@skrr-ai/cli 0.1.126 → 0.1.128

package/dist/lib/proposal-decision-command.js

@@ -82,7 +82,27 @@ class ProposalDecisionCommand extends base_command_1.BaseCommand {
             }
             this.handleApiError(error);
         }
-        this.log(flags.json ? JSON.stringify(result, null, 2) : `Proposal ${decision} decision recorded.`);
+        // A retry whose first response was lost lands on the decision that already took effect; the
+        // server marks it, so it is not worded like a first success (OSK-21191).
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+        }
+        else if (result.replayed) {
+            // The receipt repeats the decision that was ASKED for; what the intent's outcome actually is
+            // (applied, still waiting to be applied, rejected) is on the proposal, so read it (OSK-21250).
+            // Best effort: when that read fails the message names the decision, as before.
+            let view;
+            try {
+                view = await proposals_1.proposalApi.show(ref.kind, ref.id);
+            }
+            catch {
+                view = undefined;
+            }
+            this.log((0, proposals_1.describeReplay)(decision, result, view));
+        }
+        else {
+            this.log(`Proposal ${decision} decision recorded.`);
+        }
     }
 }
 exports.ProposalDecisionCommand = ProposalDecisionCommand;

package/dist/lib/proposals.d.ts

@@ -1,4 +1,4 @@
-import type { ProposalDecisionParams, ProposalDecisionResponse, ProposalKind, ProposalListParams, ProposalListResponse, ProposalView } from '@skrr-ai/data-provider';
+import type { ProposalDecision, ProposalDecisionParams, ProposalDecisionResponse, ProposalKind, ProposalListParams, ProposalListResponse, ProposalView } from '@skrr-ai/data-provider';
 /** The unified, read-time proposal inbox. Decisions are routed by the server to
  * each family's own writer; the CLI never writes a source row. */
 export declare const proposalApi: {
@@ -23,3 +23,28 @@ export declare function resolveProposalRef(kindArg: string | undefined, idArg: s
 };
 /** A 404 here means no such proposal under THIS kind: the id is looked up under the kind given. */
 export declare function describeProposalNotFound(kind: string, id: string, bin?: string): string;
+/**
+ * The intent's title in words: what it would DO, to what. Any other kind of proposal, and an
+ * intent the server sent no context for, keeps the view's own title.
+ */
+export declare function proposalTitleFor(view: ProposalView): string;
+/**
+ * The inbox files a rejection nobody on the owner's side made under `discarded`. For a Northstar
+ * intent the verdict, and who made it, is said in the NOTE column, so a policy refusal is not
+ * read as something the person threw away.
+ */
+export declare function northstarIntentNote(view: ProposalView): string;
+/**
+ * `proposals show` for a Northstar intent, as lines a person can read. Null for every other kind,
+ * which keeps printing the full JSON as before (a script reading it does not change).
+ */
+export declare function renderNorthstarIntentView(view: ProposalView): string[] | null;
+/**
+ * What a replayed decision says. The replay receipt names the decision that was asked for ("keep"), but a
+ * Northstar intent that was kept has gone on: it may be applied, or approved and not applied yet, and a
+ * discard lands as `rejected`. "Already kept" for an intent that was in fact applied understated what
+ * had happened (OSK-21250), so the intent's own verdict is named when the proposal could be read.
+ */
+export declare function describeReplay(decision: ProposalDecision, receipt: {
+    decidedAt?: string;
+}, view?: ProposalView): string;

