@skrr-ai/cli 0.1.127 → 0.1.129

package/dist/base-command.d.ts

@@ -1,5 +1,6 @@
 import { Command, Flags, type Interfaces } from '@oclif/core';
 import { type CliOperationOptions } from './lib/json-output';
+import { type CompassRefusalContext } from './lib/compass-refusals';
 export { resolveProfileFromArgv } from './lib/keychain';
 import { dataService } from '@skrr-ai/data-provider';
 import { type WriteTarget } from './lib/write-target';
@@ -413,6 +414,12 @@ export declare abstract class BaseCommand extends Command {
      * path the person never typed. See `lib/request-field-flags.ts`.
      */
     protected requestFieldFlags?: Readonly<Record<string, string>>;
+    /**
+     * The Compass (and Agent) this invocation is about, set by a `compass` command before it sends.
+     * A stale version or a missing revision is answered with the command to run next, and that
+     * command names these. Unset, the hint carries placeholders. See `lib/compass-refusals.ts`.
+     */
+    protected compassRef?: CompassRefusalContext;
     protected handleApiError(err: unknown, { subject }?: {
         subject?: string;
     }): never;
@@ -515,6 +522,22 @@ export declare function apiRefusal(err: unknown): {
     /** The parsed JSON body, for a refusal that carries structured context. */
     body?: Record<string, unknown>;
 };
+/**
+ * The remedy a refused Commitment activation carries.
+ *
+ * The refusal's message names the blocking Preflight gate by its QUESTION and a reason token
+ * ("Can the runtime enforce this Run? (runtime_commitment_contract_unavailable)"). The gate's own
+ * `hint` — the sentence that says what to run — travels beside it at
+ * `diagnostic.firstBlocker.detail`, and the web client already shows it
+ * (`activationFailureMessage`). The CLI dropped it, so `commitments resume` and
+ * `commitments create --activate` told a person to "fix the gate the reason names" while
+ * `commitments preflight` knew the exact command (OSK-21126).
+ *
+ * Undefined when the gate offered none, so a caller keeps its generic wording.
+ *
+ * Exported for tests.
+ */
+export declare function commitmentActivationHint(body: Record<string, unknown> | null | undefined): string | undefined;
 /**
  * Prefix a failure message with the resource it is about.
  *
@@ -557,6 +580,18 @@ export declare function describeHarnessUnavailable(body: Record<string, unknown>
  * Exported for tests.
  */
 export declare function describeGitHubUnavailable(): string;
+/**
+ * Frame a typed `TASK_LIST_TIMEOUT` failure as what it is — a list too broad for the database's
+ * time limit — rather than a control-plane outage.
+ *
+ * `GET /api/tasks` answers 503 with this code when its one aggregate is cut off at `maxTimeMS`,
+ * which an unscoped list over every accessible Space reaches because no index serves its sort
+ * across the access filter. Lead with the server's `cause`/`remedy`, falling back to the CLI's
+ * own sentence: the 5xx redaction boundary generalizes a bare message in production.
+ *
+ * Exported for tests.
+ */
+export declare function describeTaskListTimeout(body: Record<string, unknown> | null, bin?: string): string;
 /**
  * Frame a typed `LABEL_SUGGESTION_UNAVAILABLE` failure as what it is — the
  * suggestion's hosted-inference call found no billing payer — rather than a

