@skrr-ai/cli 0.1.22 → 0.1.23

package/dist/lib/message-provenance.d.ts

@@ -0,0 +1,42 @@
+/**
+ * WHAT ASKED FOR THIS MESSAGE.
+ *
+ * OSK-7682/OSK-7708 — an unattended run's answer lands in the agent's
+ * conversation with nothing preceding it. The Conversation entry point
+ * persists the user's prompt as a message and the Task entry point persists
+ * the brief; the Autonomous entry point is session-detached by design and
+ * writes only the answer. Read cold, the thread shows five replies and zero
+ * questions, and there is no path from the mystery message to its cause.
+ *
+ * The server now carries the run's prompt on the ONE row the delivery already
+ * writes (`metadata.proactiveDelivery`). This reads it back. Everything here is
+ * defensive: an older row has no such metadata, and a newer server may add
+ * fields this build has never heard of.
+ */
+export interface DeliveryPrompt {
+    text: string;
+    truncated: boolean;
+    originalLength: number;
+}
+export interface MessageProvenance {
+    /** How this message came to exist, in one word, for a ROLE column. */
+    kind: 'scheduled' | 'heartbeat' | 'proactive';
+    triggerId?: string;
+    occurrenceId?: string;
+    jobId?: string;
+    reason?: string;
+    prompt?: DeliveryPrompt;
+}
+/**
+ * @returns the provenance of an unattended delivery, or null for an ordinary
+ *   interactive message (which needs no attribution — its question is the row
+ *   above it).
+ */
+export declare function messageProvenance(message: unknown): MessageProvenance | null;
+/** One-line attribution for a listing row. */
+export declare function provenanceLabel(provenance: MessageProvenance): string;
+/**
+ * The block `messages show` prints above the answer, so the reader learns what
+ * was asked before reading what came back.
+ */
+export declare function provenanceLines(provenance: MessageProvenance): string[];

package/dist/lib/message-provenance.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * WHAT ASKED FOR THIS MESSAGE.
+ *
+ * OSK-7682/OSK-7708 — an unattended run's answer lands in the agent's
+ * conversation with nothing preceding it. The Conversation entry point
+ * persists the user's prompt as a message and the Task entry point persists
+ * the brief; the Autonomous entry point is session-detached by design and
+ * writes only the answer. Read cold, the thread shows five replies and zero
+ * questions, and there is no path from the mystery message to its cause.
+ *
+ * The server now carries the run's prompt on the ONE row the delivery already
+ * writes (`metadata.proactiveDelivery`). This reads it back. Everything here is
+ * defensive: an older row has no such metadata, and a newer server may add
+ * fields this build has never heard of.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.messageProvenance = messageProvenance;
+exports.provenanceLabel = provenanceLabel;
+exports.provenanceLines = provenanceLines;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function str(value) {
+    return typeof value === 'string' && value.trim() ? value : undefined;
+}
+function readPrompt(value) {
+    const raw = record(value);
+    const text = str(raw?.text);
+    if (!text)
+        return undefined;
+    const originalLength = Number(raw?.originalLength);
+    return {
+        text,
+        truncated: raw?.truncated === true,
+        originalLength: Number.isFinite(originalLength) ? originalLength : text.length,
+    };
+}
+/**
+ * @returns the provenance of an unattended delivery, or null for an ordinary
+ *   interactive message (which needs no attribution — its question is the row
+ *   above it).
+ */
+function messageProvenance(message) {
+    const delivery = record(record(record(message)?.metadata)?.proactiveDelivery);
+    if (!delivery)
+        return null;
+    const triggerId = str(delivery.triggerId);
+    return {
+        kind: delivery.isHeartbeat === true ? 'heartbeat' : triggerId ? 'scheduled' : 'proactive',
+        triggerId,
+        occurrenceId: str(delivery.occurrenceId),
+        jobId: str(delivery.jobId),
+        reason: str(delivery.reason),
+        prompt: readPrompt(delivery.prompt),
+    };
+}
+/** One-line attribution for a listing row. */
+function provenanceLabel(provenance) {
+    return provenance.kind;
+}
+/**
+ * The block `messages show` prints above the answer, so the reader learns what
+ * was asked before reading what came back.
+ */
+function provenanceLines(provenance) {
+    const lines = [];
+    lines.push(`Asked by:     ${provenance.kind} run`);
+    if (provenance.triggerId)
+        lines.push(`Trigger:      ${provenance.triggerId}`);
+    if (provenance.occurrenceId)
+        lines.push(`Occurrence:   ${provenance.occurrenceId}`);
+    if (provenance.jobId)
+        lines.push(`Job:          ${provenance.jobId}`);
+    if (provenance.reason)
+        lines.push(`Reason:       ${provenance.reason}`);
+    if (provenance.prompt) {
+        lines.push('');
+        lines.push('Prompt:');
+        lines.push(provenance.prompt.text);
+        if (provenance.prompt.truncated) {
+            // Never let a preview read as the whole instruction.
+            lines.push(`(preview of ${provenance.prompt.originalLength} characters — the whole prompt is on the fire record: skrr agents schedule-overview <agent-id>)`);
+        }
+    }
+    return lines;
+}

