@skrr-ai/cli 0.1.23 → 0.1.25

package/dist/lib/dedicated-machines.d.ts

@@ -0,0 +1,66 @@
+import { type HarnessLease } from './harnesses';
+export type DedicatedLeaseAction = 'start' | 'stop' | 'restart' | 'snapshot' | 'health-check';
+export declare const DEDICATED_LEASE_ACTIONS: DedicatedLeaseAction[];
+export interface DedicatedRuntimeScope {
+    workspaceId?: string;
+}
+export interface CreateDedicatedRuntimeInput extends DedicatedRuntimeScope {
+    requestId: string;
+    displayName: string;
+    sizePreset: string;
+    regionClass?: string;
+    storageGb?: number;
+    retentionClass?: string;
+    backupProfile?: 'crash-consistent' | 'application-consistent';
+    monthlySpendingLimitCents: number;
+    repositoryRef?: string;
+}
+export interface DedicatedRuntimeResponse {
+    lease?: HarnessLease;
+}
+/**
+ * Flags in, request body out — and the point of it being a function is the
+ * OMISSION.
+ *
+ * A field the user did not set must be ABSENT from the body, not present as
+ * `undefined`, because the server reaches its own default through
+ * `input.x || <default>`. Restating those defaults on the client looks
+ * harmless and is not: `--storage-gb` shipped with a client default of 100
+ * against a product default of 50, so a user who never chose a disk size was
+ * billed for twice the documented one and `workspaceDefaultGb` was unreachable
+ * through the CLI. The three neighbouring flags happened to agree, which only
+ * means the same bug was invisible in them.
+ */
+export declare function dedicatedRuntimeCreateInput(input: {
+    requestId: string;
+    displayName: string;
+    sizePreset: string;
+    monthlySpendingLimitCents: number;
+    regionClass?: string;
+    storageGb?: number;
+    retentionClass?: string;
+    backupProfile?: string;
+    workspaceId?: string;
+}): CreateDedicatedRuntimeInput;
+export declare function createDedicatedRuntime(input: CreateDedicatedRuntimeInput): Promise<DedicatedRuntimeResponse>;
+export declare function listDedicatedRuntimes(options?: {
+    limit?: number;
+    state?: string;
+}): Promise<{
+    leases?: HarnessLease[];
+}>;
+export declare function getDedicatedRuntime(leaseId: string): Promise<DedicatedRuntimeResponse>;
+export declare function performDedicatedLeaseAction(leaseId: string, action: DedicatedLeaseAction): Promise<DedicatedRuntimeResponse>;
+export declare function growDedicatedRuntime(leaseId: string, storageGb: number, options?: {
+    requestId?: string;
+}): Promise<DedicatedRuntimeResponse>;
+export declare function closeDedicatedRuntimeIncidentHold(leaseId: string, options?: {
+    requestId?: string;
+}): Promise<DedicatedRuntimeResponse>;
+export declare function destroyDedicatedRuntime(leaseId: string, options?: {
+    retentionIntent?: 'retain' | 'purge';
+}): Promise<DedicatedRuntimeResponse>;
+export declare function dedicatedLeaseId(lease: HarnessLease | undefined | null): string;
+export declare function dedicatedLeaseState(lease: HarnessLease | undefined | null): string;
+export declare function dedicatedLeaseDisplayName(lease: HarnessLease | undefined | null): string;
+export declare function formatDedicatedRuntimeApiError(err: unknown): string | null;

