@skrr-ai/cli 0.1.126 → 0.1.128

package/dist/generated/agent-guides.json

@@ -375,10 +375,10 @@
                 "id": "commitments",
                 "title": "Commitments and acting later",
                 "readWhen": "you make something happen later, repeatedly or continuously, or give an Agent a standing responsibility",
-                "version": 3,
+                "version": 4,
                 "routed": true,
                 "aliases": [],
-                "tokens": 1168,
+                "tokens": 1169,
                 "sections": [
                     {
                         "id": "model",
@@ -410,7 +410,7 @@
                         "id": "authoring",
                         "title": "Write a Commitment: sources, keys, cadence and budgets",
                         "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                        "tokens": 918,
+                        "tokens": 1088,
                         "aliases": [],
                         "explains": [
                             "COMMITMENT_MODE_RETIRED",
@@ -462,7 +462,7 @@
                         "id": "always-on",
                         "title": "Turn it on: activation and Always-On",
                         "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                        "tokens": 413,
+                        "tokens": 524,
                         "aliases": [],
                         "explains": [
                             "COMMITMENT_ACTIVATION_BLOCKED",
@@ -474,7 +474,7 @@
                         "id": "governance",
                         "title": "Compass and Northstar: what each may change",
                         "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                        "tokens": 399,
+                        "tokens": 455,
                         "aliases": [],
                         "explains": [
                             "COMMITMENT_COMPASS_IMMUTABLE"
@@ -709,8 +709,8 @@
                 ]
             }
         ],
-        "hash": "3581ad4744d3aae5df82a9358ddb6f87e823b4928104006581e16b3a4d821b2e",
-        "tokens": 544
+        "hash": "6d23de37b320e5257e7e2400c36bfc79063c76c2e3984771b96a90727e95980d",
+        "tokens": 545
     },
     "routedIndex": {
         "level": "index",
@@ -1088,10 +1088,10 @@
                 "id": "commitments",
                 "title": "Commitments and acting later",
                 "readWhen": "you make something happen later, repeatedly or continuously, or give an Agent a standing responsibility",
-                "version": 3,
+                "version": 4,
                 "routed": true,
                 "aliases": [],
-                "tokens": 1168,
+                "tokens": 1169,
                 "sections": [
                     {
                         "id": "model",
@@ -1123,7 +1123,7 @@
                         "id": "authoring",
                         "title": "Write a Commitment: sources, keys, cadence and budgets",
                         "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                        "tokens": 918,
+                        "tokens": 1088,
                         "aliases": [],
                         "explains": [
                             "COMMITMENT_MODE_RETIRED",
@@ -1175,7 +1175,7 @@
                         "id": "always-on",
                         "title": "Turn it on: activation and Always-On",
                         "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                        "tokens": 413,
+                        "tokens": 524,
                         "aliases": [],
                         "explains": [
                             "COMMITMENT_ACTIVATION_BLOCKED",
@@ -1187,7 +1187,7 @@
                         "id": "governance",
                         "title": "Compass and Northstar: what each may change",
                         "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                        "tokens": 399,
+                        "tokens": 455,
                         "aliases": [],
                         "explains": [
                             "COMMITMENT_COMPASS_IMMUTABLE"
@@ -1353,8 +1353,8 @@
                 ]
             }
         ],
-        "hash": "2f65b076744f03768c49bce61d58f4ee26354c007316777602a3567f3d71f35d",
-        "tokens": 493
+        "hash": "c7cd104ee736aa524b486eb8858dce17a2de5f69036c7c61795ce5603ce1246e",
+        "tokens": 494
     },
     "cards": {
         "tasks": {
@@ -1743,12 +1743,12 @@
             "id": "commitments",
             "title": "Commitments and acting later",
             "readWhen": "you make something happen later, repeatedly or continuously, or give an Agent a standing responsibility",
-            "version": 3,
+            "version": 4,
             "routed": true,
             "aliases": [],