package/dist/lib/scoped-memory-command.d.ts

@@ -0,0 +1,68 @@
+import { type MemoryMount as SharedMemoryMount, type MemoryStore as SharedMemoryStore } from '@skrr-ai/data-schemas';
+import { BaseCommand } from '../base-command';
+import { ApiFetchError, type ApiFetchOptions } from './api-fetch';
+export type MemoryMount = SharedMemoryMount;
+export type MemoryStore = SharedMemoryStore & {
+    mount?: SharedMemoryMount;
+};
+export declare const scopedMemoryFlags: {
+    agent: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    store: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    scope: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+};
+export declare const mutationFlags: {
+    'authorization-generation': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'expected-version': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'idempotency-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'privacy-approval': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    agent: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    store: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    scope: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+};
+export declare const versionedMutationFlags: {
+    'expected-version': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'authorization-generation': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'idempotency-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'privacy-approval': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    agent: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    store: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    scope: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+};
+type ScopedFlags = {
+    agent: string;
+    space?: string;
+    store?: string;
+    scope?: string;
+    json?: boolean;
+    'authorization-generation'?: number;
+    'expected-version'?: string;
+    'idempotency-key'?: string;
+    'privacy-approval'?: string;
+    'consent-approval'?: string;
+    'dry-run'?: boolean;
+};
+export declare function parseMemoryApiError(error: ApiFetchError): {
+    code: string;
+    message: string;
+    retryable: boolean;
+    details?: Record<string, unknown>;
+};
+export declare abstract class ScopedMemoryCommand extends BaseCommand {
+    protected endpoint(agentId: string, suffix?: string): string;
+    protected memoryApi<T>(agentId: string, suffix: string, options?: ApiFetchOptions): Promise<T>;
+    protected query(flags: ScopedFlags, extra?: Record<string, unknown>): string;
+    protected resolveStore(flags: ScopedFlags, { write }?: {
+        write?: boolean | undefined;
+    }): Promise<MemoryStore>;
+    protected mutation(operation: string, flags: ScopedFlags, input: Record<string, unknown>): Promise<unknown>;
+    protected print(value: unknown, json: boolean | undefined, line: string): void;
+}
+export {};

