@skrr-ai/cli 0.1.126 → 0.1.127

package/dist/commands/agents/goals/list.d.ts

@@ -8,8 +8,8 @@ import { BaseCommand } from '../../../base-command';
  * Wraps `GET /api/agents/:agent_id/goals` (data-provider `listAgentGoals`),
  * which returns goals where the agent is owner, DRI, or a contributor, each
  * enriched with `_agentGoalRole` (which of the three) and `_completionPercent`.
- * The endpoint sorts by most-recently-updated and caps at 100 goals; there is
- * no pagination cursor, so neither is there a `--cursor` flag here.
+ * The endpoint sorts by most-recently-updated and supports cursor pagination.
+ * This command currently shows its first page of up to 100 goals.
  */
 export default class AgentsGoalsList extends BaseCommand {
     static description: string;

package/dist/commands/agents/goals/list.js

@@ -14,8 +14,8 @@ const format_1 = require("../../../lib/format");
  * Wraps `GET /api/agents/:agent_id/goals` (data-provider `listAgentGoals`),
  * which returns goals where the agent is owner, DRI, or a contributor, each
  * enriched with `_agentGoalRole` (which of the three) and `_completionPercent`.
- * The endpoint sorts by most-recently-updated and caps at 100 goals; there is
- * no pagination cursor, so neither is there a `--cursor` flag here.
+ * The endpoint sorts by most-recently-updated and supports cursor pagination.
+ * This command currently shows its first page of up to 100 goals.
  */
 class AgentsGoalsList extends base_command_1.BaseCommand {
     static description = 'List the goals an agent owns, is DRI for, or contributes to';

package/dist/commands/goals/create.d.ts

@@ -6,6 +6,7 @@ export default class GoalsCreate extends BaseCommand {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'from-json': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         title: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'idempotency-key': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         level: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'target-date': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/goals/create.js

@@ -24,6 +24,9 @@ class GoalsCreate extends base_command_1.BaseCommand {
             description: 'Path to a JSON file (or "-" for stdin) to use as the request body',
         }),
         title: core_1.Flags.string({ description: 'Goal title (required unless set via --from-json)' }),
+        'idempotency-key': core_1.Flags.string({
+            description: 'Stable key for retries of this exact Goal creation request',
+        }),
         description: core_1.Flags.string({ description: 'Goal description' }),
         level: core_1.Flags.string({
             description: 'Goal level',
@@ -126,7 +129,7 @@ class GoalsCreate extends base_command_1.BaseCommand {
             payload.labelIds = resolvedLabelIds;
         let created;
         try {
-            created = await data_provider_1.dataService.createGoal(payload);
+            created = await data_provider_1.dataService.createGoal(payload, flags['idempotency-key'] ? { idempotencyKey: flags['idempotency-key'] } : undefined);
             if (flags.space) {
                 const goalId = created.id;
                 if (!goalId || typeof goalId !== 'string') {

package/dist/commands/goals/revisions.js

@@ -4,20 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
-/**
- * The one class of goal change this log does not contain.
- *
- * `PATCH /api/goals/:goalId/planner-config` writes the goal through
- * `Goal.findOneAndUpdate` directly rather than `GoalModel.updateGoal`, which is
- * where `RevisionService` is called from — so arming, re-timing or disarming the
- * auto-planner (and any `maxActiveTasks` change made through that route) leaves
- * no revision. "Who turned the planner on for this goal, and when" is the audit
- * question a shared goal actually raises, and the table answers it with silence.
- *
- * Naming the gap is the honest thing the CLI can do; closing it is a server
- * change. DELETE THIS FOOTER once the planner-config route records a revision.
- */
-const PLANNER_GAP_NOTE = 'Note: auto-planner changes made with `goals planner-config` are not recorded as revisions.';
+const revision_actor_1 = require("../../lib/revision-actor");
 class GoalsRevisions extends base_command_1.BaseCommand {
     static description = 'List revisions for a goal';
     static examples = [
@@ -47,25 +34,22 @@ class GoalsRevisions extends base_command_1.BaseCommand {
         const items = result?.data ?? [];
         if (items.length === 0) {
             this.log('No revisions.');
-            this.log(PLANNER_GAP_NOTE);
             return;
         }
         const rows = items.map((rev) => ({
             version: String(rev.revisionNumber ?? '-'),
             changeType: String(rev.changeType ?? '-'),
-            user: String(rev.userId ?? '-'),
+            user: (0, revision_actor_1.revisionActorLabel)(rev),
             changes: String(Array.isArray(rev.changes) ? rev.changes.length : 0),
             when: rev.createdAt ? String(rev.createdAt).slice(0, 19).replace('T', ' ') : '-',
         }));
         (0, format_1.renderTable)(rows, [
             { key: 'version', header: 'REV' },
             { key: 'changeType', header: 'CHANGE' },
-            { key: 'user', header: 'USER' },
+            { key: 'user', header: 'ACTOR' },
             { key: 'changes', header: 'FIELDS' },
             { key: 'when', header: 'AT' },
         ], (line) => this.log(line));
-        this.log('');
-        this.log(PLANNER_GAP_NOTE);
     }
 }
 exports.default = GoalsRevisions;