             "body": "## Concept model\n\n| Noun | Question it answers |\n| --- | --- |\n| **Compass** | What does good look like for this Agent, and what may it never trade away? |\n| **Northstar** | Which Commitments should exist, at what priority and on what budget? |\n| **Commitment** | Which outcome does this Agent keep true, and how does it keep checking? |\n| **Check** | What did one wake of a Commitment see, decide and do? |\n\nA Commitment is not a unit of work. A **Task** is one unit of work and a **Goal** is a dated\noutcome with key results; a Commitment watches both and may create Tasks, and is neither.\n\n## Decide\n\nFive mechanisms make something happen later, and the noun alone does not pick one:\n\n| Mechanism | What it is for | The signal that picks it |\n| --- | --- | --- |\n| **Follow-up** | Coming back to one thing, once or a bounded few times: a reminder, a watch, a check-in, an agreed action | The ask ends: \"look tomorrow\", \"tell me when CI is green\" |\n| **Trigger** | Running the Agent with a set prompt on a schedule, an event, once, or on demand | The person names when, and every run does the same work |\n| **Heartbeat** | Checking in on a conversation, group chat or Space at a frequency that backs off while unread | The person wants regular contact, not an outcome held |\n| **Commitment** | Keeping an outcome true: watched sources, a cadence and a loop that decides when to act | \"Keep X true\", \"watch this metric\": no end, and stale evidence matters |\n| **Workflow** | Running a durable graph of Tasks in order | Repeatable work whose steps depend on each other |\n\nA one-off \"look at it tomorrow\" is a follow-up, never a Commitment. Standing observation is a\nCommitment with a freshness contract, not a recurring trigger or a task board left running.\n\n## Workflow\n\n### Start a Commitment\n\n1. Read the Agent's Commitments first, and change one rather than add a near-duplicate.\n2. Create it and turn it on in one call: the outcome, what it watches, how often it checks, where\n   its work goes. Turning it on runs Preflight; a refusal keeps the draft and reports the code,\n   reason and fix.\n3. Leave it a draft only when the person asked to see it first.\n4. Read it back, and tell the person what it watches, how often, and whether it is on.\n\n## Authority\n\n| Actor | May do | Only a person may do |\n| --- | --- | --- |\n| Agent | Read the Commitments of an Agent it can view; create one, change it and turn it on; request a check; pause one; decide whether a finding is worth telling the owner | Lift a stop a person made; set or clear a concurrency limit; choose the Task review policy; approve an action proposal or a cadence change; configure a Northstar's governance or decide its intents |\n| Person | Everything in both columns | — |\n\nA Commitment grants no permission: its runs work under the Agent's own. A Check never writes an\nowner-facing message, and a Compass never creates, rewrites, pauses or archives a Commitment. The\nserver cannot always tell an Agent from the person whose login it holds, so an accepted call is\nnot permission: the right-hand column stays a person's.\n\n## Live state\n\n- `skrr commitments list --agent <agent-id>` — an Agent's Commitments, with status and assessment.\n- `skrr commitments show <commitment-id>` — the contract, its next check and the last one.\n- `skrr commitments roster --agent <agent-id>` — each loop: whether it is armed, its next wake, runs today.\n\n## Related guides\n\n- `tasks` — the Tasks a Commitment creates or watches.\n- `spaces` — Goals, and Workflows: durable graphs of Tasks.\n- `agents` — the Agent a Commitment belongs to, and where its runs execute.\n- `communication` — whether, what and how to tell the owner.",
-            "hash": "4e2368a7dfc2796743cf92cbc05a7446f343423a299a0e21769ee651b8b8143c",
-            "tokens": 1168,
+            "hash": "8a5ab2048ea5a6edacd881d4403a3481798876b4529f8a070d4953eebebd075f",
+            "tokens": 1169,
             "sections": [
                 {
                     "id": "model",
@@ -1780,7 +1780,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -1832,7 +1832,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -1844,7 +1844,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"
@@ -5769,7 +5769,7 @@
             "section": "model",
             "title": "Compass, Northstar, Commitment and the check loop",
             "readWhen": "you must tell a Commitment from a Goal, Task, Compass or Northstar, or read what its loop reports",
-            "version": 3,
+            "version": 4,
             "aliases": [],
             "explains": [],
             "body": "Read this when you must tell a Commitment from a Goal, Task, Compass or Northstar, or read what its loop reports.\n\n## Three layers\n\n| Layer | Answers | Changes |\n| --- | --- | --- |\n| **Compass** | What good looks like for this Agent: the states it keeps true, and its autonomy and communication defaults | Rarely, deliberately |\n| **Northstar** | Which Commitments should exist, their priority and their budget | On a review cadence |\n| **Commitment** | One outcome held true by its own check loop | Continuously |\n\nA **Goal** is a dated outcome with key results, and a **Task** is one unit of work. A Commitment\nmay watch a Goal and its Tasks as sources and may create Tasks; it is neither of them.\n\n## The loop\n\n- A **Check** wakes on the cadence or on a watched event. It reads the watched sources, compares\n  them with the last snapshot, finds open loops (blocked, stale, waiting on someone, overdue),\n  chooses a posture and routes actions. Most checks end quiet, by design.\n- **Reflection** is slower: it measures whether the checks earn their keep and retunes the cadence.\n- Its assessment answers three things separately: the outcome, how fresh the evidence is, and\n  how the work is going. A finished run, a patch or a merged PR does not by itself prove the\n  outcome, and evidence goes stale.\n\n## Vocabulary\n\n- Kind, fixed when the Commitment is created:\n  - `achieve`: a bounded outcome, which may carry a deadline and completes when it is met.\n  - `maintain`: a state held true for as long as the Commitment runs; it never completes.\n- Status: `draft`, `active`, `paused`, `completed`, `cancelled`, `archived`.\n- A Check's posture: `stay_quiet`, `record_only`, `act_silently`, `ask_approval`, `nudge_user`, `escalate`.\n\nA `draft` does nothing until it is turned on; `paused` stops new work, and a turn already running\nmay finish.",