package/dist/lib/scoped-memory-command.js

@@ -0,0 +1,183 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopedMemoryCommand = exports.versionedMutationFlags = exports.mutationFlags = exports.scopedMemoryFlags = void 0;
+exports.parseMemoryApiError = parseMemoryApiError;
+const core_1 = require("@oclif/core");
+const data_schemas_1 = require("@skrr-ai/data-schemas");
+const node_crypto_1 = require("node:crypto");
+const base_command_1 = require("../base-command");
+const api_fetch_1 = require("./api-fetch");
+exports.scopedMemoryFlags = {
+    agent: core_1.Flags.string({ description: 'Act through this Agent', required: true }),
+    space: core_1.Flags.string({ description: 'Current Space context (required for Space scopes)' }),
+    store: core_1.Flags.string({
+        description: 'Exact Memory Store ID (exactly one of --store or --scope is required)',
+        exactlyOne: ['store', 'scope'],
+    }),
+    scope: core_1.Flags.string({
+        description: 'Store owner scope: agent:<id> or space:<id> (exactly one of --store or --scope is required)',
+        exactlyOne: ['store', 'scope'],
+    }),
+    json: core_1.Flags.boolean({ description: 'Output stable JSON' }),
+};
+exports.mutationFlags = {
+    ...exports.scopedMemoryFlags,
+    'authorization-generation': core_1.Flags.integer({
+        description: 'Expected Store authorization generation (defaults to mounted value)',
+    }),
+    'expected-version': core_1.Flags.string({ description: 'Expected current MemoryVersion ID' }),
+    'idempotency-key': core_1.Flags.string({ description: 'Stable retry key for this mutation' }),
+    'privacy-approval': core_1.Flags.string({
+        description: 'One-time Space PII approval ID from `memory approvals issue`',
+    }),
+    'dry-run': core_1.Flags.boolean({
+        description: 'Run server validation, roll back the transaction, and report the would-be result',
+    }),
+};
+exports.versionedMutationFlags = {
+    ...exports.mutationFlags,
+    'expected-version': core_1.Flags.string({
+        required: true,
+        description: 'Current MemoryVersion ID from memory topics show --json; required for optimistic CAS',
+    }),
+};
+const ERROR_EXITS = {
+    MEMORY_NOT_FOUND: 4,
+    MEMORY_VERSION_NOT_FOUND: 4,
+    MEMORY_STORE_NOT_FOUND: 4,
+    MEMORY_NOT_MOUNTED: 5,
+    MEMORY_STORE_READ_ONLY: 5,
+    MEMORY_PROMOTION_CONSENT_REQUIRED: 5,
+    MEMORY_APPROVAL_REQUIRED: 5,
+    MEMORY_APPROVAL_INVALID: 5,
+    MEMORY_SPACE_PROPOSAL_REQUIRED: 5,
+    MEMORY_ROLLOUT_DISABLED: 5,
+    MEMORY_VERSION_CONFLICT: 6,
+    MEMORY_STORE_CONFLICT: 6,
+    MEMORY_IDEMPOTENCY_CONFLICT: 6,
+    MEMORY_CURSOR_AHEAD: 6,
+    MEMORY_CURSOR_EXPIRED: 6,
+    MEMORY_AUTHORIZATION_STALE: 8,
+};
+function parseMemoryApiError(error) {
+    try {
+        const body = JSON.parse(error.body || '{}');
+        const details = {
+            ...(body.expectedVersionId ? { expectedVersionId: body.expectedVersionId } : {}),
+            ...(body.currentVersionId ? { currentVersionId: body.currentVersionId } : {}),
+            ...(body.expectedAuthorizationGeneration != null
+                ? { expectedAuthorizationGeneration: body.expectedAuthorizationGeneration }
+                : {}),
+            ...(body.currentAuthorizationGeneration != null
+                ? { currentAuthorizationGeneration: body.currentAuthorizationGeneration }
+                : {}),
+            ...(body.retryAfterRefresh === true ? { retryAfterRefresh: true } : {}),
+            ...(body.remedy ? { remedy: body.remedy } : {}),
+        };
+        return {
+            code: String(body.code || body.error || error.code || 'MEMORY_API_ERROR').toUpperCase(),
+            message: [body.message || error.message, body.remedy].filter(Boolean).join(' '),
+            retryable: body.retryable === true,
+            ...(Object.keys(details).length ? { details } : {}),
+        };
+    }
+    catch {
+        return {
+            code: error.code || 'MEMORY_API_ERROR',
+            message: error.message,
+            retryable: false,
+        };
+    }
+}
+class ScopedMemoryCommand extends base_command_1.BaseCommand {
+    endpoint(agentId, suffix = '') {
+        return `/api/agents/${encodeURIComponent(agentId)}/memories/workspace${suffix}`;
+    }