package/dist/base-command.js

@@ -5,9 +5,11 @@ exports.assigneePayloadNeedsResolution = assigneePayloadNeedsResolution;
 exports.parseGlobalFlags = parseGlobalFlags;
 exports.refusalCodeOf = refusalCodeOf;
 exports.apiRefusal = apiRefusal;
+exports.commitmentActivationHint = commitmentActivationHint;
 exports.withSubject = withSubject;
 exports.describeHarnessUnavailable = describeHarnessUnavailable;
 exports.describeGitHubUnavailable = describeGitHubUnavailable;
+exports.describeTaskListTimeout = describeTaskListTimeout;
 exports.describeLabelSuggestionUnavailable = describeLabelSuggestionUnavailable;
 exports.describeGitHubAppNotConfigured = describeGitHubAppNotConfigured;
 exports.describeResourceNotFound = describeResourceNotFound;
@@ -34,6 +36,7 @@ const failed_lookup_1 = require("./lib/failed-lookup");
 const internal_id_1 = require("./lib/internal-id");
 const http_error_1 = require("./lib/http-error");
 const api_error_reason_1 = require("./lib/api-error-reason");
+const compass_refusals_1 = require("./lib/compass-refusals");
 const guide_pointer_1 = require("./lib/guide-pointer");
 // Re-exported from its home in `lib/keychain`, beside the other profile
 // functions. It lived here while `init()` was its only caller; a lib module
@@ -1467,6 +1470,12 @@ class BaseCommand extends core_1.Command {
      * path the person never typed. See `lib/request-field-flags.ts`.
      */
     requestFieldFlags;
+    /**
+     * The Compass (and Agent) this invocation is about, set by a `compass` command before it sends.
+     * A stale version or a missing revision is answered with the command to run next, and that
+     * command names these. Unset, the hint carries placeholders. See `lib/compass-refusals.ts`.
+     */
+    compassRef;
     handleApiError(err, { subject } = {}) {
         // An error this command already raised for the user is not an API failure
         // to translate. `this.error()` throws a CLIError carrying `oclif.exit`, and
@@ -1565,6 +1574,20 @@ class BaseCommand extends core_1.Command {
                     details: envelopeDetails(body),
                 });
             }
+            else if (bodyCode === 'TASK_LIST_TIMEOUT') {
+                // The list was too broad for the database's time limit — a 503 the API sent on purpose,
+                // with the narrower question to ask. The outage branch below would say skrr is down,
+                // record an incident, and tell an agent to retry the very query that cannot finish
+                // (OSK-21284).
+                this.failWithCliError({
+                    message: say(describeTaskListTimeout(body, this.config.bin)),
+                    code: bodyCode,
+                    status: e.status,
+                    exit: 1,
+                    retryable: false,
+                    details: envelopeDetails(body),
+                });
+            }
             else if (bodyCode === 'LABEL_SUGGESTION_UNAVAILABLE') {
                 // The label-suggestion route found no inference payer — a per-call
                 // condition the API deliberately reported, not a platform outage,
@@ -1579,6 +1602,36 @@ class BaseCommand extends core_1.Command {
                     details: envelopeDetails(body),
                 });
             }
+            else if ((bodyCode === COMMITMENT_ACTIVATION_BLOCKED ||
+                stringProp(body, 'error') === COMMITMENT_ACTIVATION_BLOCKED) &&
+                commitmentActivationHint(body)) {
+                // The route puts the code in `error`, in upper case, which `refusalCodeOf` does not read
+                // as a code — so this refusal arrived as `HTTP_409` with the gate's QUESTION as its only
+                // explanation. Name the code, and say what to do (OSK-21126).
+                this.failWithCliError({
+                    message: say(`${bodyMessage || e.message}\n  → ${commitmentActivationHint(body)}`),
+                    code: COMMITMENT_ACTIVATION_BLOCKED,
+                    status: e.status,
+                    exit: 1,
+                    retryable: false,
+                    details: envelopeDetails(body),
+                });
+            }
+            else if ((e.status === 409 || e.status === 404) && (0, compass_refusals_1.compassRefusalCode)(body)) {
+                // The Compass routes sent the code in upper-case `error`, which `refusalCodeOf` does not