@@ -5806,7 +5806,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -5858,7 +5858,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -5870,7 +5870,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"
@@ -5885,7 +5885,7 @@
             "section": "later",
             "title": "Choose how to act later",
             "readWhen": "you must choose how to make something happen later, repeatedly or continuously",
-            "version": 3,
+            "version": 4,
             "aliases": [],
             "explains": [],
             "body": "Read this when you must choose how to make something happen later, repeatedly or continuously.\n\n## Choose by the ask\n\n- **It ends.** \"Look tomorrow\", \"tell me when the review lands\", \"remind me on Friday\": a\n  follow-up. A loop that outlives the ask is the wrong record, however useful it seems.\n- **It repeats on a clock the person named, with the same work each time.** \"Every weekday at 9,\n  brief me\": a trigger.\n- **It is contact, not an outcome.** \"Check in with me daily\": a heartbeat, which backs off while\n  its messages go unread.\n- **It must stay true.** \"Keep our deploy failure rate low\", \"watch this metric\": a Commitment. It\n  needs sources it can read and a cadence, and its loop decides when anything is worth doing.\n- **It is several steps in order.** A Workflow: a graph of Tasks in a Space.\n\nWho asked matters as much as when. A reminder keeps the person's words. A check-in you decided on\nis arranged by you, without asking whether you should.\n\n## Arrange it\n\n| Mechanism | Command |\n| --- | --- |\n| Follow-up | `skrr followups remind`, `skrr followups watch`, `skrr followups checkin` or `skrr followups act` |\n| Trigger | `skrr triggers create` |\n| Heartbeat | `skrr spaces heartbeats create`, for a Space; no command sets up a personal one |\n| Commitment | `skrr commitments create`, which makes a draft |\n| Workflow | `skrr spaces workflows create` |\n\n## Example\n\n\"CI on main has been flaky all week. Look at it tomorrow morning and tell me whether it's still\nred.\" The ask ends tomorrow, so it is a watch follow-up: one look at a set time that reports back.\n\n```bash\nskrr followups watch --subject ci:main --why \"Owner asked whether CI on main is still red\" \\\n  --check \"Read the latest CI run on main\" --success \"The latest run on main passed\" \\\n  --abort \"No CI run on main within two days\" --wait clock --wait-at <tomorrow-09:00-with-offset>\n```\n\nWhen it wakes, report either answer to the owner and settle it with `skrr followups resolve`.",
@@ -5922,7 +5922,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -5974,7 +5974,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -5986,7 +5986,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"
@@ -6001,7 +6001,7 @@
             "section": "followups",
             "title": "Follow-ups",
             "readWhen": "you want to come back to something later: a reminder, a watch, a check-in or an action",
-            "version": 3,
+            "version": 4,
             "aliases": [
                 "tasks/followups"
             ],
@@ -6040,7 +6040,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -6092,7 +6092,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -6104,7 +6104,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"
@@ -6119,7 +6119,7 @@
             "section": "authoring",
             "title": "Write a Commitment: sources, keys, cadence and budgets",
             "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-            "version": 3,
+            "version": 4,
             "aliases": [],
             "explains": [
                 "COMMITMENT_MODE_RETIRED",
@@ -6128,9 +6128,9 @@
                 "COMMITMENT_CONCURRENCY_REQUIRES_OWNER_DECISION",
                 "COMMITMENT_TASK_REVIEW_POLICY_OWNER_REQUIRED"
             ],
-            "body": "Read this when you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend.\n\nA Commitment starts as a draft; create and turn it on in one call unless the person asked to\nreview it first. Activation runs Preflight — a refusal keeps the draft and reports the code,\nreason and fix. An active contract spends compute on every check, so make it say exactly what\nwill be watched.\n\n- **Outcome and criteria**: the state to hold true, and how you will know it holds.\n- **Watched sources**: what each check reads. A source the platform reads itself (Tasks, a Goal,\n  GitHub, metric snapshots it records) needs only its name and scope. A value only a run can read,\n  such as a dashboard or an outside CI rate, is an `agent_run` key you declare.\n- **Declared keys**: the operator declares the keys, and the agent fills them. A run may report any\n  key, but only a declared one can move the loop, and only as its `changeRule` says: `any` change,\n  or `numeric_delta` with `minDelta`, `minRatio`, `direction` and `absoluteFloor`.