+    async memoryApi(agentId, suffix, options = {}) {
+        try {
+            return await (0, api_fetch_1.apiFetch)(this.endpoint(agentId, suffix), options);
+        }
+        catch (error) {
+            if (error instanceof api_fetch_1.ApiFetchError) {
+                const parsed = parseMemoryApiError(error);
+                this.failWithCliError({
+                    message: `${parsed.code}: ${parsed.message}`,
+                    code: parsed.code,
+                    status: error.status,
+                    exit: ERROR_EXITS[parsed.code] || (error.status === 404 ? 4 : error.status === 403 ? 5 : 2),
+                    retryable: parsed.retryable,
+                    details: parsed.details,
+                });
+            }
+            this.handleApiError(error);
+        }
+    }
+    query(flags, extra = {}) {
+        const params = new URLSearchParams();
+        if (flags.space)
+            params.set('spaceId', flags.space);
+        for (const [key, value] of Object.entries(extra)) {
+            if (value !== undefined && value !== null)
+                params.set(key, String(value));
+        }
+        const query = params.toString();
+        return query ? `?${query}` : '';
+    }
+    async resolveStore(flags, { write = false } = {}) {
+        if (flags.store) {
+            const rawStore = await this.memoryApi(flags.agent, `/stores/${encodeURIComponent(flags.store)}${this.query(flags)}`);
+            const store = data_schemas_1.MountedMemoryStoreSchema.parse(rawStore);
+            if (write && store.mount?.access !== 'read_write') {
+                this.error('MEMORY_STORE_READ_ONLY: selected Store is read-only', { exit: 5 });
+            }
+            return store;
+        }
+        if (!flags.scope) {
+            this.error('Pass exactly one of --store <id> or --scope agent:<id>|space:<id>.', { exit: 2 });
+        }
+        if (!/^(agent|space):[^:]+$/.test(flags.scope)) {
+            this.error('--scope must be agent:<id> or space:<id>.', { exit: 2 });
+        }
+        const [kind, id] = flags.scope.split(':', 2);
+        if (kind === 'space' && !flags.space) {
+            this.error(`MEMORY_SPACE_CONTEXT_REQUIRED: --space ${id} is required when selecting ${flags.scope}.`, { exit: 2, code: 'MEMORY_SPACE_CONTEXT_REQUIRED' });
+        }
+        const response = await this.memoryApi(flags.agent, `/stores${this.query(flags)}`);
+        const stores = response.stores.map((store) => data_schemas_1.MountedMemoryStoreSchema.parse(store));
+        const store = stores.find((candidate) => candidate.owner.kind === kind && candidate.owner.id === id);
+        if (!store)
+            this.error(`MEMORY_NOT_MOUNTED: ${flags.scope}`, { exit: 5 });
+        if (write && store.mount?.access !== 'read_write') {
+            this.error('MEMORY_STORE_READ_ONLY: selected Store is read-only', { exit: 5 });
+        }
+        return store;
+    }
+    async mutation(operation, flags, input) {
+        const store = await this.resolveStore(flags, { write: true });
+        const body = {
+            ...input,
+            ...(flags.space ? { spaceId: flags.space } : {}),
+            targetStoreId: store.id,
+            authorizationGeneration: flags['authorization-generation'] ??
+                store.mount?.authorizationGeneration ??
+                store.authorizationGeneration,
+            ...(flags['expected-version'] ? { expectedVersionId: flags['expected-version'] } : {}),
+            ...(flags['privacy-approval'] ? { privacyApprovalId: flags['privacy-approval'] } : {}),
+            ...(flags['consent-approval'] ? { consentApprovalId: flags['consent-approval'] } : {}),
+            idempotencyKey: flags['idempotency-key'] ||
+                (typeof input.idempotencyKey === 'string' ? input.idempotencyKey : undefined) ||
+                `cli:${operation}:${(0, node_crypto_1.randomUUID)()}`,
+        };
+        return this.memoryApi(flags.agent, `/mutations/${operation}`, {
+            method: 'POST',
+            body: flags['dry-run'] ? { ...body, dryRun: true } : body,
+        });
+    }
+    print(value, json, line) {
+        if (json)
+            this.log(JSON.stringify(value, null, 2));
+        else
+            this.log(line);
+    }
+}
+exports.ScopedMemoryCommand = ScopedMemoryCommand;

