@skrr-ai/cli 0.1.129 → 0.1.130

package/dist/lib/reflection.d.ts

@@ -36,15 +36,73 @@ export declare const MAX_REFLECTION_CADENCE_MINUTES: number;
  * out to `skrr` from Bash.
  */
 export declare const REFLECTION_PROMPT = "[Self-reflection] Step back and review your own schedule and cadence \u2014 this is a planning turn, not a chat turn.\n\n1. Look at your whole schedule in one view: your recent fires (past), your upcoming triggers, your open tasks, and today's to-dos. (Use your schedule-overview tool, or run `skrr agents schedule-overview <your-agent-id>`.)\n2. Judge your own rhythm honestly: are you waking too often (many fires, little changed) or too rarely (things slipping past their time)?\n3. If your reflection cadence is wrong, retune it \u2014 reschedule THIS self-reflection trigger to a better interval.\n4. Fix what is slipping: reschedule, create, or cancel triggers and tasks so your plan matches reality.\n\nBe deliberate and minimal. Every trigger you keep spends the user's compute \u2014 keep only what earns its place. If nothing needs changing, do nothing and end the turn.";
+/**
+ * A cadence the caller got wrong: unparseable, empty, or not a positive number of
+ * minutes. Mirrors `InvalidCadenceError` in the server copy, minus its 4xx `status`:
+ * that field is how an MCP server tells the caller's mistake from its own failure,
+ * and on the CLI the same field would make `handleApiError` read this as an HTTP
+ * response. Commands catch it and report it as a usage error.
+ */
+export declare class InvalidCadenceError extends Error {
+    readonly code = "INVALID_CADENCE";
+    constructor(message: string);
+}
 export declare function parseCadenceToMinutes(input: string): number;
 /** Clamp a cadence to the allowed reflection window. */
 export declare function clampCadenceMinutes(minutes: number): number;
+/** What `applyCadenceBounds` did to a requested cadence. */
+export interface CadenceBounds {
+    minutes: number;
+    requestedMinutes: number;
+    clamped: boolean;
+    /** The limit that moved the request, or null when it was inside the window. */
+    bound: 'minimum' | 'maximum' | null;
+}
+/**
+ * Apply the reflection window to a requested cadence and SAY what happened, so every
+ * caller can report "asked 5m, applied 15m" instead of only the clamped number
+ * (OSK-21486, OSK-21493, OSK-21602). `bound` names the limit that moved it.
+ */
+export declare function applyCadenceBounds(requestedMinutes: number): CadenceBounds;
+/**
+ * One sentence for a clamp ("5m is below the 15m minimum; applied 15m."), or null when
+ * the request was inside the window. Shared by the MCP result `note` and the CLI line.
+ */
+export declare function describeCadenceClamp({ minutes, requestedMinutes, bound, }: Pick<CadenceBounds, 'minutes' | 'requestedMinutes' | 'bound'>): string | null;
 /** Render minutes back as a compact human cadence ("6h", "90m", "1d"). */
 export declare function describeCadenceMinutes(minutes: number): string;
 /** The agent's single self-reflection trigger, or undefined if none exists. */
 export declare function findReflectionTrigger(triggers: TriggerDefinition[]): TriggerDefinition | undefined;
 /** Read a reflection trigger's current interval in minutes, if it has one. */
 export declare function reflectionCadenceMinutes(trigger: TriggerDefinition): number | undefined;
+/**
+ * The loop's next run, for display: its scheduled time while it is enabled, else `-`. A
+ * paused loop has no next run, and a loop with nothing scheduled does not have its LAST fire
+ * promoted to one (the server copy keeps `nextRunAt` and `lastFiredAt` apart the same way).
+ */
+export declare function reflectionNextRunLabel(trigger: TriggerDefinition): string;
+/**
+ * Whether the loop's fires run, as the SERVER says it (`GET /api/triggers?include=autonomy`), or
+ * null when it did not say. Nothing is derived here: the verdict depends on the agent's
+ * initiative mode and on which door created the loop, and a local copy of that judgement is free
+ * to disagree with the fire path (OSK-21606). A server that predates the field, or one that could
+ * not reach a verdict, sends nothing, and that is UNKNOWN, never `runs`.
+ */
+export declare function reflectionAutonomy(trigger: TriggerDefinition): {
+    autonomy: 'runs' | 'suggests_only';
+    note?: string;
+} | null;
+/**
+ * The one plain sentence a text view prints under the loop when its fires will not run for the
+ * owner; null when they do, when the server did not say, or when the loop is paused (a paused
+ * loop fires nothing, so the gate is not what the reader needs to hear about).
+ */
+export declare function reflectionAutonomyNote(trigger: TriggerDefinition, bin: string): string | null;
+/** The `--json` fields for the same verdict: absent when unknown, so absence reads as unknown. */
+export declare function reflectionAutonomyFields(trigger: TriggerDefinition): {
+    autonomy?: 'runs' | 'suggests_only';
+    note?: string;
+};
 /**
  * Build the `POST /api/triggers` body for a fresh self-reflection loop. Uses the
  * proven `scope:agent + kind:schedule + mode:run_only` shape and coalesces so a