\n- **Cadence**: `interval` (`1m` to `365d`), `daily` at `HH:MM` times in a timezone,\n  `event_plus_interval` (watched events plus a timed backstop), or `manual`.\n- **Delivery**: where its work goes. `report_only` reports and changes nothing.\n- **Budgets**: `policy.executionBudget` caps runs, sensing runs and cost per day. `0` blocks; `null`\n  is no limit.\n\n## Example\n\nA daily, report-only watch on a deploy failure rate:\n\nSave this as `commitment.json`:\n\n```json\n{\n  \"agentId\": \"<agent-id>\",\n  \"title\": \"Deploy failure rate\",\n  \"status\": \"draft\",\n  \"target\": { \"outcome\": \"A rise in the deploy failure rate is reported the day it happens\" },\n  \"cadence\": { \"mode\": \"daily\", \"times\": [\"09:00\"], \"timezone\": \"America/New_York\" },\n  \"delivery\": { \"mode\": \"report_only\" },\n  \"watchedSources\": [{\n    \"source\": \"agent_run\",\n    \"config\": { \"keys\": [{\n      \"key\": \"deploys.failure_rate_7d\",\n      \"label\": \"Deploy failure rate, last 7 days\",\n      \"changeRule\": { \"mode\": \"numeric_delta\", \"minDelta\": 0.02, \"direction\": \"up\" }\n    }] }\n  }],\n  \"policy\": { \"executionBudget\": { \"maxRunsPerDay\": 2, \"maxObservationRunsPerDay\": 2 } }\n}\n```\n\n```bash\nskrr commitments create --from-json commitment.json --activate --json\n```\n\n`create` prints a `Warning:` for anything the body leaves inert, such as an `agent_run` source\nwith no keys. `--activate` turns it on in the same call: it runs Preflight, and a refusal keeps\nthe draft and reports it, such as Always-On being off for the Agent. Drop `--activate` only when\nthe person asked to review it first; `skrr commitments resume` turns a draft on later, and\n`skrr commitments update` changes it.\n\n## Refusals\n\n| Code | Cause | Fix |\n| --- | --- | --- |\n| `COMMITMENT_MODE_RETIRED` | The body carries `mode`; Commitment modes are retired. | Leave it out: runs work under the Agent's own permissions. |\n| `COMMITMENT_POLICY_RETIRED` | The body carries a retired permission-tier policy field. | Remove the field the refusal names. |\n| `COMMITMENT_DELIVERY_REQUIRED` | A coding Commitment names no delivery. | Choose where its work goes. |\n| `COMMITMENT_CONCURRENCY_REQUIRES_OWNER_DECISION` | An Agent set or cleared a finite concurrency limit. | Recommend the limit; the person sets it. |\n| `COMMITMENT_TASK_REVIEW_POLICY_OWNER_REQUIRED` | Only the owner chooses the Task review policy. | Leave it out and ask the owner. |",
-            "hash": "141c4a587c433eaaab613d648ffde518624638e0f23a26d530de7c6d7b77cb84",
-            "tokens": 918,
+            "body": "Read this when you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend.\n\nA Commitment starts as a draft; create and turn it on in one call unless the person asked to\nreview it first. Activation runs Preflight — a refusal keeps the draft and reports the code,\nreason and fix. An active contract spends compute on every check, so make it say exactly what\nwill be watched.\n\n- **Outcome and criteria**: the state to hold true, and how you will know it holds.\n- **Watched sources**: what each check reads. A source the platform reads itself (Tasks, a Goal,\n  GitHub, metric snapshots it records) needs only its name and scope. A value only a run can read,\n  such as a dashboard or an outside CI rate, is an `agent_run` key you declare.\n- **Declared keys**: the operator declares the keys, and the agent fills them. A run may report any\n  key, but only a declared one can move the loop, and only as its `changeRule` says: `any` change,\n  or `numeric_delta` with `minDelta`, `minRatio`, `direction` and `absoluteFloor`.\n- **Cadence**: `interval` (`1m` to `365d`), `daily` at `HH:MM` times in a timezone,\n  `event_plus_interval` (watched events plus a timed backstop), or `manual`.\n- **Delivery**: where its work goes. `report_only` reports and changes nothing.\n- **Budgets**: `policy.executionBudget` caps runs, sensing runs and cost per day. `0` blocks; `null`\n  is no limit.\n- **Event sources**: `policy.executionBudget.allowedEventSources` limits which sources may wake it.\n  An empty or missing list allows every source; name sources to restrict it.\n- **Interruptions**: `policy.maxUserNudgesPerDay` caps messages to the person: `0` mutes, `null` is\n  no limit. `minUserNudgeIntervalMs` is the least gap between two.\n- **Quiet hours**: `policy.quietHours` is `{enabled, start, end, timezone}`. Times are 24-hour\n  `HH:MM`; `enabled: true` needs both, and they must differ. A window may cross midnight, and `end`\n  is outside it. `timezone` is an IANA name; omitted means UTC, not the person's zone.\n\n## Example\n\nA daily, report-only watch on a deploy failure rate:\n\nSave this as `commitment.json`:\n\n```json\n{\n  \"agentId\": \"<agent-id>\",\n  \"title\": \"Deploy failure rate\",\n  \"status\": \"draft\",\n  \"target\": { \"outcome\": \"A rise in the deploy failure rate is reported the day it happens\" },\n  \"cadence\": { \"mode\": \"daily\", \"times\": [\"09:00\"], \"timezone\": \"America/New_York\" },\n  \"delivery\": { \"mode\": \"report_only\" },\n  \"watchedSources\": [{\n    \"source\": \"agent_run\",\n    \"config\": { \"keys\": [{\n      \"key\": \"deploys.failure_rate_7d\",\n      \"label\": \"Deploy failure rate, last 7 days\",\n      \"changeRule\": { \"mode\": \"numeric_delta\", \"minDelta\": 0.02, \"direction\": \"up\" }\n    }] }\n  }],\n  \"policy\": { \"executionBudget\": { \"maxRunsPerDay\": 2, \"maxObservationRunsPerDay\": 2 } }\n}\n```\n\n```bash\nskrr commitments create --from-json commitment.json --activate --json\n```\n\n`create` prints a `Warning:` for anything the body leaves inert, such as an `agent_run` source\nwith no keys. `--activate` turns it on in the same call: it runs Preflight, and a refusal keeps\nthe draft and reports it, such as Always-On being off for the Agent. Drop `--activate` only when\nthe person asked to review it first; `skrr commitments resume` turns a draft on later, and\n`skrr commitments update` changes it.