package/dist/lib/proposals.js

@@ -3,8 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.proposalApi = void 0;
 exports.resolveProposalRef = resolveProposalRef;
 exports.describeProposalNotFound = describeProposalNotFound;
+exports.proposalTitleFor = proposalTitleFor;
+exports.northstarIntentNote = northstarIntentNote;
+exports.renderNorthstarIntentView = renderNorthstarIntentView;
+exports.describeReplay = describeReplay;
 const data_provider_1 = require("@skrr-ai/data-provider");
 const data_provider_2 = require("@skrr-ai/data-provider");
+const northstars_1 = require("./northstars");
 const triggers_1 = require("./triggers");
 const MOUNT = '/api/proposals';
 /** The unified, read-time proposal inbox. Decisions are routed by the server to
@@ -61,3 +66,161 @@ function describeProposalNotFound(kind, id, bin = 'skrr') {
     return (`No ${kind} proposal ${id} is visible to you. A proposal is looked up under its kind, so an id ` +
         `that exists under another kind is not found here; \`${bin} proposals list\` prints each as KIND:ID.`);
 }
+/* --------------------------------------------------------------------------
+ * A Northstar intent, in words
+ *
+ * `proposals list` showed the intent's TITLE as its kind code (`pause_commitment`),
+ * `proposals show` printed the raw JSON, `rejected` read as `discarded` (the inbox's
+ * own vocabulary, which says a person discarded something), and the sentence the
+ * governor wrote lived only inside the JSON. Everything below renders fields the
+ * view already carries; no new data is needed.
+ * ------------------------------------------------------------------------ */
+/** What each kind of intent does, as a phrase a target can follow. A new kind fails the build. */
+const INTENT_PHRASE = {
+    pause_commitment: 'Pause',
+    resume_commitment: 'Resume',
+    reprioritize_commitment: 'Reprioritize',
+    request_commitment_check: 'Check now:',
+    set_execution_bounds: 'Change the run bounds of',
+    create_commitment_proposal: 'Start a new commitment',
+    reassign_commitment_proposal: 'Reassign',
+};
+/** The intent's own verdict, which the inbox flattens into proposed/kept/discarded/expired. */
+const VERDICT_WORDS = {
+    advisory: 'advisory: recorded for you to read, nothing to decide',
+    awaiting_approval: 'waiting for your decision',
+    approved: 'approved, not applied yet',
+    applying: 'being applied',
+    applied: 'applied',
+    rejected: 'rejected',
+    invalidated: 'invalidated: it went stale before it was applied',
+};
+function isNorthstarIntentView(view) {
+    return view.kind === 'northstar_intent' && Boolean(view.decisionContext?.snapshot);
+}
+function intentTarget(view) {
+    const id = view.decisionContext?.snapshot.targetCommitmentId ?? view.commitmentId;
+    if (view.commitmentTitle)
+        return id ? `${view.commitmentTitle} (${id})` : view.commitmentTitle;
+    return id ?? 'a commitment';
+}
+/**
+ * The intent's title in words: what it would DO, to what. Any other kind of proposal, and an
+ * intent the server sent no context for, keeps the view's own title.
+ */
+function proposalTitleFor(view) {
+    if (!isNorthstarIntentView(view))
+        return view.title;
+    const snapshot = view.decisionContext.snapshot;
+    const phrase = INTENT_PHRASE[snapshot.kind] ?? snapshot.kind;
+    if (snapshot.kind === 'create_commitment_proposal') {
+        const title = snapshot.payload?.title;
+        return typeof title === 'string' && title.trim() ? `${phrase}: ${title.trim()}` : phrase;
+    }
+    if (snapshot.kind === 'reassign_commitment_proposal') {
+        const agent = snapshot.payload?.agentId;
+        const to = typeof agent === 'string' && agent ? ` to agent ${agent}` : '';
+        return `${phrase} ${intentTarget(view)}${to}`;
+    }
+    return `${phrase} ${intentTarget(view)}`;
+}
+/**
+ * The inbox files a rejection nobody on the owner's side made under `discarded`. For a Northstar
+ * intent the verdict, and who made it, is said in the NOTE column, so a policy refusal is not
+ * read as something the person threw away.
+ */
+function northstarIntentNote(view) {
+    if (!isNorthstarIntentView(view))
+        return '';
+    const verdict = view.sourceStatus;
+    const reason = view.decision?.reason ? `: ${view.decision.reason}` : '';
+    if (verdict === 'rejected') {
+        return view.decision?.by ? `rejected by you${reason}` : `rejected by policy${reason}`;