package/dist/commands/spaces/revisions.js

@@ -5,6 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
 const space_output_1 = require("../../lib/space-output");
+const revision_actor_1 = require("../../lib/revision-actor");
 class SpacesRevisions extends base_command_1.BaseCommand {
     static description = 'List revisions for a space';
     static examples = [
@@ -40,14 +41,14 @@ class SpacesRevisions extends base_command_1.BaseCommand {
         const rows = items.map((rev) => ({
             version: String(rev.revisionNumber ?? '-'),
             changeType: String(rev.changeType ?? '-'),
-            user: String(rev.userId ?? '-'),
+            user: (0, revision_actor_1.revisionActorLabel)(rev),
             changes: String(Array.isArray(rev.changes) ? rev.changes.length : 0),
             when: rev.createdAt ? String(rev.createdAt).slice(0, 19).replace('T', ' ') : '-',
         }));
         (0, format_1.renderTable)(rows, [
             { key: 'version', header: 'REV' },
             { key: 'changeType', header: 'CHANGE' },
-            { key: 'user', header: 'USER' },
+            { key: 'user', header: 'ACTOR' },
             { key: 'changes', header: 'FIELDS' },
             { key: 'when', header: 'AT' },
         ], (line) => this.log(line));

package/dist/commands/tasks/revisions.js

@@ -5,6 +5,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
+const revision_actor_1 = require("../../lib/revision-actor");
 /** " (via CLI credential)" when the revision recorded its credential channel. */
 function revisionChannelSuffix(rev) {
     const via = rev.metadata?.via;
@@ -46,14 +47,14 @@ class TasksRevisions extends base_command_1.BaseCommand {
             version: String(rev.revisionNumber ?? '-'),
             changeType: String(rev.changeType ?? '-'),
             // The channel the person's credential came through, when recorded (OSK-16621).
-            user: `${String(rev.userId ?? '-')}${revisionChannelSuffix(rev)}`,
+            user: `${(0, revision_actor_1.revisionActorLabel)(rev)}${rev.userId != null ? revisionChannelSuffix(rev) : ''}`,
             changes: String(Array.isArray(rev.changes) ? rev.changes.length : 0),
             when: rev.createdAt ? String(rev.createdAt).slice(0, 19).replace('T', ' ') : '-',
         }));
         (0, format_1.renderTable)(rows, [
             { key: 'version', header: 'REV' },
             { key: 'changeType', header: 'CHANGE' },
-            { key: 'user', header: 'USER' },
+            { key: 'user', header: 'ACTOR' },
             { key: 'changes', header: 'FIELDS' },
             { key: 'when', header: 'AT' },
         ], (line) => this.log(line));

package/dist/commands/triggers/fire-detail.js

@@ -29,6 +29,8 @@ function describeFireAuditDetail(detail, fireId, triggerId) {
         lines.push(`Duration:     ${String(detail.durationMs)}ms`);
     if (detail.conversationId)
         lines.push(`Conversation: ${String(detail.conversationId)}`);
+    // Tool calls refused during a turn that was delivered: `triggers show` points here for the facts.
+    lines.push(...(0, triggers_1.fireRefusalLines)(detail.metadata));
     return lines;
 }
 class TriggersFireDetail extends base_command_1.BaseCommand {