\n\n## Refusals\n\n| Code | Cause | Fix |\n| --- | --- | --- |\n| `COMMITMENT_MODE_RETIRED` | The body carries `mode`; Commitment modes are retired. | Leave it out: runs work under the Agent's own permissions. |\n| `COMMITMENT_POLICY_RETIRED` | The body carries a retired permission-tier policy field. | Remove the field the refusal names. |\n| `COMMITMENT_DELIVERY_REQUIRED` | A coding Commitment names no delivery. | Choose where its work goes. |\n| `COMMITMENT_CONCURRENCY_REQUIRES_OWNER_DECISION` | An Agent set or cleared a finite concurrency limit. | Recommend the limit; the person sets it. |\n| `COMMITMENT_TASK_REVIEW_POLICY_OWNER_REQUIRED` | Only the owner chooses the Task review policy. | Leave it out and ask the owner. |",
+            "hash": "c662fe976cd9555acee832566b6e321d807461522d521dca3bfc0f9d336b34d7",
+            "tokens": 1088,
             "sections": [
                 {
                     "id": "model",
@@ -6162,7 +6162,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -6214,7 +6214,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -6226,7 +6226,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"
@@ -6241,7 +6241,7 @@
             "section": "sensing",
             "title": "Readings a run reports",
             "readWhen": "you read what a Commitment's runs reported seeing, or report a reading from a run",
-            "version": 3,
+            "version": 4,
             "aliases": [],
             "explains": [],
             "body": "Read this when you read what a Commitment's runs reported seeing, or report a reading from a run.\n\nA run is a sensor: it can read what the platform cannot, such as a dashboard or a vendor's console.\nThe run reports what it saw, and the server decides whether that is a change.\n\n- Every reading is stored as \"AGENT-REPORTED, not platform-verified\", and that caveat travels inside its text.\n- Its confidence is capped at 0.5, or 0.7 when it carries an artifact with a\n  real content digest (`sha256:…`). It is never 1.\n\n## Report a reading\n\n- Report the reading, not a judgement about it: one entry per declared key you read. A key you\n  invent is recorded and drives nothing.\n- If you could not read a key, say so with `accessStatus` `unavailable` or `unauthorized` and no\n  value. \"I could not see\" is not \"it is fine\", so never carry the previous reading forward.\n- Where a key requires an artifact, attach what you actually kept (a screenshot, a file, a log)\n  with a real digest; without it the reading is kept as evidence and cannot move the Commitment.\n\n## Read them\n\nThe `changed` beside a reading is the server's verdict, from the key's `changeRule`. Treat every\nreading as a claim by the actor whose work is being judged, your own included.\n\n```bash\nskrr commitments observations <commitment-id> --declared-only\nskrr commitments observations <commitment-id> --latest\n```\n\nWithout `--declared-only` the list includes undeclared keys: what a run noticed that nobody asked\nabout is how to decide what to declare next.",
@@ -6278,7 +6278,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -6330,7 +6330,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -6342,7 +6342,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"
@@ -6357,7 +6357,7 @@
             "section": "cycles-explain",
             "title": "Why it stopped: cycles and explain",
             "readWhen": "a Commitment did not do what you expected and you need to know where it stopped",
-            "version": 3,
+            "version": 4,
             "aliases": [],
             "explains": [],
             "body": "Read this when a Commitment did not do what you expected and you need to know where it stopped.\n\nEvery wake is a cycle. A cycle that stopped names the first question it answered \"no\" to, with the\nreason in the platform's own words and, where someone can act, the fix. The questions, in the order\nthey are asked, and what a stop at each means:\n\n- `wake`: \"The wake did not run a check.\"\n- `fresh`: \"There was nothing new to act on.\"\n- `turn`: \"It was not this wake’s turn.\"\n- `think`: \"The check did not start an agent turn.\"\n- `act`: \"The agent turn or its action did not go ahead.\"\n- `reach`: \"The check had something to raise and it did not reach you.\"\n- `error`: \"The check or its run failed.\"\n\nA stop at `fresh`, or at `think` with the gate `no_agent_turn_planned`, is the loop choosing\nsilence, and there is nothing to fix. Every other stop is a gate between an intention and its\neffect. Act on the fix the cycle gives; do not invent another, and do not report a gate as quiet.\n\n```bash\nskrr commitments explain <commitment-id>\nskrr commitments cycles <commitment-id>\nskrr commitments trigger-status <commitment-id>\n```\n\n`explain` walks the latest cycle as six yes or no questions; `cycles` lists them, newest first;\n`trigger-status` shows what the scheduler actually holds, which is usually why one \"isn't\nchecking\". A failed run names who has to move: the machine (sign it in, bring it online) or the\nmodel. Once a machine is fixed, `skrr commitments check-now <commitment-id>` starts a new run; a\nscheduled check would still see nothing new.",