+                // read as a code, so a stale writer saw `HTTP_409` and a mistyped version `NOT_FOUND`,
+                // both without the versions that say what to do (OSK-21162, OSK-21152). Read these two
+                // codes by name here rather than widening `refusalCodeOf` for every route.
+                const compassCode = (0, compass_refusals_1.compassRefusalCode)(body);
+                this.failWithCliError({
+                    message: say((0, compass_refusals_1.describeCompassRefusal)(compassCode, body, this.compassRef ?? {}, this.config.bin)),
+                    code: compassCode,
+                    status: e.status,
+                    exit: compassCode === compass_refusals_1.COMPASS_REVISION_NOT_FOUND ? 4 : 1,
+                    retryable: false,
+                    details: envelopeDetails(body),
+                });
+            }
             else if (bodyCode === 'ASSIGNEE_NOT_IN_SPACE') {
                 // Code-specific enrichment takes precedence over the status heuristic:
                 // the server rejects a non-member assignee by id with no next step, so
@@ -2254,6 +2307,40 @@ function apiRefusal(err) {
         ...(body ? { body } : {}),
     };
 }
+/** The typed code the server refuses a Commitment activation with. */
+const COMMITMENT_ACTIVATION_BLOCKED = 'COMMITMENT_ACTIVATION_BLOCKED';
+/**
+ * The remedy a refused Commitment activation carries.
+ *
+ * The refusal's message names the blocking Preflight gate by its QUESTION and a reason token
+ * ("Can the runtime enforce this Run? (runtime_commitment_contract_unavailable)"). The gate's own
+ * `hint` — the sentence that says what to run — travels beside it at
+ * `diagnostic.firstBlocker.detail`, and the web client already shows it
+ * (`activationFailureMessage`). The CLI dropped it, so `commitments resume` and
+ * `commitments create --activate` told a person to "fix the gate the reason names" while
+ * `commitments preflight` knew the exact command (OSK-21126).
+ *
+ * Undefined when the gate offered none, so a caller keeps its generic wording.
+ *
+ * Exported for tests.
+ */
+function commitmentActivationHint(body) {
+    const diagnostic = body?.diagnostic;
+    if (!diagnostic || typeof diagnostic !== 'object')
+        return undefined;
+    const blocker = diagnostic.firstBlocker;
+    if (!blocker || typeof blocker !== 'object')
+        return undefined;
+    const detail = blocker.detail;
+    if (!detail || typeof detail !== 'object')
+        return undefined;
+    const { hint, note } = detail;
+    for (const candidate of [hint, note]) {
+        if (typeof candidate === 'string' && candidate.trim())
+            return candidate.trim();
+    }
+    return undefined;
+}
 /**
  * Prefix a failure message with the resource it is about.
  *
@@ -2316,6 +2403,26 @@ function describeGitHubUnavailable() {
     return ('GitHub is temporarily unreachable, so this request could not be completed. ' +
         'skrr itself answered, so this is not a skrr outage — try again shortly.');
 }
+/**
+ * Frame a typed `TASK_LIST_TIMEOUT` failure as what it is — a list too broad for the database's
+ * time limit — rather than a control-plane outage.
+ *
+ * `GET /api/tasks` answers 503 with this code when its one aggregate is cut off at `maxTimeMS`,
+ * which an unscoped list over every accessible Space reaches because no index serves its sort
+ * across the access filter. Lead with the server's `cause`/`remedy`, falling back to the CLI's
+ * own sentence: the 5xx redaction boundary generalizes a bare message in production.
+ *
+ * Exported for tests.
+ */
+function describeTaskListTimeout(body, bin = 'skrr') {
+    const cause = stringProp(body, 'cause') ||
+        'The task list took too long: it spans every task you can see across all your workspaces and ' +
+            'Spaces, and the database could not return the newest page within its time limit.';
+    const remedy = stringProp(body, 'remedy') ||
+        `Name where to look: a workspace (\`${bin} workspaces use <workspace-id>\`, or \`--workspace <workspace-id>\`) ` +
+            `or a Space (\`${bin} tasks list --space <space-id>\`).`;
+    return `${cause}\n  → ${remedy}`;
+}
 /**
  * Frame a typed `LABEL_SUGGESTION_UNAVAILABLE` failure as what it is — the
  * suggestion's hosted-inference call found no billing payer — rather than a