package/dist/lib/session-task-endpoints.d.ts

@@ -7,7 +7,7 @@
  * is no `task-read` and adding one to make the table tidy would name a resource
  * after an access mode.
  */
-export type SessionTaskOperation = 'completion' | 'move' | 'comment' | 'event' | 'read';
+export type SessionTaskOperation = 'completion' | 'move' | 'comment' | 'event' | 'update' | 'result' | 'resume' | 'resumeRead' | 'deliverable' | 'review' | 'assessment' | 'read';
 /** Path suffix per operation. Exported for the parity test, not for callers. */
 export declare const SESSION_TASK_PATH_SUFFIX: Record<SessionTaskOperation, string>;
 /**

package/dist/lib/session-task-endpoints.js

@@ -40,6 +40,13 @@ exports.SESSION_TASK_PATH_SUFFIX = {
     move: 'task-move',
     comment: 'task-comment',
     event: 'task-events',
+    update: 'task-updates',
+    result: 'task-result',
+    resume: 'task-resume-point',
+    resumeRead: 'task-resume-context',
+    deliverable: 'task-deliverables',
+    review: 'task-review',
+    assessment: 'task-expectation-assessment',
     read: 'task',
 };
 /**

package/dist/lib/sky-code-broker.d.ts

@@ -90,6 +90,23 @@ export interface ManagedSessionHandle {
     clientModelId?: string;
     authorizedUsd: number;
     leaseExpiresInMs: number;
+    /**
+     * The other TWO clocks (OSK-7729).
+     *
+     * `docs/architecture/managed-inference-execution-shapes-2026-08-12.md` reports
+     * three and is explicit about why: none is derivable from the others. The
+     * admission window is not the renewal window, and neither tells you the
+     * ceiling. This module already HELD all three and exposed one, so no surface
+     * could show the human whose session they bound when it gets cut off — the
+     * first time the ceiling was learnable was when it fired.
+     *
+     * Both optional because both are: a server that predates OSK-3924/OSK-3937
+     * reports neither, and an absent clock must read as absent rather than as
+     * zero.
+     */
+    renewalWindowMs?: number;
+    /** The immutable ceiling as an ABSOLUTE instant — it decays while it waits. */
+    ceilingAtMs?: number;
     /**
      * Stop the broker AND hand the lease back.
      *
@@ -154,6 +171,36 @@ export declare function acquireManagedSession(input?: AcquireManagedSessionInput
  * effects.
  */
 export declare function hasLocalCredential(): boolean;
+/**
+ * The three clocks a supervised session runs on, said once, before the first turn.
+ *
+ * OSK-7729 — the supervised shape's defining property is that a human is
+ * present and steering, and the human was given no way to see the deadline they
+ * were steering against. `skrr code --help`, `skrr code run --help`,
+ * `skrr code doctor` and `skrr daemon status` mention no lease, no renewal and
+ * no ceiling; the first moment the ceiling was learnable was when it fired.
+ *
+ * There are three because none is derivable from the others
+ * (`docs/architecture/managed-inference-execution-shapes-2026-08-12.md`):
+ *
+ *   - the CURRENT lease window, which is the admission window and is short,
+ *   - the RENEWAL window every subsequent lease gets while the human is present,
+ *   - the IMMUTABLE ceiling fixed at admission, which no amount of renewing moves.
+ *
+ * Reported as durations rather than instants for the OSK-3914 reason — the
+ * server's clock is the authority — with the ceiling ALSO given as a local time,
+ * because "in 3h" is what you plan around and "at 12:41" is what you recognize
+ * when it happens.
+ *
+ * An unreported clock is stated as unreported. A server predating OSK-3924 /
+ * OSK-3937 sends neither, and printing a silent 0 or omitting the clause would
+ * both read as "there is no ceiling", which is a claim this CLI cannot make.
+ */
+export declare function managedLeaseClockLine(clocks: {
+    leaseExpiresInMs: number;
+    renewalWindowMs?: number;
+    ceilingAtMs?: number;
+}, now?: number): string;
 export interface ManagedEngineHooks {
     /** `execEngine`'s `prepare`: the broker env, or `{}` when this run is BYOK. */
     prepare: () => Promise<Record<string, string>>;