@@ -6394,7 +6394,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -6446,7 +6446,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -6458,7 +6458,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"
@@ -6473,7 +6473,7 @@
             "section": "hypotheses",
             "title": "Hypotheses: claims about why",
             "readWhen": "a run concludes why a reading moved, or you investigate a drift that may already be ruled out",
-            "version": 3,
+            "version": 4,
             "aliases": [],
             "explains": [
                 "missing_falsifier",
@@ -6516,7 +6516,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -6568,7 +6568,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -6580,7 +6580,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"
@@ -6595,7 +6595,7 @@
             "section": "speaking",
             "title": "A Commitment finds; its Agent speaks",
             "readWhen": "a Commitment run found something and you must decide whether the owner hears of it",
-            "version": 3,
+            "version": 4,
             "aliases": [],
             "explains": [],
             "body": "Read this when a Commitment run found something and you must decide whether the owner hears of it.\n\nA Check never writes to the owner. When something it found may matter, the run is handed a brief\nunder \"Owner communication — your call.\": what was found, the evidence, why it may matter and a\nsuggested next step. Those are facts to judge, not a message to forward.\n\n- Decide with everything in view: what you already said, whether the owner replied, what another\n  surface already raised. One message, a different message or nothing are all valid outcomes, and\n  silence is often the right one.\n- To speak from the run, return a `message` or `status_update` action intent with its `text`, or a\n  `report` with its `text` for the Commitment's report destinations. Write the words yourself.\n- The owner's limits (mute, quiet hours, a daily nudge cap) decide whether a run is asked to speak\n  at all, and whatever you deliver counts against them, whichever way you send it.\n\n`skrr commitments reports <commitment-id>` lists where its reports go and on what condition; the\ndefault sends only on a material change.",
@@ -6632,7 +6632,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -6684,7 +6684,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -6696,7 +6696,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"
@@ -6711,16 +6711,16 @@
             "section": "always-on",
             "title": "Turn it on: activation and Always-On",
             "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-            "version": 3,
+            "version": 4,
             "aliases": [],
             "explains": [
                 "COMMITMENT_ACTIVATION_BLOCKED",
                 "COMMITMENT_STOP_NOT_YOURS_TO_LIFT",
                 "COMMITMENT_COMPASS_NOT_ACTIVE"
             ],
-            "body": "Read this when a Commitment must start waking on its own, or has stopped waking.\n\nA Commitment that wakes on a cadence or on events needs its Agent's Always-On: while it is off,\nnothing wakes the Agent and turning the Commitment on is refused. Pausing a Commitment, or turning\nAlways-On off, stops new work; a turn already running may finish, and a cancelled record is not\nproof that a process stopped.\n\n## Turn a Commitment on\n\n1. Read the Agent's Always-On state. A standing responsibility the person asked for covers turning\n   it on for that Commitment; otherwise turn it on only when the owner asked the Agent to work on\n   its own.\n2. Turning it on runs Preflight, and every blocking gate must pass, so look first where you can.\n3. Turn the Commitment on, then read it back: armed, and when it next wakes.\n\n```bash\nskrr agents always-on status <agent-id>\nskrr commitments preflight <commitment-id>\nskrr commitments resume <commitment-id>\nskrr commitments status <commitment-id>\n```\n\n`skrr agents always-on enable <agent-id>` turns Always-On on, and `reconcile` repairs a degraded\none. `skrr commitments pause <commitment-id>` stops new work.\n\n## Refusals\n\n| Code | Cause | Fix |\n| --- | --- | --- |\n| `COMMITMENT_ACTIVATION_BLOCKED` | A blocking Preflight gate did not pass; the refusal names the first. | Fix that gate, then turn it on again. |\n| `COMMITMENT_STOP_NOT_YOURS_TO_LIFT` | A person or the platform stopped it, and an Agent cannot lift that stop. | Ask the person to resume it. |\n| `COMMITMENT_COMPASS_NOT_ACTIVE` | The Compass it is bound to is not active. | Ask the person to activate that Compass first. |",
-            "hash": "f775f7b5681d47f9d2856cf9a9d189a484993123ddbaf658d7159fdcd90591da",
-            "tokens": 413,