package/dist/commands/agenda/trigger/list.d.ts

@@ -12,7 +12,8 @@ import { BaseCommand } from '../../../base-command';
 export declare function isUnconfirmedTurnCapture(trigger: Record<string, unknown>): boolean;
 /**
  * `skrr agenda trigger list <agent-id>` — show all triggers registered for
- * an agent (any kind, not just agenda-created ones).
+ * an agent (any kind, not just agenda-created ones), including the ones the
+ * platform manages for its Commitments (the daily self-reflection check).
  */
 export default class AgendaTriggerList extends BaseCommand {
     static description: string;

package/dist/commands/agenda/trigger/list.js

@@ -7,6 +7,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
 const format_1 = require("../../../lib/format");
 const triggers_1 = require("../../../lib/triggers");
+const agent_trigger_listing_1 = require("../../../lib/agent-trigger-listing");
 /**
  * A schedule persisted while handling a conversation turn, for which no explicit
  * confirmation was recorded.
@@ -27,10 +28,11 @@ function isUnconfirmedTurnCapture(trigger) {
 }
 /**
  * `skrr agenda trigger list <agent-id>` — show all triggers registered for
- * an agent (any kind, not just agenda-created ones).
+ * an agent (any kind, not just agenda-created ones), including the ones the
+ * platform manages for its Commitments (the daily self-reflection check).
  */
 class AgendaTriggerList extends base_command_1.BaseCommand {
-    static description = 'List every trigger registered against an agent.';
+    static description = "List every trigger registered against an agent, including the ones the platform manages for its Commitments (SOURCE 'system'). A passive agent (--initial-always-on off) still has a daily self-reflection check.";
     static examples = [
         '<%= config.bin %> agenda trigger list <agent-id>',
         '<%= config.bin %> agenda trigger list <agent-id> --unconfirmed',
@@ -55,17 +57,50 @@ class AgendaTriggerList extends base_command_1.BaseCommand {
         catch (err) {
             this.handleApiError(err);
         }
+        const r = response;
+        const listed = r?.data ?? [];
+        // The per-agent route lists `scope: 'agent'` rows only; the Commitment triggers a passive agent still owns
+        // live under `commitment_watcher`. `--unconfirmed` is about turn captures, which are agent-scoped, so it
+        // skips the extra read.
+        let extra = [];
+        let extraUnreadable = null;
+        if (!flags.unconfirmed) {
+            try {
+                const universal = await triggers_1.triggerApi.list((0, triggers_1.withQuery)('/api/triggers', { refEntity: [`agent:${args.agentId}`], limit: 200 }));
+                extra = (0, agent_trigger_listing_1.triggersMissingFromAgentList)(listed, (universal?.triggers ?? []));
+            }
+            catch (err) {
+                extraUnreadable = err instanceof Error ? err.message : String(err);
+            }
+        }
         if (flags.json) {
-            this.printJsonResult((0, list_output_1.listResult)(response));
+            this.printJsonResult((0, list_output_1.listResult)(r && typeof r === 'object'
+                ? {
+                    ...r,
+                    data: [...listed, ...extra],
+                    ...(extraUnreadable
+                        ? {
+                            warnings: [
+                                {
+                                    code: 'system_triggers_unreadable',
+                                    value: extraUnreadable,
+                                    hint: systemTriggersUnreadable(args.agentId, extraUnreadable),
+                                },
+                            ],
+                        }
+                        : {}),
+                }
+                : response));
             return;
         }
-        const r = response;
-        let items = r?.data ?? [];
+        let items = [...listed, ...extra];
         if (flags.unconfirmed) {
             items = items.filter((t) => isUnconfirmedTurnCapture(t));
         }
         if (items.length === 0) {
             this.log(flags.unconfirmed ? 'No unconfirmed turn-captured schedules.' : 'No triggers.');
+            if (extraUnreadable)
+                this.log(systemTriggersUnreadable(args.agentId, extraUnreadable));
             return;
         }
         const rows = items.map((t) => {
@@ -81,7 +116,7 @@ class AgendaTriggerList extends base_command_1.BaseCommand {
                 label: String(t.label ?? '-').slice(0, 40),
                 next: String(next).slice(0, 25),
                 fires: String(fires),
-                source: isUnconfirmedTurnCapture(t) ? 'turn*' : '-',
+                source: (0, agent_trigger_listing_1.sourceLabel)(t, isUnconfirmedTurnCapture(t)),
             };
         });
         (0, format_1.renderTable)(rows, [
@@ -93,6 +128,15 @@ class AgendaTriggerList extends base_command_1.BaseCommand {
             { key: 'fires', header: 'FIRES' },
             { key: 'source', header: 'SOURCE' },
         ], (line) => this.log(line));
+        if (rows.some((row) => row.source.startsWith('system'))) {
+            this.log('');
+            for (const line of (0, agent_trigger_listing_1.systemManagedLegend)(args.agentId, this.config.bin))
+                this.log(line);
+        }
+        if (extraUnreadable) {
+            this.log('');
+            this.log(systemTriggersUnreadable(args.agentId, extraUnreadable));
+        }
         if (rows.some((row) => row.source === 'turn*')) {
             // Deliberately not "the agent scheduled this by itself". The capture layer
             // cannot tell "remind me at 9" from a nudge the agent invented, so the
@@ -105,3 +149,8 @@ class AgendaTriggerList extends base_command_1.BaseCommand {
     }
 }
 exports.default = AgendaTriggerList;
+/** Said, not skipped: a missing read must not look like an agent with no Commitment triggers. */
+function systemTriggersUnreadable(agentId, reason) {
+    return (`Platform-managed (Commitment) triggers could not be read (${reason}); this list may be incomplete. ` +
+        `Try: skrr triggers list --ref-entity agent:${agentId}`);
+}

