXIT_CODE;
+}
+/**
+ * The cancel notice, in words that fit the signal. "Press Ctrl-C again" is wrong advice after a
+ * SIGTERM, and after SIGHUP nobody is looking: the terminal that would show it is gone.
+ */
+function cancelNotice(input) {
+    if (input.signal === 'SIGHUP')
+        return null;
+    const again = input.signal === 'SIGINT' ? 'press Ctrl-C again' : `send ${input.signal} again`;
+    return (`\nCancelling run ${input.sessionId}… (waiting up to ${input.graceSeconds}s; ${again} to detach). ` +
+        'A tool call already running on the runtime is not guaranteed to stop.');
+}
 /**
  * Exit code for a streamed run that reached its terminal state: 1 when it
  * failed, 0 otherwise.
@@ -882,10 +913,22 @@ class AgentsChat extends base_command_1.BaseCommand {
             detach = () => resolve('detached');
         });
         let interrupts = 0;
+        // The signal that started the stop. Its exit status is what a script reads (130, 143 or 129).
+        let interruptedBy = null;
+        // After SIGHUP the terminal is gone and a write to it throws; the notice is lost, the stop is not.
+        const writeNotice = (fd, text) => {
+            try {
+                (0, node_fs_1.writeSync)(fd, text);
+            }
+            catch (_error) {
+                /* the terminal that would show this is closed */
+            }
+        };
         let forcedDetachAnnounced = false;
         let graceTimer = null;
-        const onInterrupt = () => {
+        const onInterrupt = (signal = 'SIGINT') => {
             interrupts += 1;
+            interruptedBy ??= signal;
             const action = interruptAction({ interrupts, awaitingHandover: client.awaitingHandover() });
             if (action === 'stop-handover-wait') {
                 // Nothing to cancel and nothing to grace-wait for: stop at once.
@@ -896,7 +939,7 @@ class AgentsChat extends base_command_1.BaseCommand {
                         conversationId: started.conversationId,
                     });
                     if (flags.jsonl) {
-                        (0, node_fs_1.writeSync)(process.stdout.fd, `${JSON.stringify({
+                        writeNotice(process.stdout.fd, `${JSON.stringify({
                             type: 'run.detached',
                             sessionId: started.sessionId,
                             conversationId: started.conversationId,
@@ -906,9 +949,9 @@ class AgentsChat extends base_command_1.BaseCommand {
                         })}\n`);
                     }
                     else {
-                        (0, node_fs_1.writeSync)(process.stderr.fd, `\n${message}\n`);
+                        writeNotice(process.stderr.fd, `\n${message}\n`);
                     }
-                    process.exitCode = exports.DETACH_EXIT_CODE;
+                    process.exitCode = interruptExitCode(interruptedBy);
                 }
                 client.close();
                 detach?.();
@@ -917,9 +960,13 @@ class AgentsChat extends base_command_1.BaseCommand {
             if (action === 'cancel') {
                 client.cancel();
                 if (!flags.jsonl) {
-                    this.log(`\nCancelling run ${started.sessionId}… (waiting up to ${CANCEL_GRACE_MS / 1000}s; ` +
-                        'press Ctrl-C again to detach). A tool call already running on the runtime is ' +
-                        'not guaranteed to stop.');
+                    const notice = cancelNotice({
+                        signal,
+                        sessionId: started.sessionId,
+                        graceSeconds: CANCEL_GRACE_MS / 1000,
+                    });