+            "body": "Read this when a Commitment must start waking on its own, or has stopped waking.\n\nA Commitment that wakes on a cadence or on events needs its Agent's Always-On: while it is off,\nnothing wakes the Agent and turning the Commitment on is refused. Pausing a Commitment, or turning\nAlways-On off, stops new work; a turn already running may finish, and a cancelled record is not\nproof that a process stopped.\n\n## Turn a Commitment on\n\n1. Read the Agent's Always-On state. A standing responsibility the person asked for covers turning\n   it on for that Commitment; otherwise turn it on only when the owner asked the Agent to work on\n   its own.\n2. Turning it on runs Preflight, and every blocking gate must pass, so look first where you can.\n   More than one can block at once, and Always-On is only the first: a Commitment is bounded work,\n   and the cloud Agent Worker cannot enforce a bounded Commitment's contract, so an Agent that runs\n   there is refused (`runtime_commitment_contract_unavailable`) even with Always-On on. It needs a\n   Hosted Machine or a local harness.\n3. Turn the Commitment on, then read it back: armed, and when it next wakes.\n\n```bash\nskrr agents always-on status <agent-id>\nskrr commitments preflight <commitment-id>\nskrr commitments resume <commitment-id>\nskrr commitments status <commitment-id>\n```\n\n`skrr agents always-on enable <agent-id>` turns Always-On on, and `reconcile` repairs a degraded\none. `skrr agents attach-harness <harness> --agent <agent-id>` moves an Agent off the cloud worker.\n`skrr commitments pause <commitment-id>` stops new work.\n\n## Refusals\n\n| Code | Cause | Fix |\n| --- | --- | --- |\n| `COMMITMENT_ACTIVATION_BLOCKED` | A blocking Preflight gate did not pass; the refusal names the first, and Preflight lists every one. | Fix each gate Preflight lists, then turn it on again. |\n| `COMMITMENT_STOP_NOT_YOURS_TO_LIFT` | A person or the platform stopped it, and an Agent cannot lift that stop. | Ask the person to resume it. |\n| `COMMITMENT_COMPASS_NOT_ACTIVE` | The Compass it is bound to is not active. | Ask the person to activate that Compass first. |",
+            "hash": "d1888e652fc8b76c8bc6ca790250c6cdd3db91089c467fdc4e9831da5fbdfe9d",
+            "tokens": 524,
             "sections": [
                 {
                     "id": "model",
@@ -6752,7 +6752,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -6804,7 +6804,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -6816,7 +6816,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"
@@ -6831,14 +6831,14 @@
             "section": "governance",
             "title": "Compass and Northstar: what each may change",
             "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-            "version": 3,
+            "version": 4,
             "aliases": [],
             "explains": [
                 "COMMITMENT_COMPASS_IMMUTABLE"
             ],
-            "body": "Read this when a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change.\n\n## Compass\n\nA Compass says what good looks like for an Agent: invariant targets, plus autonomy and\ncommunication defaults such as the quiet hours a Commitment without its own inherits. A\nCommitment is bound to one Compass when it is created and reads its current direction on every\ncheck. The binding cannot change afterwards; a different Compass needs a successor Commitment. A\nCompass never creates, rewrites, pauses or archives a Commitment.\n\n## Northstar\n\nA Northstar groups Commitments without owning their loops. Its review rolls their health up,\ngives each a cadence band and a run budget, and proposes typed management intents. Only the\nNorthstar's own router applies an intent, and only as its governance allows: `advisory` records\nthem, `approval` waits for a person on each, and `bounded_auto` applies a narrow set. Resuming,\ncreating or reassigning a Commitment, and any change that buys compute, always wait for a person.\nArchiving a Northstar detaches its Commitments, and they keep running.\n\nYou may read both and propose; configuring governance and deciding intents are a person's.\n\n```bash\nskrr compass list --agent <agent-id>\nskrr compass trace <compass-id> --agent <agent-id>\nskrr northstars show <northstar-id>\nskrr northstars intents list <northstar-id>\n```\n\n`compass trace` shows which Commitment checks used each version of a Compass.\n\n## Refusals\n\n| Code | Cause | Fix |\n| --- | --- | --- |\n| `COMMITMENT_COMPASS_IMMUTABLE` | An update tried to change the Compass a Commitment is bound to. | Create a successor Commitment bound to the other Compass. |",
-            "hash": "e1c27473f864764930c9337a27cfcb3280195d9a1e349085f65708fc022d37e2",
-            "tokens": 399,
+            "body": "Read this when a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change.\n\n## Compass\n\nA Compass says what good looks like for an Agent: invariant targets, plus autonomy and\ncommunication defaults such as the quiet hours a Commitment without its own inherits. A\nCommitment is bound to one Compass when it is created and reads its current direction on every\ncheck. The binding cannot change afterwards; a different Compass needs a successor Commitment. A\nCompass never creates, rewrites, pauses or archives a Commitment.\n\n## Northstar\n\nA Northstar groups Commitments without owning their loops. Its review rolls their health up,\ngives each a cadence band and a run budget, and proposes typed management intents. Only the\nNorthstar's own router applies an intent, and only as its governance allows: `advisory` records\nthem, `approval` waits for a person on each, and `bounded_auto` applies a narrow set. Resuming,\ncreating or reassigning a Commitment, and any change that buys compute, always wait for a person.\nArchiving a Northstar detaches its Commitments, and they keep running.\n\nYou may read both and propose; configuring governance and deciding intents are a person's.\n\n```bash\nskrr compass list --agent <agent-id>\nskrr compass trace <compass-id> --agent <agent-id>\nskrr northstars show <northstar-id>\nskrr northstars intents list <northstar-id>\n```\n\n`compass trace` shows which Commitment checks used each version of a Compass. To bind a\nCommitment to one, set `compassId` in the `--from-json` body of `skrr commitments create`; there\nis no flag, and `skrr compass commitments <compass-id> --agent <agent-id>` lists it once bound.\n\n## Refusals\n\n| Code | Cause | Fix |\n| --- | --- | --- |\n| `COMMITMENT_COMPASS_IMMUTABLE` | An update tried to change the Compass a Commitment is bound to. | Create a successor Commitment bound to the other Compass. |",