package/dist/lib/revision-actor.d.ts

@@ -0,0 +1,2 @@
+/** Render the actual actor without presenting a system or Agent as a user. */
+export declare function revisionActorLabel(revision: Record<string, unknown>): string;

package/dist/lib/revision-actor.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revisionActorLabel = revisionActorLabel;
+/** Render the actual actor without presenting a system or Agent as a user. */
+function revisionActorLabel(revision) {
+    if (revision.userId != null)
+        return String(revision.userId);
+    const actor = revision.actor;
+    if (actor && typeof actor === 'object' && !Array.isArray(actor)) {
+        const { kind, id } = actor;
+        if ((kind === 'system' || kind === 'agent') && typeof id === 'string' && id) {
+            return `${kind}: ${id}`;
+        }
+    }
+    return '-';
+}

package/dist/lib/triggers.d.ts

@@ -158,6 +158,15 @@ export interface TriggerFireRecord {
         replayBlockedReason?: string;
         replayRequirements?: string[];
         replayContext?: unknown;
+        /** Tool calls refused during a turn that was delivered (OSK-20776). */
+        permissionRefusals?: {
+            count?: number;
+            tools?: string[];
+            unattended?: boolean;
+            layer?: string;
+        };
+        /** The refusal record could not be read for this fire, which is not "none were refused". */
+        permissionRefusalsUnread?: boolean;
     };
 }
 export interface TriggerListResponse {
@@ -516,6 +525,29 @@ export declare function writeModeLabel(writeMode: string): string;
  * the configured base URL rather than guessed.
  */
 export declare function webhookIngestUrl(baseURL: string, triggerId: string): string;
+/**
+ * What `triggers show` adds when the last fire DELIVERED but had tool calls
+ * refused (OSK-20776). The outcome of such a fire is `succeeded`, so the
+ * `Fires:` line reads as success; this says what the string after `last` means
+ * and what a person can do about it.
+ *
+ * It states the mechanism and not this fire's cause, because `lastResult` names
+ * the refused kinds only. Whether a fire was unattended, and which layer
+ * refused, is on the fire record (`fire-detail`), and this points there.
+ *
+ * It does not recommend a mode. `bypassPermissions` is the only mode under which
+ * an unattended shell call runs, and it runs EVERY call without asking, which is
+ * a decision about what this agent may do on its own (a release job included),
+ * not a hint to paste.
+ */
+export declare function toolsRefusedHintLines(trigger: TriggerDefinition, kinds: readonly string[], bin?: string): string[];
+/**
+ * The refusal facts a fire record holds, as `fire-detail` lines. Nothing when
+ * the fire recorded none. A fire whose record could not be read says so: that
+ * is not the same as no refusal, and a reader must not be able to mistake it
+ * for one.
+ */
+export declare function fireRefusalLines(metadata: unknown): string[];
 export declare function renderTriggerSummary(trigger: TriggerDefinition, log: (line: string) => void, options?: {
     baseURL?: string;
 }): void;