+    }
+    if (verdict === 'invalidated') {
+        return `invalidated: it went stale, nothing was discarded${reason}`;
+    }
+    if (verdict === 'advisory')
+        return 'advisory: nothing to decide';
+    return '';
+}
+/**
+ * `proposals show` for a Northstar intent, as lines a person can read. Null for every other kind,
+ * which keeps printing the full JSON as before (a script reading it does not change).
+ */
+function renderNorthstarIntentView(view) {
+    if (!isNorthstarIntentView(view))
+        return null;
+    const context = view.decisionContext;
+    const verdict = view.sourceStatus;
+    const risk = context.riskLevel ?? context.snapshot.riskLevel ?? 'unknown';
+    const hasTarget = Boolean(context.snapshot.targetCommitmentId || view.commitmentId);
+    const lines = [proposalTitleFor(view), ''];
+    lines.push(`Proposal    ${view.id}`);
+    lines.push(`Kind        ${context.snapshot.kind} · risk ${risk}`);
+    lines.push(`Target      ${hasTarget ? intentTarget(view) : 'none (a new commitment)'}`);
+    if (context.reason)
+        lines.push(`Why         ${context.reason}`);
+    lines.push(`Status      ${VERDICT_WORDS[verdict] ?? verdict}  (the inbox files it under "${view.disposition}")`);
+    const decision = view.decision;
+    if (verdict === 'awaiting_approval' || verdict === 'advisory') {
+        // Nobody has decided: `decision.reason` here is the policy that HELD it (or kept it advisory),
+        // and printing it as "Decided … by policy" read as a recorded decision (OSK-21251).
+        if (decision?.reason) {
+            const words = (0, northstars_1.describeNorthstarReason)(decision.reason);
+            lines.push(verdict === 'awaiting_approval' ? `Waiting for you: ${words}` : `Not decided: ${words}`);
+        }
+    }
+    else if (decision && (decision.at || decision.by || decision.reason)) {
+        const at = decision.at ? `${(0, northstars_1.shortDate)(decision.at)} UTC` : 'at an unrecorded time';
+        const by = decision.by ? ` by user ${decision.by}` : ' by policy';
+        const via = decision.via ? ` via ${decision.via}` : '';
+        const reason = decision.reason ? `: ${decision.reason}` : '';
+        lines.push(`Decided     ${at}${by}${via}${reason}`);
+    }
+    if (view.canDecide) {
+        lines.push(`Can decide  ${view.availableDecisions.join(', ')}`);
+    }
+    else {
+        const why = view.undecidableReason
+            ? data_provider_2.PROPOSAL_UNDECIDABLE_TEXT[view.undecidableReason]
+            : 'not now';
+        lines.push(`Can decide  no: ${why}`);
+    }
+    const continuation = view.continuation;
+    if (continuation) {
+        const bits = [continuation.status, continuation.commitmentId, continuation.reason].filter(Boolean);
+        lines.push(`Continued   ${bits.join(' · ')}`);
+    }
+    lines.push(`Revision    ${JSON.stringify(view.revision)}`);
+    // The hint is for a proposal that can still be decided: beside "Can decide  no" it contradicts
+    // the line above it (OSK-21255).
+    if (view.canDecide) {
+        lines.push('            (pass this exact JSON as --expected to keep, discard or snooze)');
+    }
+    lines.push(`Web         ${view.links.web}`);
+    return lines;
+}
+/**
+ * What a replayed decision says. The replay receipt names the decision that was asked for ("keep"), but a
+ * Northstar intent that was kept has gone on: it may be applied, or approved and not applied yet, and a
+ * discard lands as `rejected`. "Already kept" for an intent that was in fact applied understated what
+ * had happened (OSK-21250), so the intent's own verdict is named when the proposal could be read.
+ */
+function describeReplay(decision, receipt, view) {
+    let outcome = { keep: 'kept', discard: 'discarded', snooze: 'snoozed' }[decision];
+    if (view && isNorthstarIntentView(view)) {
+        const settled = INTENT_REPLAY_WORDS[view.sourceStatus];
+        if (settled)
+            outcome = settled;
+    }
+    const when = receipt.decidedAt ? ` at ${(0, northstars_1.shortDate)(receipt.decidedAt)} UTC` : '';
+    return `Already ${outcome}${when} — nothing changed.`;
+}
+/** The verdicts a replayed keep or discard can find an intent in. */
+const INTENT_REPLAY_WORDS = {
+    applied: 'applied',
+    approved: 'approved (not applied yet)',
+    applying: 'approved and being applied',
+    rejected: 'rejected',
+};