package/dist/lib/sky-code-broker.js

@@ -56,6 +56,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ManagedAcquisitionError = void 0;
 exports.acquireManagedSession = acquireManagedSession;
 exports.hasLocalCredential = hasLocalCredential;
+exports.managedLeaseClockLine = managedLeaseClockLine;
 exports.createManagedEngineHooks = createManagedEngineHooks;
 exports.managedRenewalStoppedLine = managedRenewalStoppedLine;
 exports.managedFallbackLine = managedFallbackLine;
@@ -71,6 +72,7 @@ const device_id_1 = require("./device-id");
 const sky_code_1 = require("./sky-code");
 const sky_code_agent_1 = require("./sky-code-agent");
 const sky_code_managed_1 = require("./sky-code-managed");
+const task_execution_1 = require("./task-execution");
 /**
  * Harness selections the POLICY resolves, mirroring the server's own set.
  *
@@ -430,6 +432,8 @@ async function acquireManagedSession(input = {}, deps = {}) {
         ...(session.clientModelId ? { clientModelId: session.clientModelId } : {}),
         authorizedUsd: lease.authorizedUsd,
         leaseExpiresInMs: lease.leaseExpiresInMs,
+        ...(lease.renewalWindowMs !== undefined ? { renewalWindowMs: lease.renewalWindowMs } : {}),
+        ...(lease.ceilingAtMs !== undefined ? { ceilingAtMs: lease.ceilingAtMs } : {}),
         stop: async (reason = 'cli_session_ended') => {
             try {
                 // The broker FIRST, because `stop()` stops the renewal loop: releasing
@@ -874,6 +878,51 @@ function describe(err) {
     const text = err instanceof Error ? err.message : String(err);
     return text.trim() || 'unknown error';
 }
+/**
+ * The three clocks a supervised session runs on, said once, before the first turn.
+ *
+ * OSK-7729 — the supervised shape's defining property is that a human is
+ * present and steering, and the human was given no way to see the deadline they
+ * were steering against. `skrr code --help`, `skrr code run --help`,
+ * `skrr code doctor` and `skrr daemon status` mention no lease, no renewal and
+ * no ceiling; the first moment the ceiling was learnable was when it fired.
+ *
+ * There are three because none is derivable from the others
+ * (`docs/architecture/managed-inference-execution-shapes-2026-08-12.md`):
+ *
+ *   - the CURRENT lease window, which is the admission window and is short,
+ *   - the RENEWAL window every subsequent lease gets while the human is present,
+ *   - the IMMUTABLE ceiling fixed at admission, which no amount of renewing moves.
+ *
+ * Reported as durations rather than instants for the OSK-3914 reason — the
+ * server's clock is the authority — with the ceiling ALSO given as a local time,
+ * because "in 3h" is what you plan around and "at 12:41" is what you recognize
+ * when it happens.
+ *
+ * An unreported clock is stated as unreported. A server predating OSK-3924 /
+ * OSK-3937 sends neither, and printing a silent 0 or omitting the clause would
+ * both read as "there is no ceiling", which is a claim this CLI cannot make.
+ */
+function managedLeaseClockLine(clocks, now = Date.now()) {
+    const parts = [`this lease runs ${(0, task_execution_1.formatDurationMs)(clocks.leaseExpiresInMs)}`];
+    parts.push(clocks.renewalWindowMs !== undefined
+        ? `renews every ${(0, task_execution_1.formatDurationMs)(clocks.renewalWindowMs)} while you are here`
+        : 'renews on a heartbeat while you are here');
+    if (clocks.ceilingAtMs !== undefined) {
+        const remainingMs = Math.max(0, clocks.ceilingAtMs - now);
+        parts.push(`ends for good in ${(0, task_execution_1.formatDurationMs)(remainingMs)} (${localClock(clocks.ceilingAtMs)})`);
+    }
+    else {
+        parts.push('this server reports no ceiling');
+    }
+    return `Managed session: ${parts.join(' \u00b7 ')}.`;
+}
+function localClock(atMs) {
+    const at = new Date(atMs);
+    const hh = String(at.getHours()).padStart(2, '0');
+    const mm = String(at.getMinutes()).padStart(2, '0');
+    return `${hh}:${mm} local`;
+}
 /**
  * What is ACTUALLY about to happen instead — which is not always BYOK.
  *
@@ -990,6 +1039,7 @@ function createManagedEngineHooks(input) {
                             log(line);
                     },
                 });
+                log(managedLeaseClockLine(handle));
                 return handle.env;
             }
             catch (err) {

package/dist/lib/sky-code-doctor.js

@@ -509,7 +509,16 @@ function managedInferenceCheck(env) {
     return {
         name: 'managed-inference',
         status: posture.status,
-        detail: posture.detail,
+        detail: posture.status === 'ok'
+            ? // OSK-7729 — a supervised session is bounded by three clocks and this
+                // line used to imply none. `doctor` is structural by design and cannot
+                // know their VALUES (they are fixed at admission, and it makes no API
+                // call), but it can stop the absence of any mention reading as the
+                // absence of a deadline, and say where the numbers appear.
+                `${posture.detail}. A session reports three clocks when it starts — the current ` +
+                    'lease, the renewal window, and the immutable ceiling — and none is derivable ' +
+                    'from the others'
+            : posture.detail,
         ...(posture.remedy ? { remedy: posture.remedy } : {}),
     };
 }