+                    if (notice)
+                        writeNotice(process.stdout.fd, `${notice}\n`);
                 }
                 graceTimer = setTimeout(() => detach?.(), CANCEL_GRACE_MS);
                 graceTimer.unref?.();
@@ -933,7 +980,7 @@ class AgentsChat extends base_command_1.BaseCommand {
                     forced: true,
                 });
                 if (flags.jsonl) {
-                    (0, node_fs_1.writeSync)(process.stdout.fd, `${JSON.stringify({
+                    writeNotice(process.stdout.fd, `${JSON.stringify({
                         type: 'run.detached',
                         sessionId: started.sessionId,
                         conversationId: started.conversationId,
@@ -942,13 +989,14 @@ class AgentsChat extends base_command_1.BaseCommand {
                     })}\n`);
                 }
                 else {
-                    (0, node_fs_1.writeSync)(process.stderr.fd, `\n${message}\n`);
+                    writeNotice(process.stderr.fd, `\n${message}\n`);
                 }
-                process.exitCode = exports.DETACH_EXIT_CODE;
+                process.exitCode = interruptExitCode(interruptedBy);
             }
             detach?.();
         };
-        process.on('SIGINT', onInterrupt);
+        for (const name of exports.INTERRUPT_SIGNALS)
+            process.on(name, onInterrupt);
         try {
             // OSK-2944 — the run was ACCEPTED before we ever tried to attach. If the
             // stream cannot be attached, that is a lost view of a live run, not a
@@ -988,7 +1036,7 @@ class AgentsChat extends base_command_1.BaseCommand {
                 // 130 only when a signal actually caused this; otherwise the stream was
                 // lost and claiming SIGINT lies to every script reading the code
                 // (OSK-7660).
-                const exit = interrupts > 0 ? exports.DETACH_EXIT_CODE : exports.STREAM_LOST_EXIT_CODE;
+                const exit = interrupts > 0 ? interruptExitCode(interruptedBy) : exports.STREAM_LOST_EXIT_CODE;
                 if (flags.jsonl) {
                     (0, agentic_stream_1.writeJsonLine)(process.stdout, {
                         type: 'run.detached',
@@ -1039,15 +1087,23 @@ class AgentsChat extends base_command_1.BaseCommand {
                     this.error(noOutput, { exit: 1 });
                 this.log(result.text);
             }
-            else if (result.status === 'aborted') {
+            else if (result.status === 'aborted' && interruptedBy !== 'SIGHUP') {
                 // Streaming human mode: say the cancel took, rather than leave the keypress warning last.
+                // (Not after SIGHUP: the terminal that would show it is gone.)
                 this.log(`\n${cancelledRunMessage({ sessionId: started.sessionId, conversationId: started.conversationId })}`);
             }
+            // A run stopped by SIGTERM or SIGHUP ends the way a shell reports a process the signal killed,
+            // so a script can tell a cancelled run from one that finished. Ctrl-C keeps its existing status
+            // (a cancel that took is a success, a detach is 130).
+            if (interruptedBy === 'SIGTERM' || interruptedBy === 'SIGHUP') {
+                process.exitCode = interruptExitCode(interruptedBy);
+            }
         }
         finally {
             if (graceTimer)
                 clearTimeout(graceTimer);
-            process.removeListener('SIGINT', onInterrupt);
+            for (const name of exports.INTERRUPT_SIGNALS)
+                process.removeListener(name, onInterrupt);
             client.close();
         }
     }