+            "hash": "e3ca9a955d02c043b5856eb652e2eb382835ddda6c6932d08f8d80a88149400b",
+            "tokens": 455,
             "sections": [
                 {
                     "id": "model",
@@ -6870,7 +6870,7 @@
                     "id": "authoring",
                     "title": "Write a Commitment: sources, keys, cadence and budgets",
                     "readWhen": "you draft or change a Commitment's contract: what it watches, how often, where its work goes, what it may spend",
-                    "tokens": 918,
+                    "tokens": 1088,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_MODE_RETIRED",
@@ -6922,7 +6922,7 @@
                     "id": "always-on",
                     "title": "Turn it on: activation and Always-On",
                     "readWhen": "a Commitment must start waking on its own, or has stopped waking",
-                    "tokens": 413,
+                    "tokens": 524,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_ACTIVATION_BLOCKED",
@@ -6934,7 +6934,7 @@
                     "id": "governance",
                     "title": "Compass and Northstar: what each may change",
                     "readWhen": "a Commitment is bound to a Compass or belongs to a Northstar, and you must know what either may change",
-                    "tokens": 399,
+                    "tokens": 455,
                     "aliases": [],
                     "explains": [
                         "COMMITMENT_COMPASS_IMMUTABLE"

package/dist/lib/agentic-stream.d.ts

@@ -47,6 +47,14 @@ export type AgenticStreamResult = {
      * (OSK-13543). Absent on every ordinary run.
      */
     repaired?: true;
+    /**
+     * Tool calls refused because nobody could be asked and the run was not started with
+     * `--approve-tools`, as the same one-line description the streamed `[permission]` line uses.
+     * A quiet run discards the rendering, so without this a `--no-stream --json` turn read as a
+     * completed turn that did nothing, beside an agent telling the person to resend from another
+     * surface (which a CLI cannot offer). Absent when nothing was refused.
+     */
+    permissionDenials?: string[];
     lastEvent?: AgenticStreamEvent;
 };
 /**
@@ -605,6 +613,7 @@ export declare class AgenticStreamClient {
     private readonly openQuestionPrompts;
     /** Text already written to the terminal, for suffix-only rendering. */
     private renderedText;
+    private permissionDenials;
     /** The "still waiting" line for a terminal run with no output yet (OSK-20427). */
     private waitingTimer;
     private waitingStartedAt;

package/dist/lib/agentic-stream.js

@@ -855,6 +855,7 @@ class AgenticStreamClient {
     openQuestionPrompts = new Map();
     /** Text already written to the terminal, for suffix-only rendering. */
     renderedText = '';
+    permissionDenials = [];
     /** The "still waiting" line for a terminal run with no output yet (OSK-20427). */
     waitingTimer = null;
     waitingStartedAt = 0;
@@ -2213,6 +2214,18 @@ class AgenticStreamClient {
             output.write(`\n[application permission] ${String(event.message)}\n`);
             return;
         }
+        if (event.type === 'permission.denied' && event.reason === 'noninteractive_or_not_enabled') {
+            const described = describePermission(event);
+            // The stream asks and is refused twice for one call (observed: both appear, identical), and
+            // the result should name a refused call once.
+            if (!this.permissionDenials.includes(described))
+                this.permissionDenials.push(described);
+            // A quiet run withholds the answer's rendering, not a refusal: say it on stderr, as the
+            // handover and browser-permission lines above do, so stdout stays the final result.
+            if (this.options.quiet && !this.options.jsonl) {
+                (this.options.statusOutput ?? process.stderr).write(`\n[permission] ${described} denied: nobody could be asked, and this run was not started with --approve-tools\n`);
+            }
+        }
         // Accumulation and `onEvent` still run — only the incremental rendering is
         // suppressed, so a quiet run is the same turn with a different display.
         if (this.options.quiet)
@@ -2522,6 +2535,7 @@ class AgenticStreamClient {
             text: this.accumulated,
             status,
             ...(status === 'completed' && event.repaired === true ? { repaired: true } : {}),
+            ...(this.permissionDenials.length ? { permissionDenials: [...this.permissionDenials] } : {}),
             lastEvent: event,
         };
         this.resolve(this.terminalResult);