package/dist/lib/task-artifact-flags.d.ts

@@ -0,0 +1,2 @@
+/** Merge the current spelling with the compatibility alias without duplicating a reference. */
+export declare function mergeTaskArtifactFlags(deliverables: string[] | undefined, artifacts: string[] | undefined): string[];

package/dist/lib/task-artifact-flags.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeTaskArtifactFlags = mergeTaskArtifactFlags;
+/** Merge the current spelling with the compatibility alias without duplicating a reference. */
+function mergeTaskArtifactFlags(deliverables, artifacts) {
+    return [...new Set([...(deliverables ?? []), ...(artifacts ?? [])])];
+}

package/dist/lib/task-execution.d.ts

@@ -3,9 +3,8 @@ import { type TaskRecord } from './tasks';
  * Statuses at which an execution is OVER — nothing further will move the task
  * without new input.
  *
- * `in_review` is one of them (OSK-2064). The required-output policy is
- * default-ON, so the platform now PARKS a run that ended without an approved
- * TASK_OUTPUT at `in_review` and releases the checkout: the run is finished and
+ * `in_review` is one of them. The platform parks a Run whose Result still
+ * needs independent Review at `in_review` and releases the checkout: the Run is finished and
  * a human has to close the loop. It was in neither set, so `skrr tasks wait`
  * (default `--until done`, default `--fail-on failed,blocked,cancelled`) polled
  * a task that could never satisfy either condition and never returned — the
@@ -14,8 +13,8 @@ import { type TaskRecord } from './tasks';
 export declare const TERMINAL_STATUSES: Set<string>;
 /**
  * Terminal statuses that are NOT a success, i.e. the wait ends non-zero.
- * `in_review` belongs here for the same reason: a parked run did not produce
- * the deliverable, and a caller waiting for `done` needs to be told so rather
+ * `in_review` belongs here for the same reason: a parked Run has not satisfied
+ * the Task's close policy, and a caller waiting for `done` needs to be told so rather
  * than told nothing. Overridable per command via `--fail-on`.
  */
 export declare const DEFAULT_FAIL_STATUSES: Set<string>;

package/dist/lib/task-execution.js

@@ -32,9 +32,8 @@ const html_text_1 = require("./html-text");
  * Statuses at which an execution is OVER — nothing further will move the task
  * without new input.
  *
- * `in_review` is one of them (OSK-2064). The required-output policy is
- * default-ON, so the platform now PARKS a run that ended without an approved
- * TASK_OUTPUT at `in_review` and releases the checkout: the run is finished and
+ * `in_review` is one of them. The platform parks a Run whose Result still
+ * needs independent Review at `in_review` and releases the checkout: the Run is finished and
  * a human has to close the loop. It was in neither set, so `skrr tasks wait`
  * (default `--until done`, default `--fail-on failed,blocked,cancelled`) polled
  * a task that could never satisfy either condition and never returned — the
@@ -50,8 +49,8 @@ exports.TERMINAL_STATUSES = new Set([
 ]);
 /**
  * Terminal statuses that are NOT a success, i.e. the wait ends non-zero.
- * `in_review` belongs here for the same reason: a parked run did not produce
- * the deliverable, and a caller waiting for `done` needs to be told so rather
+ * `in_review` belongs here for the same reason: a parked Run has not satisfied
+ * the Task's close policy, and a caller waiting for `done` needs to be told so rather
  * than told nothing. Overridable per command via `--fail-on`.
  */
 exports.DEFAULT_FAIL_STATUSES = new Set(['failed', 'blocked', 'cancelled', 'in_review']);

package/dist/lib/task-extras.d.ts

@@ -23,11 +23,7 @@ export declare const taskLookupApi: {
      */
     followUp: (id: string, body: Json) => Promise<Json>;
     cancelFollowUp: (id: string) => Promise<Json>;
-    /**
-     * Atomic completion: moves the task AND writes the TASK_OUTPUT comment in one
-     * request, so a crash between the two cannot leave a done task with no record
-     * of what it produced.
-     */
+    /** Result-first closeout: submit one immutable Result, then project status. */
     complete: (id: string, body: Json) => Promise<Json>;
     treePosition: (id: string, body: Json) => Promise<Json>;
     createAndStart: (body: Json) => Promise<Json>;