package/dist/lib/rate-limit-retry.d.ts

@@ -10,6 +10,11 @@
  * `X-Idempotency-Key` (every `request.ts` / adapter write does). A 429 means the
  * request was refused before it ran, so the key is belt and braces.
  *
+ * Never retried when the body says it cannot help: a 429 that declares
+ * `retryable: false` (a follow-up budget refusal, which says the day resets at
+ * 00:00 UTC) is a refusal to keep, not a limiter to wait out. Retrying it sent the
+ * same refused request three times and told the server about three intents (OSK-21266).
+ *
  * Bounded twice: at most `maxRetries` extra attempts and a per-wait ceiling, so
  * a stuck limiter costs a script seconds, not minutes. `SKRR_RATE_LIMIT_RETRIES=0`
  * turns it off.

package/dist/lib/rate-limit-retry.js

@@ -11,6 +11,11 @@
  * `X-Idempotency-Key` (every `request.ts` / adapter write does). A 429 means the
  * request was refused before it ran, so the key is belt and braces.
  *
+ * Never retried when the body says it cannot help: a 429 that declares
+ * `retryable: false` (a follow-up budget refusal, which says the day resets at
+ * 00:00 UTC) is a refusal to keep, not a limiter to wait out. Retrying it sent the
+ * same refused request three times and told the server about three intents (OSK-21266).
+ *
  * Bounded twice: at most `maxRetries` extra attempts and a per-wait ceiling, so
  * a stuck limiter costs a script seconds, not minutes. `SKRR_RATE_LIMIT_RETRIES=0`
  * turns it off.
@@ -65,6 +70,18 @@ function retryAfterOf(response) {
         ? parseRetryAfterMs(response.headers.get('retry-after'))
         : undefined;
 }
+/** A 429 whose body declares `retryable: false`. Reads a clone, so the caller still gets the body. */
+async function declaresNotRetryable(response) {
+    if (response.status !== 429)
+        return false;
+    try {
+        const body = (await response.clone().json());
+        return body?.retryable === false;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Run `attemptFetch` and, on a 429 for a replay-safe request, wait and run it
  * again. Returns the last response, with `retryAfterMs` of the final 429 (so the
@@ -80,6 +97,8 @@ async function fetchWithRateLimitRetry(attemptFetch, options) {
     for (let attempt = 0; attempt < max && response.status === 429; attempt++) {
         if (options.signal?.aborted)
             break;
+        if (await declaresNotRetryable(response))
+            break;
         await sleep(rateLimitWaitMs(attempt, retryAfterMs, options.random));
         response = await attemptFetch();
         retryAfterMs = retryAfterOf(response);

package/dist/lib/revision-actor.d.ts

@@ -0,0 +1,2 @@
+/** Render the actual actor without presenting a system or Agent as a user. */
+export declare function revisionActorLabel(revision: Record<string, unknown>): string;

package/dist/lib/revision-actor.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revisionActorLabel = revisionActorLabel;
+/** Render the actual actor without presenting a system or Agent as a user. */
+function revisionActorLabel(revision) {
+    if (revision.userId != null)
+        return String(revision.userId);
+    const actor = revision.actor;
+    if (actor && typeof actor === 'object' && !Array.isArray(actor)) {
+        const { kind, id } = actor;
+        if ((kind === 'system' || kind === 'agent') && typeof id === 'string' && id) {
+            return `${kind}: ${id}`;
+        }
+    }
+    return '-';
+}