package/dist/commands/agents/chat.js

@@ -336,6 +336,13 @@ function noStreamJsonPayload(input) {
         // The run first failed as handed over and the machine's reply was then
         // repaired onto the record (OSK-13543).
         ...(result.repaired ? { repaired: true } : {}),
+        // Tool calls refused for want of `--approve-tools`: the turn completed, and these did not run.
+        ...(result.permissionDenials?.length
+            ? {
+                permissionDenials: result.permissionDenials,
+                permissionDenialHint: 'Re-run with --approve-tools to allow these tool calls.',
+            }
+            : {}),
         response: result.text,
         // The model a local harness reported running (OSK-12111). Absent on a
         // cloud turn and on a harness that reports none.

package/dist/commands/agents/create.js

@@ -245,7 +245,9 @@ class AgentsCreate extends base_command_1.BaseCommand {
             description: 'Default working directory for local Harness sessions',
         }),
         'initial-always-on': core_1.Flags.string({
-            description: 'Start autonomous work after creation (default: on). Use off for a passive agent; explicit chat still works. Relationship-loop seeding is configured separately.',
+            description: 'Start autonomous work after creation (default: on). Use off for a passive agent; explicit chat still works. ' +
+                'A passive agent is still seeded with the system-managed daily self-reflection Commitment: `agenda trigger list <agent>` shows its trigger (SOURCE "system", marked "suspended" while the platform holds it for Always-On being off) ' +
+                'and `commitments list --agent <agent> --include-system` finds the Commitment to pause. Relationship-loop seeding is configured separately.',
             options: ['on', 'off'],
         }),
         'no-relationship-loops': core_1.Flags.boolean({

package/dist/commands/browser/persistent-profile.d.ts

@@ -0,0 +1,22 @@
+import { Command } from '@oclif/core';
+/**
+ * Whether browser sessions on THIS computer share one profile that keeps its
+ * logins and cache, instead of a fresh one each.
+ *
+ * The setting lives in the daemon's own config on this computer, so it is
+ * forwarded to the daemon rather than sent to the API: a browser that stays
+ * signed in is the person at the machine's decision, and a request from the
+ * cloud must not be able to make it (the same boundary as `browser
+ * cloud-agents`). The profile is the daemon's own, never the everyday Chrome.
+ */
+export default class BrowserPersistentProfile extends Command {
+    static description: string;
+    static examples: string[];
+    static args: {
+        action: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/browser/persistent-profile.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const browser_1 = require("../browser");
+/**
+ * Whether browser sessions on THIS computer share one profile that keeps its
+ * logins and cache, instead of a fresh one each.
+ *
+ * The setting lives in the daemon's own config on this computer, so it is
+ * forwarded to the daemon rather than sent to the API: a browser that stays
+ * signed in is the person at the machine's decision, and a request from the
+ * cloud must not be able to make it (the same boundary as `browser
+ * cloud-agents`). The profile is the daemon's own, never the everyday Chrome.
+ */
+class BrowserPersistentProfile extends core_1.Command {
+    static description = 'Keep one browser profile (logins, cookies, cache) across browser sessions on this computer (off by default)';
+    static examples = [
+        '<%= config.bin %> browser persistent-profile status',
+        '<%= config.bin %> browser persistent-profile on',
+        '<%= config.bin %> browser persistent-profile off',
+        '<%= config.bin %> browser persistent-profile reset',
+    ];
+    static args = {
+        action: core_1.Args.string({
+            description: 'on, off, status, or reset (sign out of everything and delete the profile)',
+            required: true,
+            options: ['on', 'off', 'status', 'reset'],
+            // Without this oclif reads stdin for a missing positional, so the command
+            // hangs when run from a pipe or a non-tty instead of refusing. Enforced
+            // by ARG_IMPLICIT_STDIN_ENABLED in the command-hygiene audit.
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(BrowserPersistentProfile);
+        await (0, browser_1.forwardBrowserCommand)(this, [
+            'persistent-profile',
+            args.action,
+            ...(flags.json ? ['--json'] : []),
+        ]);
+    }
+}
+exports.default = BrowserPersistentProfile;