package/dist/lib/reflection.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REFLECTION_PROMPT = exports.MAX_REFLECTION_CADENCE_MINUTES = exports.MIN_REFLECTION_CADENCE_MINUTES = exports.DEFAULT_REFLECTION_CADENCE_MINUTES = exports.REFLECTION_LABEL = void 0;
+exports.InvalidCadenceError = exports.REFLECTION_PROMPT = exports.MAX_REFLECTION_CADENCE_MINUTES = exports.MIN_REFLECTION_CADENCE_MINUTES = exports.DEFAULT_REFLECTION_CADENCE_MINUTES = exports.REFLECTION_LABEL = void 0;
 exports.parseCadenceToMinutes = parseCadenceToMinutes;
 exports.clampCadenceMinutes = clampCadenceMinutes;
+exports.applyCadenceBounds = applyCadenceBounds;
+exports.describeCadenceClamp = describeCadenceClamp;
 exports.describeCadenceMinutes = describeCadenceMinutes;
 exports.findReflectionTrigger = findReflectionTrigger;
 exports.reflectionCadenceMinutes = reflectionCadenceMinutes;
+exports.reflectionNextRunLabel = reflectionNextRunLabel;
+exports.reflectionAutonomy = reflectionAutonomy;
+exports.reflectionAutonomyNote = reflectionAutonomyNote;
+exports.reflectionAutonomyFields = reflectionAutonomyFields;
 exports.buildReflectionTriggerPayload = buildReflectionTriggerPayload;
 /**
  * reflection.ts — the agent self-reflection ("meta cadence") loop.
@@ -52,9 +58,42 @@ exports.REFLECTION_PROMPT = `[Self-reflection] Step back and review your own sch
 4. Fix what is slipping: reschedule, create, or cancel triggers and tasks so your plan matches reality.
 
 Be deliberate and minimal. Every trigger you keep spends the user's compute — keep only what earns its place. If nothing needs changing, do nothing and end the turn.`;
+/**
+ * A cadence the caller got wrong: unparseable, empty, or not a positive number of
+ * minutes. Mirrors `InvalidCadenceError` in the server copy, minus its 4xx `status`:
+ * that field is how an MCP server tells the caller's mistake from its own failure,
+ * and on the CLI the same field would make `handleApiError` read this as an HTTP
+ * response. Commands catch it and report it as a usage error.
+ */
+class InvalidCadenceError extends Error {
+    code = 'INVALID_CADENCE';
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidCadenceError';
+    }
+}
+exports.InvalidCadenceError = InvalidCadenceError;
+/**
+ * A cadence must be a positive, finite number of minutes. `0` is not "off" and not "the
+ * minimum": rounding it up to the floor turned an attempt to switch the loop off into one
+ * that wakes the agent 96 times a day (OSK-21493).
+ */
+function requirePositiveMinutes(minutes, raw) {
+    if (!Number.isFinite(minutes)) {
+        throw new InvalidCadenceError(`That cadence is too large to be a number of minutes. Pick between ${describeCadenceMinutes(exports.MIN_REFLECTION_CADENCE_MINUTES)} and ${describeCadenceMinutes(exports.MAX_REFLECTION_CADENCE_MINUTES)}.`);
+    }
+    if (minutes <= 0) {
+        const shown = raw.length > 24 ? `${raw.slice(0, 24)}…` : raw;
+        throw new InvalidCadenceError(`"${shown}" is not a cadence — it cannot mean "off". To pause the loop, disable it instead ` +
+            '(skrr agents reflect <agent> --disable, or the self_reflection_disable tool); otherwise ' +
+            `pick between ${describeCadenceMinutes(exports.MIN_REFLECTION_CADENCE_MINUTES)} and ${describeCadenceMinutes(exports.MAX_REFLECTION_CADENCE_MINUTES)}.`);
+    }
+    return minutes;
+}
 /**
  * Parse a human cadence into minutes. Accepts `6h`, `90m`, `2h30m`, `1d`, or a
- * bare number (interpreted as minutes). Throws on unparseable input.
+ * bare number (interpreted as minutes). Throws `InvalidCadenceError` on
+ * unparseable input.
  */
 // Longest-first alternation, and CADENCE_FULL is anchored so the WHOLE string
 // must be consumed. Without the anchor, "1 month" matches `1` + `m` and silently
@@ -67,14 +106,14 @@ function parseCadenceToMinutes(input) {
         .trim()
         .toLowerCase();
     if (!raw) {
-        throw new Error('Empty cadence. Use a form like "6h", "90m", "2h30m", or "360".');
+        throw new InvalidCadenceError('Empty cadence. Use a form like "6h", "90m", "2h30m", or "360".');
     }
     // Bare number → minutes.
     if (/^\d+(\.\d+)?$/.test(raw)) {
-        return Math.round(Number(raw));
+        return requirePositiveMinutes(Math.round(Number(raw)), raw);
     }
     if (!CADENCE_FULL.test(raw)) {
-        throw new Error(`Could not parse cadence "${input}". Use minutes/hours/days — e.g. "6h", "90m", "2h30m", "360". ` +
+        throw new InvalidCadenceError(`Could not parse cadence "${input}". Use minutes/hours/days — e.g. "6h", "90m", "2h30m", "360". ` +
             '(Months and seconds are not units here.)');
     }
     let total = 0;
@@ -90,12 +129,39 @@ function parseCadenceToMinutes(input) {
         else
             total += n;
     }
-    return Math.round(total);
+    return requirePositiveMinutes(Math.round(total), raw);
 }
 /** Clamp a cadence to the allowed reflection window. */
 function clampCadenceMinutes(minutes) {
     return Math.max(exports.MIN_REFLECTION_CADENCE_MINUTES, Math.min(exports.MAX_REFLECTION_CADENCE_MINUTES, Math.round(minutes)));
 }
+/**
+ * Apply the reflection window to a requested cadence and SAY what happened, so every
+ * caller can report "asked 5m, applied 15m" instead of only the clamped number
+ * (OSK-21486, OSK-21493, OSK-21602). `bound` names the limit that moved it.
+ */
+function applyCadenceBounds(requestedMinutes) {
+    const requested = Math.round(requestedMinutes);
+    const minutes = clampCadenceMinutes(requested);
+    let bound = null;
+    if (minutes > requested)
+        bound = 'minimum';
+    else if (minutes < requested)
+        bound = 'maximum';
+    return { minutes, requestedMinutes: requested, clamped: bound !== null, bound };
+}
+/**
+ * One sentence for a clamp ("5m is below the 15m minimum; applied 15m."), or null when
+ * the request was inside the window. Shared by the MCP result `note` and the CLI line.
+ */
+function describeCadenceClamp({ minutes, requestedMinutes, bound, }) {
+    if (!bound)
+        return null;
+    const limit = bound === 'minimum' ? exports.MIN_REFLECTION_CADENCE_MINUTES : exports.MAX_REFLECTION_CADENCE_MINUTES;
+    const side = bound === 'minimum' ? 'below' : 'above';
+    return (`${describeCadenceMinutes(requestedMinutes)} is ${side} the ${describeCadenceMinutes(limit)} ` +
+        `${bound}; applied ${describeCadenceMinutes(minutes)}.`);
+}
 /** Render minutes back as a compact human cadence ("6h", "90m", "1d"). */
 function describeCadenceMinutes(minutes) {
     if (minutes > 0 && minutes % (60 * 24) === 0)
@@ -113,6 +179,49 @@ function reflectionCadenceMinutes(trigger) {
     const ms = trigger.schedule?.intervalMs;
     return typeof ms === 'number' && Number.isFinite(ms) ? Math.round(ms / 60_000) : undefined;
 }
+/**
+ * The loop's next run, for display: its scheduled time while it is enabled, else `-`. A
+ * paused loop has no next run, and a loop with nothing scheduled does not have its LAST fire
+ * promoted to one (the server copy keeps `nextRunAt` and `lastFiredAt` apart the same way).
+ */
+function reflectionNextRunLabel(trigger) {
+    return (0, triggers_1.scheduledRunAt)(trigger) ?? '-';
+}
+/**
+ * Whether the loop's fires run, as the SERVER says it (`GET /api/triggers?include=autonomy`), or
+ * null when it did not say. Nothing is derived here: the verdict depends on the agent's
+ * initiative mode and on which door created the loop, and a local copy of that judgement is free
+ * to disagree with the fire path (OSK-21606). A server that predates the field, or one that could
+ * not reach a verdict, sends nothing, and that is UNKNOWN, never `runs`.
+ */
+function reflectionAutonomy(trigger) {
+    if (trigger.enabled === false)
+        return null;
+    const { autonomy, autonomyNote } = trigger;
+    if (autonomy !== 'runs' && autonomy !== 'suggests_only')
+        return null;
+    const note = typeof autonomyNote === 'string' && autonomyNote.trim() ? autonomyNote.trim() : '';
+    return { autonomy, ...(note ? { note } : {}) };
+}
+/**
+ * The one plain sentence a text view prints under the loop when its fires will not run for the
+ * owner; null when they do, when the server did not say, or when the loop is paused (a paused
+ * loop fires nothing, so the gate is not what the reader needs to hear about).
+ */
+function reflectionAutonomyNote(trigger, bin) {
+    const verdict = reflectionAutonomy(trigger);
+    if (!verdict || verdict.autonomy !== 'suggests_only')
+        return null;
+    return (verdict.note ??
+        `This loop's fires only create an inbox suggestion. Run ${bin} triggers preflight ${trigger.id ?? '<trigger-id>'} to see why.`);
+}
+/** The `--json` fields for the same verdict: absent when unknown, so absence reads as unknown. */
+function reflectionAutonomyFields(trigger) {
+    const verdict = reflectionAutonomy(trigger);
+    if (!verdict)
+        return {};
+    return { autonomy: verdict.autonomy, ...(verdict.note ? { note: verdict.note } : {}) };
+}
 /**
  * Build the `POST /api/triggers` body for a fresh self-reflection loop. Uses the
  * proven `scope:agent + kind:schedule + mode:run_only` shape and coalesces so a

package/dist/lib/task-operations.js

@@ -28,6 +28,8 @@ function taskActionCommand(action, taskId, targetId, bin = 'skrr', context = {})
         request_approval: `tasks approvals create ${task} --type <review|sign_off|deployment>`,
         resolve_approval: `tasks approvals resolve ${task} ${target} --status <approved|rejected>`,
         resolve_task_hold: `tasks move ${task} --status <status>`,
+        resume_schedule: `tasks resume-schedule ${task}`,
+        retry_schedule: `tasks retry-schedule ${task} --at <time>`,
         retry_task: `tasks retry ${task}`,
         set_execution_mode: `tasks update ${task} --execution-mode <agent|human>`,
         start_task: `tasks start ${task}`,

package/dist/lib/task-schedule-notes.d.ts

@@ -0,0 +1,46 @@
+/**
+ * What a schedule command did to the schedule, as sentences.
+ *
+ * The server already knows these things and reports them as response-only fields
+ * (`schedulePaused`, `scheduleChange`, `scheduleResume`, `scheduleElapsedWhileArchived`).
+ * The commands printed "Scheduled ..." / "Resumed ..." / "unarchived" regardless, so a
+ * person could not tell that a time was recorded but nothing was armed (OSK-21521), that
+ * a slot which fell inside their pause was skipped (OSK-21513), or that a time which
+ * passed while a Task was archived was dropped rather than run (OSK-21494).
+ */
+type Instant = string | Date | null | undefined;
+export type ScheduleResult = {
+    schedulePaused?: {
+        pausedAt?: Instant;
+    };
+    scheduleChange?: {
+        changed?: boolean;
+        reason?: string;
+    };
+};
+/**
+ * Lines to print under `Scheduled task ...`. A paused series is told as such, with the one
+ * command that un-pauses it, because `schedule` never does.
+ */
+export declare function scheduleResultLines(result: ScheduleResult | null | undefined, taskRef: string, bin?: string): string[];
+export type ResumeResult = {
+    scheduleResume?: {
+        skippedScheduledFor?: Instant;
+        nextRunAt?: Instant;
+    };
+};
+/** What resuming did to the slot that fell inside the pause, or nothing when none did. */
+export declare function resumeResultLines(result: ResumeResult | null | undefined): string[];
+export type UnarchiveResult = {
+    scheduleElapsedWhileArchived?: {
+        skippedScheduledFor?: Instant;
+        nextRunAt?: Instant;
+    };
+};
+/** What unarchiving did to a schedule that came due while the Task was archived. */
+export declare function unarchiveResultLines(result: UnarchiveResult | null | undefined, taskRef: string, bin?: string): string[];
+/** At archive time: a kept time that will not fire while archived. */
+export declare function archiveResultLines(result: {
+    scheduledFor?: Instant;
+} | null | undefined): string[];
+export {};

package/dist/lib/task-schedule-notes.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * What a schedule command did to the schedule, as sentences.
+ *
+ * The server already knows these things and reports them as response-only fields
+ * (`schedulePaused`, `scheduleChange`, `scheduleResume`, `scheduleElapsedWhileArchived`).
+ * The commands printed "Scheduled ..." / "Resumed ..." / "unarchived" regardless, so a
+ * person could not tell that a time was recorded but nothing was armed (OSK-21521), that
+ * a slot which fell inside their pause was skipped (OSK-21513), or that a time which
+ * passed while a Task was archived was dropped rather than run (OSK-21494).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scheduleResultLines = scheduleResultLines;
+exports.resumeResultLines = resumeResultLines;
+exports.unarchiveResultLines = unarchiveResultLines;
+exports.archiveResultLines = archiveResultLines;
+function iso(value) {
+    if (!value)
+        return null;
+    const at = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(at.getTime()) ? String(value) : at.toISOString();
+}
+/**
+ * Lines to print under `Scheduled task ...`. A paused series is told as such, with the one
+ * command that un-pauses it, because `schedule` never does.
+ */
+function scheduleResultLines(result, taskRef, bin = 'skrr') {
+    const lines = [];
+    if (result?.scheduleChange?.changed === false) {
+        lines.push('Already scheduled exactly like this; nothing changed.');
+    }
+    if (result?.schedulePaused) {
+        lines.push('The recurring series is PAUSED: this time is recorded, but nothing is armed and nothing will run.', `Resume it with \`${bin} tasks resume-schedule ${taskRef}\` (\`schedule\` never resumes a paused series).`);
+    }
+    return lines;
+}
+/** What resuming did to the slot that fell inside the pause, or nothing when none did. */
+function resumeResultLines(result) {
+    const resume = result?.scheduleResume;
+    if (!resume)
+        return [];
+    const skipped = iso(resume.skippedScheduledFor);
+    const next = iso(resume.nextRunAt);
+    return [
+        `Skipped the run that came due while paused (${skipped}); it is not replayed.`,
+        next ? `Next run: ${next}` : 'The series has no further run.',
+    ];
+}
+/** What unarchiving did to a schedule that came due while the Task was archived. */
+function unarchiveResultLines(result, taskRef, bin = 'skrr') {
+    const elapsed = result?.scheduleElapsedWhileArchived;
+    if (!elapsed)
+        return [];
+    const skipped = iso(elapsed.skippedScheduledFor);
+    const next = iso(elapsed.nextRunAt);
+    return [
+        `Its scheduled time (${skipped}) passed while it was archived, so it was skipped, not run.`,
+        next
+            ? `Next run: ${next}`
+            : `It is no longer scheduled; set a new time with \`${bin} tasks schedule ${taskRef} --at <time>\`.`,
+    ];
+}
+/** At archive time: a kept time that will not fire while archived. */
+function archiveResultLines(result) {
+    const kept = iso(result?.scheduledFor);
+    return kept
+        ? [
+            `Its scheduled time (${kept}) is kept but will not fire while archived; a time that passes meanwhile is skipped on unarchive.`,
+        ]
+        : [];
+}

package/dist/lib/triggers.d.ts

@@ -143,6 +143,16 @@ export interface TriggerDefinition {
         recordedAt?: string;
         retiredAt?: string;
     };
+    /**
+     * Server-DERIVED and only present when the list was asked for it (`?include=autonomy`), and
+     * only on a self-reflection loop: whether its scheduled fires RUN (`runs`) or stop short of
+     * running because the agent's initiative mode applies to them (`suggests_only`, with
+     * `autonomyNote` saying why). It is the verdict `triggers preflight` prints at its initiative
+     * gate. A server that predates it, or a verdict it could not reach, sends neither field, which
+     * means UNKNOWN: a reader must never take an absent `autonomy` for `runs` (OSK-21606).
+     */
+    autonomy?: 'runs' | 'suggests_only';
+    autonomyNote?: string;
     createdAt?: string;
     updatedAt?: string;
 }
@@ -457,6 +467,14 @@ export declare function scopeLabel(trigger: TriggerDefinition): string;
  * `triggers show` said `Armed: yes` with no time (OSK-15416).
  */
 export declare function onceDueAt(trigger: TriggerDefinition): string | null;
+/**
+ * When a trigger WILL fire next: its scheduled time, and only while it is enabled. A disabled
+ * trigger keeps the `schedule.nextRunAt` it had when it was paused, and nothing will ever run
+ * at that time — `agents reflect` and `agents schedule-overview` printed it as the next run of
+ * a paused loop while `agents upcoming` correctly listed nothing (OSK-21605). Null when
+ * nothing is scheduled; never the last fire.
+ */
+export declare function scheduledRunAt(trigger: TriggerDefinition): string | null;
 export declare function nextRunLabel(trigger: TriggerDefinition): string;
 /**
  * Whether a trigger will actually fire — not merely whether someone left it on.

package/dist/lib/triggers.js

@@ -39,6 +39,7 @@ exports.agentRefEntity = agentRefEntity;
 exports.fetchAgentScopedTrigger = fetchAgentScopedTrigger;
 exports.scopeLabel = scopeLabel;
 exports.onceDueAt = onceDueAt;
+exports.scheduledRunAt = scheduledRunAt;
 exports.nextRunLabel = nextRunLabel;
 exports.armedLabel = armedLabel;
 exports.degradedMarker = degradedMarker;
@@ -1078,12 +1079,21 @@ function onceDueAt(trigger) {
     const due = once.runAt ?? once.at;
     return due ? String(due) : null;
 }
+/**
+ * When a trigger WILL fire next: its scheduled time, and only while it is enabled. A disabled
+ * trigger keeps the `schedule.nextRunAt` it had when it was paused, and nothing will ever run
+ * at that time — `agents reflect` and `agents schedule-overview` printed it as the next run of
+ * a paused loop while `agents upcoming` correctly listed nothing (OSK-21605). Null when
+ * nothing is scheduled; never the last fire.
+ */
+function scheduledRunAt(trigger) {
+    if (trigger.enabled === false)
+        return null;
+    const next = trigger.schedule?.nextRunAt ?? trigger.selfScheduled?.nextRunAt ?? onceDueAt(trigger);
+    return next ? String(next) : null;
+}
 function nextRunLabel(trigger) {
-    const next = trigger.schedule?.nextRunAt ??
-        trigger.selfScheduled?.nextRunAt ??
-        onceDueAt(trigger) ??
-        trigger.audit?.lastFiredAt ??
-        '';
+    const next = scheduledRunAt(trigger) ?? trigger.audit?.lastFiredAt ?? '';
     return next ? String(next) : '-';
 }
 /**
@@ -1438,7 +1448,7 @@ function renderTriggerSummary(trigger, log, options = {}) {
     const next = nextRunLabel(trigger);
     if (next !== '-') {
         // `nextRunLabel` falls back to the last fire when nothing is scheduled; say which it is.
-        const upcoming = Boolean(trigger.schedule?.nextRunAt ?? trigger.selfScheduled?.nextRunAt ?? onceDueAt(trigger));
+        const upcoming = Boolean(scheduledRunAt(trigger));
         log(`${upcoming ? 'Next run:' : 'Last run:'}${next.length > 0 ? ` ${next}` : ''}`);
     }
     /*

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -1,5 +1,6 @@
 import { type DeviceKeyAlg, type DevicePublicJwk } from './deviceKey.js';
 import { type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
+import { type ExecutorStopReceipt, type ExecutorStopReceiptBody } from './executorStopReceipt.js';
 import { type HardwareKeyCapability, type HardwareKeyRecord } from './deviceKeyHardware.js';
 /**
  * The `cred_envelope.read.decrypt_failed` hint for the device PRIVATE key
@@ -235,6 +236,14 @@ export declare function signServerRequest(opts: {
     refreshToken?: string;
     accessToken?: string;
 }): Promise<string | null>;
+/**
+ * Sign an executor stop receipt (OSK-20777 Gate 1) with the device key: the signed proof that a
+ * scheduled session stopped, which the server verifies against the key pinned on this machine's row.
+ * Returns null when device identity is not active or the key cannot sign right now. NEVER throws: a
+ * failed sign emits a telemetry event and the caller sends the response without a receipt, which the
+ * server treats as an unproven stop rather than as a failure of the session.
+ */
+export declare function signExecutorStopReceiptWithDeviceKey(body: ExecutorStopReceiptBody): Promise<ExecutorStopReceipt | null>;
 /** @internal Test seams — file path resolvers. */
 export declare function __publicKeyPathForTest(profile: string): string;
 export declare function __privateKeyPathForTest(profile: string): string;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -51,6 +51,7 @@ __export(deviceIdentityBridge_exports, {
   persistPendingHardwareKey: () => persistPendingHardwareKey,
   prepareHardwareKeyCandidate: () => prepareHardwareKeyCandidate,
   resetDeviceIdentity: () => resetDeviceIdentity,
+  signExecutorStopReceiptWithDeviceKey: () => signExecutorStopReceiptWithDeviceKey,
   signServerRequest: () => signServerRequest,
   signWithCandidate: () => signWithCandidate
 });
@@ -60,6 +61,7 @@ var import_node_path = __toESM(require("node:path"), 1);
 var import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
 var import_deviceKey = require("./deviceKey.js");
 var import_deviceKeyHandle = require("./deviceKeyHandle.js");
+var import_executorStopReceipt = require("./executorStopReceipt.js");
 var import_deviceKeyHardware = require("./deviceKeyHardware.js");
 var import_credentialEnvelopeBridge = require("./credentialEnvelopeBridge.js");
 var import_profileStateDir = require("./profileStateDir.js");
@@ -827,6 +829,25 @@ async function signServerRequest(opts) {
     return null;
   }
 }
+async function signExecutorStopReceiptWithDeviceKey(body) {
+  reloadIfRecovered();
+  const state = _state;
+  if (state.kind !== "active")
+    return null;
+  try {
+    return await (0, import_executorStopReceipt.signExecutorStopReceipt)(state.key, body);
+  } catch (err) {
+    emit("sign_failed", false, {
+      profile: state.profile,
+      thumbprint: state.key.thumbprint,
+      custody: state.key.custody,
+      method: "executor_stop_receipt",
+      ...err instanceof import_deviceKeyHardware.HardwareDeviceKeyError ? { hardwareFailure: err.code } : {},
+      message: err?.message ?? "unknown"
+    });
+    return null;
+  }
+}
 function __publicKeyPathForTest(profile) {
   return publicKeyPath(profile);
 }
@@ -1040,6 +1061,7 @@ async function enrollWithServer(opts) {
   persistPendingHardwareKey,
   prepareHardwareKeyCandidate,
   resetDeviceIdentity,
+  signExecutorStopReceiptWithDeviceKey,
   signServerRequest,
   signWithCandidate
 });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -34,7 +34,7 @@ export { AUTH_SERVER_METADATA_PATH, readServerDeviceKeyAlgs, SERVER_DEVICE_KEY_A
 export { configureHardwareDeviceKeyHelper, HARDWARE_KEY_HELPER_NAME, HardwareDeviceKeyError, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, type HardwareDeviceKeyErrorCode, type HardwareKeyCapability, } from './deviceKeyHardware.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, signExecutorStopReceiptWithDeviceKey, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -316,6 +316,7 @@ __export(index_exports, {
   setMachineUuidProfile: () => import_machineUuid.setMachineUuidProfile,
   shutdownCredEnvelope: () => import_credentialEnvelopeBridge.shutdownCredEnvelope,
   signExecutorStopReceipt: () => import_executorStopReceipt.signExecutorStopReceipt,
+  signExecutorStopReceiptWithDeviceKey: () => import_deviceIdentityBridge.signExecutorStopReceiptWithDeviceKey,
   signProofWith: () => import_deviceKey.signProofWith,
   signServerRequest: () => import_deviceIdentityBridge.signServerRequest,
   signWithCandidate: () => import_deviceIdentityBridge.signWithCandidate,
@@ -686,6 +687,7 @@ var import_independentMachineReservation = require("./independentMachineReservat
   setMachineUuidProfile,
   shutdownCredEnvelope,
   signExecutorStopReceipt,
+  signExecutorStopReceiptWithDeviceKey,
   signProofWith,
   signServerRequest,
   signWithCandidate,

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -1,5 +1,6 @@
 import { type DeviceKeyAlg, type DevicePublicJwk } from './deviceKey.js';
 import { type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
+import { type ExecutorStopReceipt, type ExecutorStopReceiptBody } from './executorStopReceipt.js';
 import { type HardwareKeyCapability, type HardwareKeyRecord } from './deviceKeyHardware.js';
 /**
  * The `cred_envelope.read.decrypt_failed` hint for the device PRIVATE key
@@ -235,6 +236,14 @@ export declare function signServerRequest(opts: {
     refreshToken?: string;
     accessToken?: string;
 }): Promise<string | null>;
+/**
+ * Sign an executor stop receipt (OSK-20777 Gate 1) with the device key: the signed proof that a
+ * scheduled session stopped, which the server verifies against the key pinned on this machine's row.
+ * Returns null when device identity is not active or the key cannot sign right now. NEVER throws: a
+ * failed sign emits a telemetry event and the caller sends the response without a receipt, which the
+ * server treats as an unproven stop rather than as a failure of the session.
+ */
+export declare function signExecutorStopReceiptWithDeviceKey(body: ExecutorStopReceiptBody): Promise<ExecutorStopReceipt | null>;
 /** @internal Test seams — file path resolvers. */
 export declare function __publicKeyPathForTest(profile: string): string;
 export declare function __privateKeyPathForTest(profile: string): string;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -34,6 +34,7 @@ import path from 'node:path';
 import lockfile from 'proper-lockfile';
 import { generateDeviceKeyPair, isDevicePublicJwk, jwkThumbprint, signProofWith, } from './deviceKey.js';
 import { softwareEd25519Handle } from './deviceKeyHandle.js';
+import { signExecutorStopReceipt, } from './executorStopReceipt.js';
 import { createHardwareDeviceKey, hardwareDeviceKeyHandle, parseHardwareKeyRecord, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, serializeHardwareKeyRecord, HardwareDeviceKeyError, } from './deviceKeyHardware.js';
 import { hasCredEnvelopePathConflict, isCredEnvelopeActive, maybeDecryptOnRead, splitKeyConvergencePolicy, wrapIfActiveOrPassthrough, } from './credentialEnvelopeBridge.js';
 import { consolidateProfileState, profileStateFilePathsToClear, profileStateDir, resolveProfileStateDir, RETIRED_COPY_SUFFIX, } from './profileStateDir.js';
@@ -1133,6 +1134,33 @@ export async function signServerRequest(opts) {
         return null;
     }
 }
+/**
+ * Sign an executor stop receipt (OSK-20777 Gate 1) with the device key: the signed proof that a
+ * scheduled session stopped, which the server verifies against the key pinned on this machine's row.
+ * Returns null when device identity is not active or the key cannot sign right now. NEVER throws: a
+ * failed sign emits a telemetry event and the caller sends the response without a receipt, which the
+ * server treats as an unproven stop rather than as a failure of the session.
+ */
+export async function signExecutorStopReceiptWithDeviceKey(body) {
+    reloadIfRecovered();
+    const state = _state;
+    if (state.kind !== 'active')
+        return null;
+    try {
+        return await signExecutorStopReceipt(state.key, body);
+    }
+    catch (err) {
+        emit('sign_failed', false, {
+            profile: state.profile,
+            thumbprint: state.key.thumbprint,
+            custody: state.key.custody,
+            method: 'executor_stop_receipt',
+            ...(err instanceof HardwareDeviceKeyError ? { hardwareFailure: err.code } : {}),
+            message: err?.message ?? 'unknown',
+        });
+        return null;
+    }
+}
 /** @internal Test seams — file path resolvers. */
 export function __publicKeyPathForTest(profile) {
     return publicKeyPath(profile);

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -34,7 +34,7 @@ export { AUTH_SERVER_METADATA_PATH, readServerDeviceKeyAlgs, SERVER_DEVICE_KEY_A
 export { configureHardwareDeviceKeyHelper, HARDWARE_KEY_HELPER_NAME, HardwareDeviceKeyError, probeHardwareDeviceKey, resolveHardwareDeviceKeyHelper, type HardwareDeviceKeyErrorCode, type HardwareKeyCapability, } from './deviceKeyHardware.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, signExecutorStopReceiptWithDeviceKey, prepareHardwareKeyCandidate, commitDeviceKeyCandidate, signWithCandidate, persistPendingHardwareKey, commitPendingHardwareKey, discardPendingHardwareKey, PENDING_HARDWARE_KEY_MAX_AGE_MS, type DeviceKeyCandidate, type DeviceKeyCandidateResult, type PendingHardwareKeyOutcome, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, describeStoredDeviceKey, DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT, type StoredDeviceKeyDescription, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';