package/dist/lib/triggers.js

@@ -48,6 +48,8 @@ exports.formatDuplicateSubscriptionWarning = formatDuplicateSubscriptionWarning;
 exports.armedStateLabel = armedStateLabel;
 exports.writeModeLabel = writeModeLabel;
 exports.webhookIngestUrl = webhookIngestUrl;
+exports.toolsRefusedHintLines = toolsRefusedHintLines;
+exports.fireRefusalLines = fireRefusalLines;
 exports.renderTriggerSummary = renderTriggerSummary;
 exports.renderLegacyRuns = renderLegacyRuns;
 exports.renderFireAudit = renderFireAudit;
@@ -1276,6 +1278,65 @@ const WEBHOOK_INGEST_KINDS = new Set(['on_demand', 'form', 'chat_message']);
 function webhookIngestUrl(baseURL, triggerId) {
     return `${String(baseURL).replace(/\/+$/, '')}/api/triggers/webhook/${encodeURIComponent(triggerId)}`;
 }
+/** An id or token that is short and plain, so it is safe in a command a person will paste. */
+const PLAIN_TOKEN = /^[A-Za-z0-9_.-]{1,64}$/;
+/**
+ * What `triggers show` adds when the last fire DELIVERED but had tool calls
+ * refused (OSK-20776). The outcome of such a fire is `succeeded`, so the
+ * `Fires:` line reads as success; this says what the string after `last` means
+ * and what a person can do about it.
+ *
+ * It states the mechanism and not this fire's cause, because `lastResult` names
+ * the refused kinds only. Whether a fire was unattended, and which layer
+ * refused, is on the fire record (`fire-detail`), and this points there.
+ *
+ * It does not recommend a mode. `bypassPermissions` is the only mode under which
+ * an unattended shell call runs, and it runs EVERY call without asking, which is
+ * a decision about what this agent may do on its own (a release job included),
+ * not a hint to paste.
+ */
+function toolsRefusedHintLines(trigger, kinds, bin = 'skrr') {
+    const scopedAgent = trigger.scope?.kind === 'agent' ? trigger.scope.refs?.agentId : undefined;
+    const agent = typeof scopedAgent === 'string' && PLAIN_TOKEN.test(scopedAgent) ? scopedAgent : '<agent>';
+    const triggerId = typeof trigger.id === 'string' && PLAIN_TOKEN.test(trigger.id) ? trigger.id : '<trigger-id>';
+    const what = kinds.length > 0 ? kinds.join(', ') : 'some tool calls';
+    return [
+        `Refused:  ${what} - the last fire delivered, but these tool calls were refused`,
+        '          A scheduled fire runs unattended: a call that would need approval is refused, because no one is there to give it.',
+        "          To allow it, change the agent's permission mode (bypassPermissions runs every tool call without asking, so decide that on purpose):",
+        `            ${bin} agents update ${agent} --default-permission-mode <mode>   (modes: ${bin} agents update --help)`,
+        `          What was refused, per fire: ${bin} triggers audit ${triggerId}, then ${bin} triggers fire-detail ${triggerId} <fire-id>`,
+    ];
+}
+/**
+ * The refusal facts a fire record holds, as `fire-detail` lines. Nothing when
+ * the fire recorded none. A fire whose record could not be read says so: that
+ * is not the same as no refusal, and a reader must not be able to mistake it
+ * for one.
+ */
+function fireRefusalLines(metadata) {
+    if (!metadata || typeof metadata !== 'object')
+        return [];
+    const { permissionRefusals, permissionRefusalsUnread } = metadata;
+    const lines = [];
+    if (permissionRefusals && typeof permissionRefusals === 'object') {
+        const { count, tools, unattended, layer } = permissionRefusals;
+        const kinds = (Array.isArray(tools) ? tools : []).filter((tool) => typeof tool === 'string' && PLAIN_TOKEN.test(tool));
+        const calls = typeof count === 'number' && Number.isFinite(count) && count > 0
+            ? `${count} tool call${count === 1 ? '' : 's'}`
+            : 'tool calls';
+        const parts = [`${calls} refused${kinds.length > 0 ? ` (${kinds.join(', ')})` : ''}`];
+        if (unattended === true)
+            parts.push('unattended, so no one could grant them');
+        if (typeof layer === 'string' && PLAIN_TOKEN.test(layer))
+            parts.push(`refused by ${layer}`);
+        lines.push(`Refused:      ${parts.join('; ')}`);
+    }
+    if (permissionRefusalsUnread === true) {
+        lines.push('Refused:      unknown - the refusal record could not be read for this fire; that is not the same as none');
+    }
+    return lines;
+}
 function renderTriggerSummary(trigger, log, options = {}) {
     log(`ID:       ${trigger.id ?? '-'}`);
     log(`Kind:     ${trigger.kind ?? '-'}`);
@@ -1389,6 +1450,11 @@ function renderTriggerSummary(trigger, log, options = {}) {
                 parts.push(`last ${audit.lastResult}`);
             log(`Fires:    ${parts.join(', ')}`);
         }
+        // `last tools_refused:...` above is a success that held a refusal. Say what that means.
+        const refused = (0, data_provider_1.parseToolsRefusedResult)(audit.lastResult);
+        if (refused)
+            for (const line of toolsRefusedHintLines(trigger, refused))
+                log(line);
         // The reason, at the surface a reader reaches for — not only in `--json`.
         if (audit.lastError)
             log(`Last error: ${audit.lastError}`);