package/dist/commands/commitments/action-history.js

@@ -42,8 +42,8 @@ class CommitmentsActionHistory extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         if (flags.json) {
+            // One JSON document and nothing else: has_more / next_cursor are in it.
             this.log(JSON.stringify(response, null, 2));
-            (0, commitments_1.renderListPageHint)(response, (line) => this.log(line));
             return;
         }
         (0, commitment_ledgers_1.renderActionHistory)(response, (line) => this.log(line));

package/dist/commands/commitments/cases.js

@@ -31,11 +31,11 @@ class CommitmentsCases extends base_command_1.BaseCommand {
             this.handleApiError(error);
         }
         if (flags.json) {
+            // One JSON document and nothing else: has_more / next_cursor are in it.
             this.log(JSON.stringify(result, null, 2));
+            return;
         }
-        else {
-            (0, commitments_1.renderCommitmentCases)(result, (line) => this.log(line));
-        }
+        (0, commitments_1.renderCommitmentCases)(result, (line) => this.log(line));
         (0, commitments_1.renderListPageHint)(result, (line) => this.log(line));
     }
 }

package/dist/commands/commitments/check-now.d.ts

@@ -1,6 +1,14 @@
 import { BaseCommand } from '../../base-command';
-/** Render runtime/Always-On blockers returned alongside an accepted Check. */
-export declare function manualCheckBlockerLines(result: Record<string, unknown>): string[];
+/** Render runtime/Always-On blockers returned alongside a Check (accepted, or skipped). */
+export declare function manualCheckBlockerLines(result: Record<string, unknown>, heading?: string): string[];
+/**
+ * Why a Check was not queued, in words, and what to do. The server answers with a reason code
+ * (`commitment_draft`, `commitment_paused`, ...) and the CLI used to print only that, so "Check
+ * skipped / Reason: commitment_draft" gave no hint that the Commitment simply was not turned on
+ * (dogfood df-261031-commitment-authoring, F11). The code stays in parentheses so it can be
+ * searched for and quoted. `null` for a reason this does not know: the caller prints it as it came.
+ */
+export declare function describeNotQueuedReason(reason: unknown, id: string, bin?: string): string | null;
 /**
  * `skrr commitments check-now <id>` — run one control-loop iteration immediately.
  *