package/dist/commands/agents/goals/list.d.ts

@@ -8,8 +8,8 @@ import { BaseCommand } from '../../../base-command';
  * Wraps `GET /api/agents/:agent_id/goals` (data-provider `listAgentGoals`),
  * which returns goals where the agent is owner, DRI, or a contributor, each
  * enriched with `_agentGoalRole` (which of the three) and `_completionPercent`.
- * The endpoint sorts by most-recently-updated and caps at 100 goals; there is
- * no pagination cursor, so neither is there a `--cursor` flag here.
+ * The endpoint sorts by most-recently-updated and supports cursor pagination.
+ * This command currently shows its first page of up to 100 goals.
  */
 export default class AgentsGoalsList extends BaseCommand {
     static description: string;

package/dist/commands/agents/goals/list.js

@@ -14,8 +14,8 @@ const format_1 = require("../../../lib/format");
  * Wraps `GET /api/agents/:agent_id/goals` (data-provider `listAgentGoals`),
  * which returns goals where the agent is owner, DRI, or a contributor, each
  * enriched with `_agentGoalRole` (which of the three) and `_completionPercent`.
- * The endpoint sorts by most-recently-updated and caps at 100 goals; there is
- * no pagination cursor, so neither is there a `--cursor` flag here.
+ * The endpoint sorts by most-recently-updated and supports cursor pagination.
+ * This command currently shows its first page of up to 100 goals.
  */
 class AgentsGoalsList extends base_command_1.BaseCommand {
     static description = 'List the goals an agent owns, is DRI for, or contributes to';

package/dist/commands/goals/create.d.ts

@@ -6,6 +6,7 @@ export default class GoalsCreate extends BaseCommand {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'from-json': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         title: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'idempotency-key': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         level: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'target-date': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/goals/create.js