package/dist/lib/roles.d.ts

@@ -53,7 +53,7 @@ export declare const roleApi: {
                 config?: Record<string, unknown> | undefined;
             }[];
             sources: {
-                source: "space" | "tasks" | "memory" | "daemon" | "email" | "goal" | "files" | "local" | "browser" | "conversations" | "slack" | "github" | "messages" | "calendar" | "agent_run" | "docs" | "metrics" | "agent_initiatives" | "documents" | "product_metrics" | "business_metrics" | "state_monitor" | "monitor";
+                source: "space" | "tasks" | "memory" | "daemon" | "email" | "goal" | "files" | "local" | "browser" | "conversations" | "slack" | "github" | "messages" | "calendar" | "docs" | "metrics" | "agent_run" | "agent_initiatives" | "documents" | "product_metrics" | "business_metrics" | "state_monitor" | "monitor";
                 enabled: boolean;
                 config?: Record<string, unknown> | undefined;
             }[];

package/dist/lib/space-charter.js

@@ -51,6 +51,15 @@ function charterLines(charter, { binName, spaceId, full = false }) {
     if (lead) {
         for (const line of lead.split('\n'))
             lines.push(`  ${line}`);
+        // Agents are handed about the first `leadContextChars` characters of the lead, then a pointer
+        // to the rest. The page printed all of it under "read by every agent", so a long lead looked
+        // fully delivered (the web card warns; the CLI said nothing). Measured like the server does.
+        const cap = charter.leadContextChars;
+        if (typeof cap === 'number' && cap > 0 && lead.length > cap) {
+            lines.push('');
+            lines.push(`  Over the cap: this lead is ${lead.length} characters and agents get about the first ${cap}, ` +
+                'then a pointer to the rest. Put the essentials first, or move detail below a ## heading.');
+        }
     }
     else {
         lines.push('  (empty: the page opens with a ## heading, so agents receive no charter lead. ' +

package/dist/lib/task-asset-upload.js

@@ -68,7 +68,6 @@ const fs = __importStar(require("node:fs"));
 const http = __importStar(require("node:http"));
 const https = __importStar(require("node:https"));
 const path = __importStar(require("node:path"));
-const node_buffer_1 = require("node:buffer");
 const node_crypto_1 = require("node:crypto");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../base-command");
@@ -223,7 +222,7 @@ function taskAssetMarkdownRef(asset) {
  */
 function fileFormData(filePath, filename, mimeType, role, ledger) {
     const fd = new FormData();
-    fd.append('file', new node_buffer_1.Blob([fs.readFileSync(filePath)], { type: mimeType }), filename);
+    fd.append('file', new Blob([fs.readFileSync(filePath)], { type: mimeType }), filename);
     if (role)
         fd.append('role', role);
     if (ledger?.identity) {

package/dist/lib/triggers.d.ts

@@ -158,6 +158,15 @@ export interface TriggerFireRecord {
         replayBlockedReason?: string;
         replayRequirements?: string[];
         replayContext?: unknown;
+        /** Tool calls refused during a turn that was delivered (OSK-20776). */
+        permissionRefusals?: {
+            count?: number;
+            tools?: string[];
+            unattended?: boolean;
+            layer?: string;
+        };
+        /** The refusal record could not be read for this fire, which is not "none were refused". */
+        permissionRefusalsUnread?: boolean;
     };
 }
 export interface TriggerListResponse {
@@ -499,7 +508,7 @@ export declare function formatDuplicateSubscriptionWarning(trigger: unknown): {
  * "armed" when it will fire and "inert" until enabled — so a freshly-created
  * trigger did not plainly confirm it is live.
  */
-export declare function armedStateLabel(enabled: boolean | undefined): string;
+export declare function armedStateLabel(enabled: boolean | undefined, lastResult?: string | null): string;
 /**
  * Human phrasing for an effect trigger's write mode (OSK-4886).
  *
@@ -516,6 +525,29 @@ export declare function writeModeLabel(writeMode: string): string;
  * the configured base URL rather than guessed.
  */
 export declare function webhookIngestUrl(baseURL: string, triggerId: string): string;
+/**
+ * What `triggers show` adds when the last fire DELIVERED but had tool calls
+ * refused (OSK-20776). The outcome of such a fire is `succeeded`, so the
+ * `Fires:` line reads as success; this says what the string after `last` means
+ * and what a person can do about it.
+ *
+ * It states the mechanism and not this fire's cause, because `lastResult` names
+ * the refused kinds only. Whether a fire was unattended, and which layer
+ * refused, is on the fire record (`fire-detail`), and this points there.
+ *
+ * It does not recommend a mode. `bypassPermissions` is the only mode under which
+ * an unattended shell call runs, and it runs EVERY call without asking, which is
+ * a decision about what this agent may do on its own (a release job included),
+ * not a hint to paste.
+ */
+export declare function toolsRefusedHintLines(trigger: TriggerDefinition, kinds: readonly string[], bin?: string): string[];
+/**
+ * The refusal facts a fire record holds, as `fire-detail` lines. Nothing when
+ * the fire recorded none. A fire whose record could not be read says so: that
+ * is not the same as no refusal, and a reader must not be able to mistake it
+ * for one.
+ */
+export declare function fireRefusalLines(metadata: unknown): string[];
 export declare function renderTriggerSummary(trigger: TriggerDefinition, log: (line: string) => void, options?: {
     baseURL?: string;
 }): void;

package/dist/lib/triggers.js

@@ -48,6 +48,8 @@ exports.formatDuplicateSubscriptionWarning = formatDuplicateSubscriptionWarning;
 exports.armedStateLabel = armedStateLabel;
 exports.writeModeLabel = writeModeLabel;
 exports.webhookIngestUrl = webhookIngestUrl;
+exports.toolsRefusedHintLines = toolsRefusedHintLines;
+exports.fireRefusalLines = fireRefusalLines;
 exports.renderTriggerSummary = renderTriggerSummary;
 exports.renderLegacyRuns = renderLegacyRuns;
 exports.renderFireAudit = renderFireAudit;
@@ -1239,8 +1241,16 @@ function formatDuplicateSubscriptionWarning(trigger) {
  * "armed" when it will fire and "inert" until enabled — so a freshly-created
  * trigger did not plainly confirm it is live.
  */
-function armedStateLabel(enabled) {
-    return enabled === false ? 'no — inert until enabled' : 'yes — will fire';
+function armedStateLabel(enabled, lastResult) {
+    if (enabled === false)
+        return 'no — inert until enabled';
+    // "Will fire" is the row's intent. A platform-managed row whose owner is fenced (Always-On off) ticks on
+    // schedule and is skipped every time, and the same screen's `Fires:` line says so; the first line a reader
+    // meets must not say the opposite (dogfood df-261031-commitment-authoring, OSK-21103).
+    const skipped = typeof lastResult === 'string' ? /^skipped:(.+)$/.exec(lastResult) : null;
+    return skipped
+        ? `yes — but its last tick was skipped (${skipped[1]}), so it did not run`
+        : 'yes — will fire';
 }
 /**
  * Human phrasing for an effect trigger's write mode (OSK-4886).
@@ -1276,10 +1286,69 @@ const WEBHOOK_INGEST_KINDS = new Set(['on_demand', 'form', 'chat_message']);
 function webhookIngestUrl(baseURL, triggerId) {
     return `${String(baseURL).replace(/\/+$/, '')}/api/triggers/webhook/${encodeURIComponent(triggerId)}`;
 }
+/** An id or token that is short and plain, so it is safe in a command a person will paste. */
+const PLAIN_TOKEN = /^[A-Za-z0-9_.-]{1,64}$/;
+/**
+ * What `triggers show` adds when the last fire DELIVERED but had tool calls
+ * refused (OSK-20776). The outcome of such a fire is `succeeded`, so the
+ * `Fires:` line reads as success; this says what the string after `last` means
+ * and what a person can do about it.
+ *
+ * It states the mechanism and not this fire's cause, because `lastResult` names
+ * the refused kinds only. Whether a fire was unattended, and which layer
+ * refused, is on the fire record (`fire-detail`), and this points there.
+ *
+ * It does not recommend a mode. `bypassPermissions` is the only mode under which
+ * an unattended shell call runs, and it runs EVERY call without asking, which is
+ * a decision about what this agent may do on its own (a release job included),
+ * not a hint to paste.
+ */
+function toolsRefusedHintLines(trigger, kinds, bin = 'skrr') {
+    const scopedAgent = trigger.scope?.kind === 'agent' ? trigger.scope.refs?.agentId : undefined;
+    const agent = typeof scopedAgent === 'string' && PLAIN_TOKEN.test(scopedAgent) ? scopedAgent : '<agent>';
+    const triggerId = typeof trigger.id === 'string' && PLAIN_TOKEN.test(trigger.id) ? trigger.id : '<trigger-id>';
+    const what = kinds.length > 0 ? kinds.join(', ') : 'some tool calls';
+    return [
+        `Refused:  ${what} - the last fire delivered, but these tool calls were refused`,
+        '          A scheduled fire runs unattended: a call that would need approval is refused, because no one is there to give it.',
+        "          To allow it, change the agent's permission mode (bypassPermissions runs every tool call without asking, so decide that on purpose):",
+        `            ${bin} agents update ${agent} --default-permission-mode <mode>   (modes: ${bin} agents update --help)`,
+        `          What was refused, per fire: ${bin} triggers audit ${triggerId}, then ${bin} triggers fire-detail ${triggerId} <fire-id>`,
+    ];
+}
+/**
+ * The refusal facts a fire record holds, as `fire-detail` lines. Nothing when
+ * the fire recorded none. A fire whose record could not be read says so: that
+ * is not the same as no refusal, and a reader must not be able to mistake it
+ * for one.
+ */
+function fireRefusalLines(metadata) {
+    if (!metadata || typeof metadata !== 'object')
+        return [];
+    const { permissionRefusals, permissionRefusalsUnread } = metadata;
+    const lines = [];
+    if (permissionRefusals && typeof permissionRefusals === 'object') {
+        const { count, tools, unattended, layer } = permissionRefusals;
+        const kinds = (Array.isArray(tools) ? tools : []).filter((tool) => typeof tool === 'string' && PLAIN_TOKEN.test(tool));
+        const calls = typeof count === 'number' && Number.isFinite(count) && count > 0
+            ? `${count} tool call${count === 1 ? '' : 's'}`
+            : 'tool calls';
+        const parts = [`${calls} refused${kinds.length > 0 ? ` (${kinds.join(', ')})` : ''}`];
+        if (unattended === true)
+            parts.push('unattended, so no one could grant them');
+        if (typeof layer === 'string' && PLAIN_TOKEN.test(layer))
+            parts.push(`refused by ${layer}`);
+        lines.push(`Refused:      ${parts.join('; ')}`);
+    }
+    if (permissionRefusalsUnread === true) {
+        lines.push('Refused:      unknown - the refusal record could not be read for this fire; that is not the same as none');
+    }
+    return lines;
+}
 function renderTriggerSummary(trigger, log, options = {}) {
     log(`ID:       ${trigger.id ?? '-'}`);
     log(`Kind:     ${trigger.kind ?? '-'}`);
-    log(`Armed:    ${armedStateLabel(trigger.enabled)}`);
+    log(`Armed:    ${armedStateLabel(trigger.enabled, trigger.audit?.lastResult)}`);
     log(`Scope:    ${scopeLabel(trigger)}`);
     /*
      * Say when the row is not yours to change.
@@ -1389,6 +1458,11 @@ function renderTriggerSummary(trigger, log, options = {}) {
                 parts.push(`last ${audit.lastResult}`);
             log(`Fires:    ${parts.join(', ')}`);
         }
+        // `last tools_refused:...` above is a success that held a refusal. Say what that means.
+        const refused = (0, data_provider_1.parseToolsRefusedResult)(audit.lastResult);
+        if (refused)
+            for (const line of toolsRefusedHintLines(trigger, refused))
+                log(line);
         // The reason, at the surface a reader reaches for — not only in `--json`.
         if (audit.lastError)
             log(`Last error: ${audit.lastError}`);