package/dist/commands/commitments/check-now.js

@@ -1,18 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.manualCheckBlockerLines = manualCheckBlockerLines;
+exports.describeNotQueuedReason = describeNotQueuedReason;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const web_url_1 = require("../../lib/web-url");
 const commitments_1 = require("../../lib/commitments");
-/** Render runtime/Always-On blockers returned alongside an accepted Check. */
-function manualCheckBlockerLines(result) {
+const ACCEPTED_CHECK_BLOCKER_HEADING = 'Warning: this check can record state, but autonomous agent work is blocked:';
+/** Render runtime/Always-On blockers returned alongside a Check (accepted, or skipped). */
+function manualCheckBlockerLines(result, heading = ACCEPTED_CHECK_BLOCKER_HEADING) {
     const blockers = Array.isArray(result.executionBlockers)
         ? result.executionBlockers
         : [];
     if (!blockers.length)
         return [];
-    const lines = ['Warning: this check can record state, but autonomous agent work is blocked:'];
+    const lines = [heading];
     for (const blocker of blockers) {
         const label = typeof blocker.label === 'string' && blocker.label ? blocker.label : 'Execution';
         const reason = typeof blocker.reason === 'string' && blocker.reason ? ` — ${blocker.reason}` : '';
@@ -23,6 +25,40 @@ function manualCheckBlockerLines(result) {
     }
     return lines;
 }
+/**
+ * Why a Check was not queued, in words, and what to do. The server answers with a reason code
+ * (`commitment_draft`, `commitment_paused`, ...) and the CLI used to print only that, so "Check
+ * skipped / Reason: commitment_draft" gave no hint that the Commitment simply was not turned on
+ * (dogfood df-261031-commitment-authoring, F11). The code stays in parentheses so it can be
+ * searched for and quoted. `null` for a reason this does not know: the caller prints it as it came.
+ */
+function describeNotQueuedReason(reason, id, bin = 'skrr') {
+    if (typeof reason !== 'string' || !reason)
+        return null;
+    const resume = `Turn it on with \`${bin} commitments resume ${id}\`.`;
+    const sentence = (text) => `${text} (${reason})`;
+    switch (reason) {
+        case 'commitment_draft':
+            return sentence(`Nothing was queued: this Commitment is a draft, so it never runs. ${resume}`);
+        case 'commitment_paused':
+            return sentence(`Nothing was queued: this Commitment is paused. ${resume}`);
+        case 'commitment_archived':
+        case 'commitment_completed':
+        case 'commitment_cancelled':
+            return sentence(`Nothing was queued: this Commitment is ${reason.slice('commitment_'.length)}, so it no longer runs.`);
+        case 'commitment_deleted':
+            return sentence('Nothing was queued: this Commitment was deleted.');
+        case 'commitment_check_not_reserved':
+            return sentence('Nothing was queued: the platform did not reserve a new check for it just now. Try again shortly.');
+        case 'reservation_exists':
+            // Two requests at once: one reserves the check, the other meets that reservation.
+            return sentence(`Nothing new was queued: a check for this Commitment is already queued or running. See it with \`${bin} commitments checks ${id}\`.`);
+        case 'queue_unavailable':
+            return sentence('Nothing was queued: the check queue is unavailable right now. Try again shortly.');
+        default:
+            return null;
+    }
+}
 /**
  * `skrr commitments check-now <id>` — run one control-loop iteration immediately.
  *
@@ -60,6 +96,20 @@ class CommitmentsCheckNow extends base_command_1.BaseCommand {
         const status = String(result.status ?? 'unknown');
         const checkId = result.checkId ? String(result.checkId) : null;
         this.log(`Check ${status}${checkId ? ` — ${checkId}` : ''}`);
+        if (status !== 'queued') {
+            const sentence = describeNotQueuedReason(result.reason, args.id, this.config.bin);
+            if (sentence)
+                this.log(sentence);
+            else if (result.reason)
+                this.log(`Reason: ${String(result.reason)}`);
+            // What would stop it from running once it is on, so the fix is not discovered one try at a time.
+            const blockerLines = manualCheckBlockerLines(result, 'When it is on, these will also keep agent work from running:');
+            if (blockerLines.length)
+                this.log('');
+            for (const line of blockerLines)
+                this.log(line);
+            return;
+        }
         if (result.reason)
             this.log(`Reason: ${String(result.reason)}`);
         if (status === 'queued') {

package/dist/commands/commitments/create.d.ts

@@ -20,19 +20,10 @@ export declare function createCadenceFromFlags({ eventDriven, cadence: cadenceIn
     cadenceMode?: string;
     timezone?: string;
 }): Record<string, unknown> | undefined;
-/**
- * Creation preserves the policy its author wrote, so the mode that comes back
- * is normally the mode that was asked for. When it is not — normalization
- * rejected the value, or a governance layer sits lower — the difference has to
- * be said out loud at the CLI boundary; otherwise a successful create response
- * reads like the requested autonomy is live when something else is running.
- */
-/**
- * A refused `--activate` leaves a draft, and the draft's id is the answer the
- * caller needs — so the refusal is reported on the result, never thrown over
- * it. `{code, reason, fix}` mirrors the MCP surface's refusal; `guide` points
- * at the section that explains the code when one does (resolved offline).
- */
+export type ActivationBlocker = {
+    gate: string;
+    reason: string;
+};
 export declare function commitmentActivationRefusal(err: unknown, { id, bin }: {
     id: string;
     bin: string;
@@ -41,6 +32,7 @@ export declare function commitmentActivationRefusal(err: unknown, { id, bin }: {
     reason: string;
     fix: string;
     guide?: AgentGuidePointer;
+    blockers?: ActivationBlocker[];
 };
 /**
  * `skrr commitments create` — author a durable commitment contract.
@@ -89,7 +81,7 @@ export default class CommitmentsCreate extends BaseCommand {
         repo: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         base: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         isolation: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        'max-nudges': import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'max-nudges': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'max-concurrent-runs': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'concurrency-reason': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };