@skrr-ai/cli 0.1.15 → 0.1.17

package/dist/commands/tasks/deliverable/confirm.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const tasks_1 = require("../../../lib/tasks");
+/**
+ * `skrr tasks deliverable confirm <task> <kind>:<identity>[@<location>] --reason "<what you checked>"`
+ *
+ * Somebody looked, and it is there.
+ *
+ * WHY THIS IS A SEPARATE COMMAND from `deliverable add`. Recording and vouching
+ * are different claims. `add` says "this exists, and I am the one who made it";
+ * this says "I checked, independently of whoever made it". Five of the six
+ * outcome kinds have no automatic observer — nothing in the platform watches a
+ * Drive folder or a Slack channel — so without this rung an expectation for a
+ * PDF or a posted message could only ever be closed by waiving it, which
+ * records "we decided we did not need this" about work that was actually done.
+ *
+ * The reason is required, for the same purpose a waiver's and a judgement's
+ * are: the entire value of a confirmation is that a person actually looked, and
+ * a confirmation with nothing written down is indistinguishable from a click.
+ *
+ * It UPSERTS. Confirming something the executor never recorded is legitimate —
+ * the thing is there either way — and making a person file the row first before
+ * they may vouch for it is ceremony that buys nothing.
+ */
+class TasksDeliverableConfirm extends base_command_1.BaseCommand {
+    static description = 'Confirm you checked a deliverable and it is there — the evidence an expectation needs when nothing observes it automatically';
+    static examples = [
+        '<%= config.bin %> tasks deliverable confirm <task-id> file/pdf:report_92@Drive/Reports --reason "Opened it; all four sections are there."',
+        '<%= config.bin %> tasks deliverable confirm <task-id> message:m_51@#general --reason "Read the thread; it went out at 09:04."',
+    ];
+    static args = {
+        task: core_1.Args.string({ description: 'Task id or ref', required: true, ignoreStdin: true }),
+        coordinate: core_1.Args.string({
+            description: '<kind>[/<format>]:<identity>[@<location>] — the thing you checked',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        reason: core_1.Flags.string({
+            required: true,
+            description: 'What you looked at. A confirmation without one is not a confirmation.',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksDeliverableConfirm);
+        const parsed = (0, tasks_1.parseDeliverableCoordinate)(args.coordinate);
+        if (!parsed.ok) {
+            // For an agent the refusal IS the documentation — it hits the error and
+            // corrects — so it carries the whole form and vocabulary.
+            this.error(parsed.error, { exit: 1 });
+            return;
+        }
+        let result;
+        try {
+            result = await data_provider_1.dataService.confirmTaskDeliverable(args.task, {
+                ...parsed.value,
+                reason: flags.reason,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        this.log(`Confirmed ${parsed.value.kind}:${parsed.value.identity}: ${flags.reason}`);
+    }
+}
+exports.default = TasksDeliverableConfirm;

package/dist/commands/tasks/expectations.js

@@ -15,6 +15,10 @@ const STATE_LABEL = {
     met: 'done',
     waived: 'dropped',
     blocked: 'stuck',
+    // Its own word, because its next action is its own: somebody looks, rather
+    // than somebody works. Reading it as 'not yet' sends people to redo finished
+    // work, which is precisely the confusion the state was added to remove.
+    unverified: 'needs a look',
     underway: 'on its way',
     owed: 'not yet',
     unjudged: 'needs a person',
@@ -26,7 +30,13 @@ function line(expectation) {
     // trusted.
     const gate = expectation.gating ? '' : '  (does not block completion)';
     const from = expectation.source === 'space' ? '  [space default]' : '';
-    return `  ${expectation.id.padEnd(18)} ${label.padEnd(14)} ${expectation.sentence}${gate}${from}`;
+    // Only shown when the work exists and the evidence is short — stating the
+    // required authority on every row would be noise on the rows where it is
+    // already satisfied or not yet relevant.
+    const evidence = expectation.state === 'unverified'
+        ? `  (has ${expectation.evidenceAuthority}, needs ${expectation.requiredAuthority})`
+        : '';
+    return `  ${expectation.id.padEnd(18)} ${label.padEnd(14)} ${expectation.sentence}${evidence}${gate}${from}`;
 }
 class TasksExpectations extends base_command_1.BaseCommand {
     static description = 'Show what a task must produce and how far each expectation got ("Done when")';
@@ -83,6 +93,15 @@ class TasksExpectations extends base_command_1.BaseCommand {
         if (settleable > 0) {
             this.log(`${settleable} awaiting a person — settle with \`${this.config.bin} tasks judge\`.`);
         }
+        // Named separately from `unjudged`, and with a different command, because
+        // the two look alike on the board and are not: one needs a verdict on prose,
+        // the other needs somebody to look at a thing that already exists.
+        const unverified = acceptance.expectations.filter((e) => e.state === 'unverified').length;
+        if (unverified > 0) {
+            this.log(`${unverified} produced but not vouched for — confirm with ` +
+                `\`${this.config.bin} tasks deliverable confirm\`, or lower the bar with ` +
+                `\`${this.config.bin} tasks trust\`.`);
+        }
         const inherited = acceptance.unjudged - settleable;
         if (inherited > 0) {
             this.log(`${inherited} inherited from the space default — declare them on the task to settle them.`);

package/dist/commands/tasks/report.js

@@ -7,6 +7,7 @@ const api_fetch_1 = require("../../lib/api-fetch");
 const outbox_1 = require("../../lib/outbox");
 const task_report_1 = require("../../lib/task-report");
 const task_resolver_1 = require("../../lib/task-resolver");
+const tasks_1 = require("../../lib/tasks");
 const session_task_endpoints_1 = require("../../lib/session-task-endpoints");
 const web_url_1 = require("../../lib/web-url");
 /**
@@ -94,6 +95,29 @@ class TasksReport extends base_command_1.BaseCommand {
             ...(0, task_report_1.taskReportEventFields)(report),
             artifacts: flags.deliverable?.map((ref) => ({ label: 'deliverable', ref })),
         };
+        // THE SAME BRIDGE `tasks complete` CARRIES, for the same reason.
+        //
+        // `--deliverable` here is prose for a work event's `artifacts` list, and
+        // the ledger the completion gate reads is written by `tasks deliverable
+        // add`. Three commands in this CLI answer to the word and only one of them
+        // writes the ledger — and the project's own operating instructions teach
+        // this spelling. So a value that is unambiguously a coordinate is forwarded
+        // to the ledger too; prose is left exactly as it was, because guessing a
+        // coordinate out of prose fills the ledger with rows nobody can look up.
+        for (const ref of flags.deliverable ?? []) {
+            const parsed = (0, tasks_1.parseDeliverableCoordinate)(ref);
+            if (!parsed.ok) {
+                continue;
+            }
+            try {
+                await data_provider_1.dataService.addTaskDeliverable(task.id, parsed.value);
+            }
+            catch {
+                // Best-effort: a report must still be posted when the ledger write
+                // fails, and the completion gate's refusal names the command that
+                // writes it.
+            }
+        }
         const sessionPath = await (0, session_task_endpoints_1.sessionScopedTaskPath)('event');
         let result;
         try {

package/dist/commands/tasks/trust.d.ts

@@ -0,0 +1,35 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr tasks trust <task> <expectation-id> --level <authority> --reason "<why>"`
+ *
+ * Move how much evidence one expectation demands.
+ *
+ * A DECISION, not an edit — which is why it is its own command rather than a
+ * field on `tasks update`. It is the one control that turns a refusal into a
+ * pass with no new work done, so a reader later has to be able to see that it
+ * happened and why. Buried in a list patch it would record neither.
+ *
+ * Lowering is the common direction and it is legitimate: a contract that cannot
+ * express "an agent's word is enough for this one" pushes its authors back to
+ * declaring nothing at all, which is the failure the whole feature exists to
+ * end. Raising takes the same reason and costs nothing to allow.
+ *
+ * The three levels, weakest first:
+ *   self_reported       whoever did the work says it is done
+ *   human_confirmed     someone else looked and said so
+ *   observation_backed  the platform saw it itself (a merge webhook, an upload)
+ */
+export default class TasksTrust extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        task: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        expectation: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        level: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        reason: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tasks/trust.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+/**
+ * `skrr tasks trust <task> <expectation-id> --level <authority> --reason "<why>"`
+ *
+ * Move how much evidence one expectation demands.
+ *
+ * A DECISION, not an edit — which is why it is its own command rather than a
+ * field on `tasks update`. It is the one control that turns a refusal into a
+ * pass with no new work done, so a reader later has to be able to see that it
+ * happened and why. Buried in a list patch it would record neither.
+ *
+ * Lowering is the common direction and it is legitimate: a contract that cannot
+ * express "an agent's word is enough for this one" pushes its authors back to
+ * declaring nothing at all, which is the failure the whole feature exists to
+ * end. Raising takes the same reason and costs nothing to allow.
+ *
+ * The three levels, weakest first:
+ *   self_reported       whoever did the work says it is done
+ *   human_confirmed     someone else looked and said so
+ *   observation_backed  the platform saw it itself (a merge webhook, an upload)
+ */
+class TasksTrust extends base_command_1.BaseCommand {
+    static description = 'Set how much evidence one expectation demands, with a stated reason';
+    static examples = [
+        '<%= config.bin %> tasks trust <task-id> e1 --level self_reported --reason "Internal draft; nobody else needs to check it."',
+        '<%= config.bin %> tasks trust <task-id> e2 --level observation_backed --reason "Customer-facing; I want the platform to see it land."',
+    ];
+    static args = {
+        task: core_1.Args.string({ description: 'Task id or ref', required: true, ignoreStdin: true }),
+        expectation: core_1.Args.string({
+            description: 'Expectation id (see `tasks expectations`)',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        level: core_1.Flags.string({
+            options: [...data_provider_1.DELIVERABLE_AUTHORITIES],
+            required: true,
+            description: 'How well evidenced the answer must be: self_reported (the doer says so), ' +
+                'human_confirmed (someone else looked), observation_backed (the platform saw it).',
+        }),
+        reason: core_1.Flags.string({
+            required: true,
+            description: 'Why this bar. Required — it is the record.',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksTrust);
+        let result;
+        try {
+            result = await data_provider_1.dataService.setTaskExpectationTrust(args.task, {
+                expectationId: args.expectation,
+                level: flags.level,
+                reason: flags.reason,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        this.log(`${args.expectation} now needs ${flags.level}: ${flags.reason}`);
+    }
+}
+exports.default = TasksTrust;

package/dist/commands/tasks/waive.js

@@ -22,7 +22,7 @@ class TasksWaive extends base_command_1.BaseCommand {
     static args = {
         task: core_1.Args.string({ description: 'Task id or ref', required: true, ignoreStdin: true }),
         expectation: core_1.Args.string({
-            description: 'Expectation id (see `tasks show`)',
+            description: 'Expectation id (see `tasks expectations`)',
             required: true,
             ignoreStdin: true,
         }),

package/dist/lib/commitments.d.ts

@@ -16,7 +16,7 @@
  * Two `kind`s: `achieve` (bounded, deadline-bearing) and `maintain` (perpetual
  * "hold this state", derived from a Compass invariant — not authored here).
  */
-import { COMMITMENT_WATCHED_SOURCES, COMMITMENT_TEMPLATE_IDS, COMMITMENT_CADENCE_MODES, COMMITMENT_CADENCE_TIME_PATTERN, COMMITMENT_CADENCE_MAX_TIMES } from '@skrr-ai/data-provider';
+import { COMMITMENT_WATCHED_SOURCES, COMMITMENT_TEMPLATE_IDS, COMMITMENT_CADENCE_MODES, COMMITMENT_CADENCE_TIME_PATTERN, COMMITMENT_CADENCE_MAX_TIMES, COMMITMENT_AUTONOMY_MODES, COMMITMENT_EXECUTION_ISOLATION_MODES } from '@skrr-ai/data-provider';
 import type { CommitmentCheck, CommitmentChecksResponse, Commitment, CommitmentListResponse, CommitmentPlanResponse, CommitmentStatusResponse, CommitmentWorkLink } from '@skrr-ai/data-provider';
 import { withQuery } from './triggers';
 export { COMMITMENT_WATCHED_SOURCES, COMMITMENT_TEMPLATE_IDS, COMMITMENT_CADENCE_MODES, COMMITMENT_CADENCE_TIME_PATTERN, COMMITMENT_CADENCE_MAX_TIMES, };
@@ -28,8 +28,20 @@ export type { CommitmentCheck, CommitmentChecksResponse, Commitment, CommitmentL
  * `_Exhaustive*` guards fail to resolve if a canonical value is missing.
  */
 export declare const COMMITMENT_STATUSES: readonly ["draft", "active", "paused", "completed", "cancelled", "archived"];
-/** Autonomy ladder — how much the commitment may act without asking. */
-export declare const COMMITMENT_AUTONOMY_MODES: readonly ["off", "suggestions_only", "ask_first", "auto_run_limited", "auto_run"];
+/**
+ * Autonomy ladder — how much the commitment may act without asking.
+ *
+ * Re-exported, not restated: `@skrr-ai/data-provider` owns the vocabulary, and
+ * a second literal here is how the CLI would silently drift from the server
+ * that rejects its values.
+ */
+export { COMMITMENT_AUTONOMY_MODES };
+/**
+ * Where a Commitment's autonomous runs do their work. Re-exported for the same
+ * reason as the ladder above: the vocabulary is the server's, and a picker that
+ * offers a value the API rejects is a silent drift.
+ */
+export { COMMITMENT_EXECUTION_ISOLATION_MODES };
 /**
  * Interval bounds for `cadence.intervalMs`.
  *
@@ -210,6 +222,7 @@ export declare const commitmentApi: {
     get: (id: string) => Promise<CommitmentStatusResponse>;
     create: (body: Record<string, unknown>) => Promise<Commitment>;
     update: (id: string, body: Record<string, unknown>) => Promise<Commitment>;
+    draftPreflight: (body: Record<string, unknown>) => Promise<CommitmentPreflightReport>;
     workLinks: (id: string, includeInactive?: boolean) => Promise<{
         object: "commitment_work_link_list";
         data: CommitmentWorkLink[];
@@ -347,6 +360,18 @@ export declare const COMMITMENT_FEEDBACK_KINDS: readonly ["useful", "noisy", "wr
 export declare const COMMITMENT_REMEDIATION_ACTIONS: readonly ["pause_commitment", "mute_user_nudges", "reduce_nudge_frequency", "tighten_policy", "mark_noop"];
 /** The only keys `createBodySchema` (a `z.strictObject`) accepts. */
 export declare const COMMITMENT_CREATE_KEYS: readonly ["agentId", "kind", "compassId", "compassOrigin", "goalId", "title", "description", "agentDirective", "status", "target", "watchedSources", "policy", "cadence", "subject", "sensors", "grants", "reports", "createdVia"];
+/**
+ * Read the per-Commitment domain policy from an inline flag or a text file.
+ *
+ * This deliberately uses a separate pair of names from Agent-level instruction
+ * commands: the result configures one Commitment run, not the Agent's global
+ * prompt. The explicit error also keeps shell users from accidentally masking
+ * a reviewed file with a short inline experiment.
+ */
+export declare function readCommitmentAgentDirective({ directive, file, }: {
+    directive?: string;
+    file?: string;
+}): Promise<string | undefined>;
 /**
  * Normalize a `--from-json` body into something the create endpoint accepts.
  *

package/dist/lib/commitments.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COMMITMENT_CLI_EVALUATORS = exports.COMMITMENT_CREATE_KEYS = exports.COMMITMENT_REMEDIATION_ACTIONS = exports.COMMITMENT_FEEDBACK_KINDS = exports.commitmentApi = exports.commitmentPackApi = exports.MAX_COMMITMENT_INTERVAL_MS = exports.MIN_COMMITMENT_INTERVAL_MS = exports.COMMITMENT_AUTONOMY_MODES = exports.COMMITMENT_STATUSES = exports.COMMITMENT_CADENCE_MAX_TIMES = exports.COMMITMENT_CADENCE_TIME_PATTERN = exports.COMMITMENT_CADENCE_MODES = exports.COMMITMENT_TEMPLATE_IDS = exports.COMMITMENT_WATCHED_SOURCES = void 0;
+exports.COMMITMENT_CLI_EVALUATORS = exports.COMMITMENT_CREATE_KEYS = exports.COMMITMENT_REMEDIATION_ACTIONS = exports.COMMITMENT_FEEDBACK_KINDS = exports.commitmentApi = exports.commitmentPackApi = exports.MAX_COMMITMENT_INTERVAL_MS = exports.MIN_COMMITMENT_INTERVAL_MS = exports.COMMITMENT_EXECUTION_ISOLATION_MODES = exports.COMMITMENT_AUTONOMY_MODES = exports.COMMITMENT_STATUSES = exports.COMMITMENT_CADENCE_MAX_TIMES = exports.COMMITMENT_CADENCE_TIME_PATTERN = exports.COMMITMENT_CADENCE_MODES = exports.COMMITMENT_TEMPLATE_IDS = exports.COMMITMENT_WATCHED_SOURCES = void 0;
+exports.readCommitmentAgentDirective = readCommitmentAgentDirective;
 exports.normalizeCreateBody = normalizeCreateBody;
 exports.parseIntervalToMs = parseIntervalToMs;
 exports.buildWatchedSources = buildWatchedSources;
@@ -45,6 +46,9 @@ Object.defineProperty(exports, "COMMITMENT_TEMPLATE_IDS", { enumerable: true, ge
 Object.defineProperty(exports, "COMMITMENT_CADENCE_MODES", { enumerable: true, get: function () { return data_provider_1.COMMITMENT_CADENCE_MODES; } });
 Object.defineProperty(exports, "COMMITMENT_CADENCE_TIME_PATTERN", { enumerable: true, get: function () { return data_provider_1.COMMITMENT_CADENCE_TIME_PATTERN; } });
 Object.defineProperty(exports, "COMMITMENT_CADENCE_MAX_TIMES", { enumerable: true, get: function () { return data_provider_1.COMMITMENT_CADENCE_MAX_TIMES; } });
+Object.defineProperty(exports, "COMMITMENT_AUTONOMY_MODES", { enumerable: true, get: function () { return data_provider_1.COMMITMENT_AUTONOMY_MODES; } });
+Object.defineProperty(exports, "COMMITMENT_EXECUTION_ISOLATION_MODES", { enumerable: true, get: function () { return data_provider_1.COMMITMENT_EXECUTION_ISOLATION_MODES; } });
+const instruction_input_1 = require("./instruction-input");
 const format_1 = require("./format");
 const triggers_1 = require("./triggers");
 /**
@@ -63,16 +67,6 @@ exports.COMMITMENT_STATUSES = [
 ];
 const _statusDriftGuard = true;
 void _statusDriftGuard;
-/** Autonomy ladder — how much the commitment may act without asking. */
-exports.COMMITMENT_AUTONOMY_MODES = [
-    'off',
-    'suggestions_only',
-    'ask_first',
-    'auto_run_limited',
-    'auto_run',
-];
-const _autonomyDriftGuard = true;
-void _autonomyDriftGuard;
 /**
  * Interval bounds for `cadence.intervalMs`.
  *
@@ -116,6 +110,7 @@ exports.commitmentApi = {
     get: (id) => data_provider_1.request.get(base(id)),
     create: (body) => data_provider_1.request.post('/api/commitments', body),
     update: (id, body) => data_provider_1.request.patch(base(id), body),
+    draftPreflight: (body) => data_provider_1.request.post('/api/commitments/preflight', body),
     workLinks: (id, includeInactive = false) => data_provider_1.request.get((0, triggers_1.withQuery)(`${base(id)}/links`, { ...(includeInactive ? { includeInactive: true } : {}) })),
     createWorkLink: (id, body) => data_provider_1.request.post(`${base(id)}/links`, body),
     updateWorkLink: (id, linkId, body) => data_provider_1.request.patch(`${base(id)}/links/${encodeURIComponent(linkId)}`, body),
@@ -238,6 +233,20 @@ exports.COMMITMENT_CREATE_KEYS = [
     'reports',
     'createdVia',
 ];
+/**
+ * Read the per-Commitment domain policy from an inline flag or a text file.
+ *
+ * This deliberately uses a separate pair of names from Agent-level instruction
+ * commands: the result configures one Commitment run, not the Agent's global
+ * prompt. The explicit error also keeps shell users from accidentally masking
+ * a reviewed file with a short inline experiment.
+ */
+async function readCommitmentAgentDirective({ directive, file, }) {
+    if (directive !== undefined && file !== undefined) {
+        throw new Error('Use either --agent-directive or --agent-directive-file, not both.');
+    }
+    return (0, instruction_input_1.readInstructionBody)({ body: directive, file });
+}
 /**
  * Normalize a `--from-json` body into something the create endpoint accepts.
  *

package/dist/lib/tasks.js

@@ -170,8 +170,34 @@ function parseDeliverableCoordinate(spec) {
 }
 /** Lifecycle values a caller may assert, for flag validation. */
 exports.DELIVERABLE_LIFECYCLE_VALUES = data_provider_1.DELIVERABLE_LIFECYCLES;
+/**
+ * `--from-json` takes stored API field names, while the interactive flags use
+ * shorter names such as `--project` and `--spawned-by`. Normalize the obvious
+ * camel-case forms before a permissive API route can silently drop them.
+ */
+function normalizeTaskCreateJsonAliases(body) {
+    const normalized = { ...body };
+    const aliases = [
+        ['parent', 'parentId'],
+        ['space', 'spaceId'],
+        ['goal', 'goalId'],
+        ['commitment', 'commitmentId'],
+        ['project', 'projectId'],
+        ['cycle', 'cycleId'],
+        ['spawnedBy', 'spawnedByTaskId'],
+    ];
+    for (const [alias, canonical] of aliases) {
+        if (Object.prototype.hasOwnProperty.call(normalized, canonical))
+            continue;
+        if (!Object.prototype.hasOwnProperty.call(normalized, alias))
+            continue;
+        normalized[canonical] = normalized[alias];
+        delete normalized[alias];
+    }
+    return normalized;
+}
 function buildTaskCreatePayload(body, flags = {}) {
-    const payload = (0, prompt_1.mergeDefined)(body, {
+    const payload = (0, prompt_1.mergeDefined)(normalizeTaskCreateJsonAliases(body), {
         templateId: flags.template,
         title: flags.title,
         description: flags.description,