@@ -24,6 +24,9 @@ class GoalsCreate extends base_command_1.BaseCommand {
             description: 'Path to a JSON file (or "-" for stdin) to use as the request body',
         }),
         title: core_1.Flags.string({ description: 'Goal title (required unless set via --from-json)' }),
+        'idempotency-key': core_1.Flags.string({
+            description: 'Stable key for retries of this exact Goal creation request',
+        }),
         description: core_1.Flags.string({ description: 'Goal description' }),
         level: core_1.Flags.string({
             description: 'Goal level',
@@ -126,7 +129,7 @@ class GoalsCreate extends base_command_1.BaseCommand {
             payload.labelIds = resolvedLabelIds;
         let created;
         try {
-            created = await data_provider_1.dataService.createGoal(payload);
+            created = await data_provider_1.dataService.createGoal(payload, flags['idempotency-key'] ? { idempotencyKey: flags['idempotency-key'] } : undefined);
             if (flags.space) {
                 const goalId = created.id;
                 if (!goalId || typeof goalId !== 'string') {

package/dist/commands/goals/revisions.js

@@ -4,20 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
-/**
- * The one class of goal change this log does not contain.
- *
- * `PATCH /api/goals/:goalId/planner-config` writes the goal through
- * `Goal.findOneAndUpdate` directly rather than `GoalModel.updateGoal`, which is
- * where `RevisionService` is called from — so arming, re-timing or disarming the
- * auto-planner (and any `maxActiveTasks` change made through that route) leaves
- * no revision. "Who turned the planner on for this goal, and when" is the audit
- * question a shared goal actually raises, and the table answers it with silence.
- *
- * Naming the gap is the honest thing the CLI can do; closing it is a server
- * change. DELETE THIS FOOTER once the planner-config route records a revision.
- */
-const PLANNER_GAP_NOTE = 'Note: auto-planner changes made with `goals planner-config` are not recorded as revisions.';
+const revision_actor_1 = require("../../lib/revision-actor");
 class GoalsRevisions extends base_command_1.BaseCommand {
     static description = 'List revisions for a goal';
     static examples = [
@@ -47,25 +34,22 @@ class GoalsRevisions extends base_command_1.BaseCommand {
         const items = result?.data ?? [];
         if (items.length === 0) {
             this.log('No revisions.');
-            this.log(PLANNER_GAP_NOTE);
             return;
         }
         const rows = items.map((rev) => ({
             version: String(rev.revisionNumber ?? '-'),
             changeType: String(rev.changeType ?? '-'),
-            user: String(rev.userId ?? '-'),
+            user: (0, revision_actor_1.revisionActorLabel)(rev),
             changes: String(Array.isArray(rev.changes) ? rev.changes.length : 0),
             when: rev.createdAt ? String(rev.createdAt).slice(0, 19).replace('T', ' ') : '-',
         }));
         (0, format_1.renderTable)(rows, [
             { key: 'version', header: 'REV' },
             { key: 'changeType', header: 'CHANGE' },
-            { key: 'user', header: 'USER' },
+            { key: 'user', header: 'ACTOR' },
             { key: 'changes', header: 'FIELDS' },
             { key: 'when', header: 'AT' },
         ], (line) => this.log(line));
-        this.log('');
-        this.log(PLANNER_GAP_NOTE);
     }
 }
 exports.default = GoalsRevisions;

package/dist/commands/spaces/revisions.js

@@ -5,6 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
 const space_output_1 = require("../../lib/space-output");
+const revision_actor_1 = require("../../lib/revision-actor");
 class SpacesRevisions extends base_command_1.BaseCommand {
     static description = 'List revisions for a space';
     static examples = [
@@ -40,14 +41,14 @@ class SpacesRevisions extends base_command_1.BaseCommand {
         const rows = items.map((rev) => ({
             version: String(rev.revisionNumber ?? '-'),
             changeType: String(rev.changeType ?? '-'),
-            user: String(rev.userId ?? '-'),
+            user: (0, revision_actor_1.revisionActorLabel)(rev),
             changes: String(Array.isArray(rev.changes) ? rev.changes.length : 0),
             when: rev.createdAt ? String(rev.createdAt).slice(0, 19).replace('T', ' ') : '-',
         }));
         (0, format_1.renderTable)(rows, [
             { key: 'version', header: 'REV' },
             { key: 'changeType', header: 'CHANGE' },
-            { key: 'user', header: 'USER' },
+            { key: 'user', header: 'ACTOR' },
             { key: 'changes', header: 'FIELDS' },
             { key: 'when', header: 'AT' },
         ], (line) => this.log(line));

package/dist/commands/tasks/revisions.js

@@ -5,6 +5,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
+const revision_actor_1 = require("../../lib/revision-actor");
 /** " (via CLI credential)" when the revision recorded its credential channel. */
 function revisionChannelSuffix(rev) {
     const via = rev.metadata?.via;
@@ -46,14 +47,14 @@ class TasksRevisions extends base_command_1.BaseCommand {
             version: String(rev.revisionNumber ?? '-'),
             changeType: String(rev.changeType ?? '-'),
             // The channel the person's credential came through, when recorded (OSK-16621).
-            user: `${String(rev.userId ?? '-')}${revisionChannelSuffix(rev)}`,
+            user: `${(0, revision_actor_1.revisionActorLabel)(rev)}${rev.userId != null ? revisionChannelSuffix(rev) : ''}`,
             changes: String(Array.isArray(rev.changes) ? rev.changes.length : 0),
             when: rev.createdAt ? String(rev.createdAt).slice(0, 19).replace('T', ' ') : '-',
         }));
         (0, format_1.renderTable)(rows, [
             { key: 'version', header: 'REV' },
             { key: 'changeType', header: 'CHANGE' },
-            { key: 'user', header: 'USER' },
+            { key: 'user', header: 'ACTOR' },
             { key: 'changes', header: 'FIELDS' },
             { key: 'when', header: 'AT' },
         ], (line) => this.log(line));

package/dist/commands/triggers/fire-detail.js

@@ -29,6 +29,8 @@ function describeFireAuditDetail(detail, fireId, triggerId) {
         lines.push(`Duration:     ${String(detail.durationMs)}ms`);
     if (detail.conversationId)
         lines.push(`Conversation: ${String(detail.conversationId)}`);
+    // Tool calls refused during a turn that was delivered: `triggers show` points here for the facts.
+    lines.push(...(0, triggers_1.fireRefusalLines)(detail.metadata));
     return lines;
 }
 class TriggersFireDetail extends base_command_1.BaseCommand {

package/dist/lib/revision-actor.d.ts

@@ -0,0 +1,2 @@
+/** Render the actual actor without presenting a system or Agent as a user. */
+export declare function revisionActorLabel(revision: Record<string, unknown>): string;

package/dist/lib/revision-actor.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revisionActorLabel = revisionActorLabel;
+/** Render the actual actor without presenting a system or Agent as a user. */
+function revisionActorLabel(revision) {
+    if (revision.userId != null)
+        return String(revision.userId);
+    const actor = revision.actor;
+    if (actor && typeof actor === 'object' && !Array.isArray(actor)) {
+        const { kind, id } = actor;
+        if ((kind === 'system' || kind === 'agent') && typeof id === 'string' && id) {
+            return `${kind}: ${id}`;
+        }
+    }
+    return '-';
+}

package/dist/lib/triggers.d.ts

@@ -158,6 +158,15 @@ export interface TriggerFireRecord {
         replayBlockedReason?: string;
         replayRequirements?: string[];
         replayContext?: unknown;
+        /** Tool calls refused during a turn that was delivered (OSK-20776). */
+        permissionRefusals?: {
+            count?: number;
+            tools?: string[];
+            unattended?: boolean;
+            layer?: string;
+        };
+        /** The refusal record could not be read for this fire, which is not "none were refused". */
+        permissionRefusalsUnread?: boolean;
     };
 }
 export interface TriggerListResponse {
@@ -516,6 +525,29 @@ export declare function writeModeLabel(writeMode: string): string;
  * the configured base URL rather than guessed.
  */
 export declare function webhookIngestUrl(baseURL: string, triggerId: string): string;
+/**
+ * What `triggers show` adds when the last fire DELIVERED but had tool calls
+ * refused (OSK-20776). The outcome of such a fire is `succeeded`, so the
+ * `Fires:` line reads as success; this says what the string after `last` means
+ * and what a person can do about it.
+ *
+ * It states the mechanism and not this fire's cause, because `lastResult` names
+ * the refused kinds only. Whether a fire was unattended, and which layer
+ * refused, is on the fire record (`fire-detail`), and this points there.
+ *
+ * It does not recommend a mode. `bypassPermissions` is the only mode under which
+ * an unattended shell call runs, and it runs EVERY call without asking, which is
+ * a decision about what this agent may do on its own (a release job included),
+ * not a hint to paste.
+ */
+export declare function toolsRefusedHintLines(trigger: TriggerDefinition, kinds: readonly string[], bin?: string): string[];
+/**
+ * The refusal facts a fire record holds, as `fire-detail` lines. Nothing when
+ * the fire recorded none. A fire whose record could not be read says so: that
+ * is not the same as no refusal, and a reader must not be able to mistake it
+ * for one.
+ */
+export declare function fireRefusalLines(metadata: unknown): string[];
 export declare function renderTriggerSummary(trigger: TriggerDefinition, log: (line: string) => void, options?: {
     baseURL?: string;
 }): void;

package/dist/lib/triggers.js

@@ -48,6 +48,8 @@ exports.formatDuplicateSubscriptionWarning = formatDuplicateSubscriptionWarning;
 exports.armedStateLabel = armedStateLabel;
 exports.writeModeLabel = writeModeLabel;
 exports.webhookIngestUrl = webhookIngestUrl;
+exports.toolsRefusedHintLines = toolsRefusedHintLines;
+exports.fireRefusalLines = fireRefusalLines;
 exports.renderTriggerSummary = renderTriggerSummary;
 exports.renderLegacyRuns = renderLegacyRuns;
 exports.renderFireAudit = renderFireAudit;
@@ -1276,6 +1278,65 @@ const WEBHOOK_INGEST_KINDS = new Set(['on_demand', 'form', 'chat_message']);
 function webhookIngestUrl(baseURL, triggerId) {
     return `${String(baseURL).replace(/\/+$/, '')}/api/triggers/webhook/${encodeURIComponent(triggerId)}`;
 }
+/** An id or token that is short and plain, so it is safe in a command a person will paste. */
+const PLAIN_TOKEN = /^[A-Za-z0-9_.-]{1,64}$/;
+/**
+ * What `triggers show` adds when the last fire DELIVERED but had tool calls
+ * refused (OSK-20776). The outcome of such a fire is `succeeded`, so the
+ * `Fires:` line reads as success; this says what the string after `last` means
+ * and what a person can do about it.
+ *
+ * It states the mechanism and not this fire's cause, because `lastResult` names
+ * the refused kinds only. Whether a fire was unattended, and which layer
+ * refused, is on the fire record (`fire-detail`), and this points there.
+ *
+ * It does not recommend a mode. `bypassPermissions` is the only mode under which
+ * an unattended shell call runs, and it runs EVERY call without asking, which is
+ * a decision about what this agent may do on its own (a release job included),
+ * not a hint to paste.
+ */
+function toolsRefusedHintLines(trigger, kinds, bin = 'skrr') {
+    const scopedAgent = trigger.scope?.kind === 'agent' ? trigger.scope.refs?.agentId : undefined;
+    const agent = typeof scopedAgent === 'string' && PLAIN_TOKEN.test(scopedAgent) ? scopedAgent : '<agent>';
+    const triggerId = typeof trigger.id === 'string' && PLAIN_TOKEN.test(trigger.id) ? trigger.id : '<trigger-id>';
+    const what = kinds.length > 0 ? kinds.join(', ') : 'some tool calls';
+    return [
+        `Refused:  ${what} - the last fire delivered, but these tool calls were refused`,
+        '          A scheduled fire runs unattended: a call that would need approval is refused, because no one is there to give it.',
+        "          To allow it, change the agent's permission mode (bypassPermissions runs every tool call without asking, so decide that on purpose):",
+        `            ${bin} agents update ${agent} --default-permission-mode <mode>   (modes: ${bin} agents update --help)`,
+        `          What was refused, per fire: ${bin} triggers audit ${triggerId}, then ${bin} triggers fire-detail ${triggerId} <fire-id>`,
+    ];
+}
+/**
+ * The refusal facts a fire record holds, as `fire-detail` lines. Nothing when
+ * the fire recorded none. A fire whose record could not be read says so: that
+ * is not the same as no refusal, and a reader must not be able to mistake it
+ * for one.
+ */
+function fireRefusalLines(metadata) {
+    if (!metadata || typeof metadata !== 'object')
+        return [];
+    const { permissionRefusals, permissionRefusalsUnread } = metadata;
+    const lines = [];
+    if (permissionRefusals && typeof permissionRefusals === 'object') {
+        const { count, tools, unattended, layer } = permissionRefusals;
+        const kinds = (Array.isArray(tools) ? tools : []).filter((tool) => typeof tool === 'string' && PLAIN_TOKEN.test(tool));
+        const calls = typeof count === 'number' && Number.isFinite(count) && count > 0
+            ? `${count} tool call${count === 1 ? '' : 's'}`
+            : 'tool calls';
+        const parts = [`${calls} refused${kinds.length > 0 ? ` (${kinds.join(', ')})` : ''}`];
+        if (unattended === true)
+            parts.push('unattended, so no one could grant them');
+        if (typeof layer === 'string' && PLAIN_TOKEN.test(layer))
+            parts.push(`refused by ${layer}`);
+        lines.push(`Refused:      ${parts.join('; ')}`);
+    }
+    if (permissionRefusalsUnread === true) {
+        lines.push('Refused:      unknown - the refusal record could not be read for this fire; that is not the same as none');
+    }
+    return lines;
+}
 function renderTriggerSummary(trigger, log, options = {}) {
     log(`ID:       ${trigger.id ?? '-'}`);
     log(`Kind:     ${trigger.kind ?? '-'}`);
@@ -1389,6 +1450,11 @@ function renderTriggerSummary(trigger, log, options = {}) {
                 parts.push(`last ${audit.lastResult}`);
             log(`Fires:    ${parts.join(', ')}`);
         }
+        // `last tools_refused:...` above is a success that held a refusal. Say what that means.
+        const refused = (0, data_provider_1.parseToolsRefusedResult)(audit.lastResult);
+        if (refused)
+            for (const line of toolsRefusedHintLines(trigger, refused))
+                log(line);
         // The reason, at the surface a reader reaches for — not only in `--json`.
         if (audit.lastError)
             log(`Last error: ${audit.lastError}`);

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/scheduled-stream-wire.cjs

@@ -0,0 +1,98 @@
+'use strict';
+
+// Content-addressed source-envelope manifest. A manifest is completeness
+// evidence only after an authenticated native response binds it to its exact
+// dispatch, and every listed envelope has been independently retained.
+const { createHash } = require('node:crypto');
+const MAX_EVENTS = 1024;
+const MAX_EVENT_BYTES = 256 * 1024;
+const MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+const HASH = /^[0-9a-f]{64}$/;
+const id = value => typeof value === 'string' && value.length > 0 && value.length <= 240;
+const digest = value => createHash('sha256').update(value, 'utf8').digest('hex');
+
+function sorted(value) {
+  if (Array.isArray(value)) return value.map(sorted);
+  if (value && typeof value === 'object') return Object.fromEntries(
+    Object.keys(value).sort().map(key => [key, sorted(value[key])]));
+  return value;
+}
+function normalize(envelope) {
+  // JSON round-trip defines the wire representation, rejects cycles, and
+  // removes undefined properties in the same way as the uploader.
+  const value = JSON.parse(JSON.stringify(envelope));
+  if (!value || typeof value !== 'object' || Array.isArray(value) ||
+      !id(value.id) || !value.ev || typeof value.ev !== 'object' || Array.isArray(value.ev))
+    throw new TypeError('Invalid scheduled stream envelope');
+  // These fields are owned by the server or are independently authenticated
+  // native receipts, not part of the replayable provider stream.
+  for (const key of ['__seq', 'userSeq', '__degraded', 'messageId', 'managedEventType']) delete value[key];
+  for (const key of ['autonomousSourceExecutorTerminal', 'autonomousSourceExecutorNotStarted',
+    'ordinaryExecutorTerminal', 'personalContextInvocationTerminal', 'personalContextInvocationNotStarted'])
+    delete value.ev[key];
+  return JSON.stringify(sorted(value));
+}
+function fingerprint(envelope) {
+  const json = normalize(envelope);
+  const bytes = Buffer.byteLength(json, 'utf8');
+  if (bytes > MAX_EVENT_BYTES) throw new RangeError('Scheduled stream envelope exceeds the limit');
+  return { hash: digest(json), bytes, json };
+}
+function create(binding) {
+  if (!binding || ![binding.runId, binding.sessionId, binding.requestId, binding.dispatchId].every(id))
+    throw new TypeError('Invalid scheduled stream binding');
+  let closed = false;
+  let unavailable = null;
+  let totalBytes = 0;
+  const hashes = [];
+  return {
+    add(envelopes) {
+      if (closed) throw new Error('Scheduled stream manifest is already closed');
+      if (unavailable || !Array.isArray(envelopes)) return;
+      for (const envelope of envelopes) {
+        if (hashes.length >= MAX_EVENTS) { unavailable = 'event_limit'; break; }
+        let entry;
+        try { entry = fingerprint(envelope); }
+        catch { unavailable = 'invalid_or_oversize_event'; break; }
+        if (totalBytes + entry.bytes > MAX_TOTAL_BYTES) { unavailable = 'byte_limit'; break; }
+        hashes.push(entry.hash);
+        totalBytes += entry.bytes;
+      }
+      // A partial prefix is never a manifest.
+      if (unavailable) { hashes.length = 0; totalBytes = 0; }
+    },
+    finish() {
+      if (closed) throw new Error('Scheduled stream manifest is already closed');
+      closed = true;
+      if (unavailable) return { unavailable };
+      return { manifest: { version: 1, algorithm: 'sha256', runId: binding.runId,
+        sessionId: binding.sessionId, requestId: binding.requestId, dispatchId: binding.dispatchId,
+        count: hashes.length, totalBytes, hashes: [...hashes] } };
+    },
+  };
+}
+function validate(manifest, binding) {
+  return Boolean(manifest && typeof manifest === 'object' && !Array.isArray(manifest) &&
+    Object.keys(manifest).sort().join(',') === 'algorithm,count,dispatchId,hashes,requestId,runId,sessionId,totalBytes,version' &&
+    manifest.version === 1 && manifest.algorithm === 'sha256' &&
+    ['runId', 'sessionId', 'requestId', 'dispatchId'].every(key => id(binding?.[key]) && manifest[key] === binding[key]) &&
+    Number.isSafeInteger(manifest.count) && manifest.count >= 0 && manifest.count <= MAX_EVENTS &&
+    Number.isSafeInteger(manifest.totalBytes) && manifest.totalBytes >= 0 && manifest.totalBytes <= MAX_TOTAL_BYTES &&
+    Array.isArray(manifest.hashes) && manifest.hashes.length === manifest.count &&
+    manifest.hashes.every(value => typeof value === 'string' && HASH.test(value)));
+}
+function verify(manifest, binding, envelopes) {
+  if (!validate(manifest, binding) || !Array.isArray(envelopes) || envelopes.length !== manifest.count)
+    return false;
+  let totalBytes = 0;
+  try {
+    for (let index = 0; index < envelopes.length; index += 1) {
+      const entry = fingerprint(envelopes[index]);
+      if (entry.hash !== manifest.hashes[index]) return false;
+      totalBytes += entry.bytes;
+      if (totalBytes > MAX_TOTAL_BYTES) return false;
+    }
+  } catch { return false; }
+  return totalBytes === manifest.totalBytes;
+}
+module.exports = { MAX_EVENTS, MAX_EVENT_BYTES, MAX_TOTAL_BYTES, normalize, fingerprint, create, validate, verify };

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/scheduled-stream-wire.d.cts

@@ -0,0 +1,15 @@
+export interface ScheduledStreamBinding { runId: string; sessionId: string; requestId: string; dispatchId: string }
+export interface ScheduledStreamManifest extends ScheduledStreamBinding {
+  version: 1; algorithm: 'sha256'; count: number; totalBytes: number; hashes: string[];
+}
+export const MAX_EVENTS: number;
+export const MAX_EVENT_BYTES: number;
+export const MAX_TOTAL_BYTES: number;
+export function normalize(envelope: unknown): string;
+export function fingerprint(envelope: unknown): { hash: string; bytes: number; json: string };
+export function create(binding: ScheduledStreamBinding): {
+  add(envelopes: unknown): void;
+  finish(): { manifest: ScheduledStreamManifest } | { unavailable: string };
+};
+export function validate(manifest: unknown, binding: ScheduledStreamBinding): boolean;
+export function verify(manifest: unknown, binding: ScheduledStreamBinding, envelopes: unknown): boolean;