package/dist/lib/dedicated-machines.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEDICATED_LEASE_ACTIONS = void 0;
+exports.dedicatedRuntimeCreateInput = dedicatedRuntimeCreateInput;
+exports.createDedicatedRuntime = createDedicatedRuntime;
+exports.listDedicatedRuntimes = listDedicatedRuntimes;
+exports.getDedicatedRuntime = getDedicatedRuntime;
+exports.performDedicatedLeaseAction = performDedicatedLeaseAction;
+exports.growDedicatedRuntime = growDedicatedRuntime;
+exports.closeDedicatedRuntimeIncidentHold = closeDedicatedRuntimeIncidentHold;
+exports.destroyDedicatedRuntime = destroyDedicatedRuntime;
+exports.dedicatedLeaseId = dedicatedLeaseId;
+exports.dedicatedLeaseState = dedicatedLeaseState;
+exports.dedicatedLeaseDisplayName = dedicatedLeaseDisplayName;
+exports.formatDedicatedRuntimeApiError = formatDedicatedRuntimeApiError;
+const api_fetch_1 = require("./api-fetch");
+const harnesses_1 = require("./harnesses");
+exports.DEDICATED_LEASE_ACTIONS = [
+    'start',
+    'stop',
+    'restart',
+    'snapshot',
+    'health-check',
+];
+/**
+ * Flags in, request body out — and the point of it being a function is the
+ * OMISSION.
+ *
+ * A field the user did not set must be ABSENT from the body, not present as
+ * `undefined`, because the server reaches its own default through
+ * `input.x || <default>`. Restating those defaults on the client looks
+ * harmless and is not: `--storage-gb` shipped with a client default of 100
+ * against a product default of 50, so a user who never chose a disk size was
+ * billed for twice the documented one and `workspaceDefaultGb` was unreachable
+ * through the CLI. The three neighbouring flags happened to agree, which only
+ * means the same bug was invisible in them.
+ */
+function dedicatedRuntimeCreateInput(input) {
+    return {
+        requestId: input.requestId,
+        displayName: input.displayName,
+        sizePreset: input.sizePreset,
+        monthlySpendingLimitCents: input.monthlySpendingLimitCents,
+        ...(input.regionClass ? { regionClass: input.regionClass } : {}),
+        ...(input.storageGb !== undefined ? { storageGb: input.storageGb } : {}),
+        ...(input.retentionClass ? { retentionClass: input.retentionClass } : {}),
+        ...(input.backupProfile
+            ? { backupProfile: input.backupProfile }
+            : {}),
+        ...(input.workspaceId ? { workspaceId: input.workspaceId } : {}),
+    };
+}
+async function createDedicatedRuntime(input) {
+    const { requestId, workspaceId, ...body } = input;
+    if (workspaceId) {
+        return (0, api_fetch_1.apiFetch)(`/api/machines/dedicated?workspaceId=${encodeURIComponent(workspaceId)}`, {
+            method: 'POST',
+            body,
+            headers: { 'Idempotency-Key': requestId },
+        });
+    }
+    return (0, api_fetch_1.apiFetch)('/api/machines/dedicated', {
+        method: 'POST',
+        body,
+        headers: { 'Idempotency-Key': requestId },
+    });
+}
+async function listDedicatedRuntimes(options = {}) {
+    return (0, harnesses_1.listHarnessLeases)({
+        ...options,
+        machineProduct: 'dedicated-machine',
+    });
+}
+async function getDedicatedRuntime(leaseId) {
+    return (0, harnesses_1.getHarnessLease)(leaseId);
+}
+async function performDedicatedLeaseAction(leaseId, action) {
+    return (0, harnesses_1.performHarnessLeaseAction)(leaseId, action);
+}
+async function growDedicatedRuntime(leaseId, storageGb, options = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/dedicated/${encodeURIComponent(leaseId)}/storage`, {
+        method: 'POST',
+        body: { storageGb },
+        ...(options.requestId ? { headers: { 'Idempotency-Key': options.requestId } } : {}),
+    });
+}
+async function closeDedicatedRuntimeIncidentHold(leaseId, options = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/dedicated/${encodeURIComponent(leaseId)}/incident-hold/close`, {
+        method: 'POST',
+        body: {},
+        ...(options.requestId ? { headers: { 'Idempotency-Key': options.requestId } } : {}),
+    });
+}
+async function destroyDedicatedRuntime(leaseId, options = {}) {
+    const query = options.retentionIntent
+        ? `?retentionIntent=${encodeURIComponent(options.retentionIntent)}`
+        : '';
+    return (0, api_fetch_1.apiFetch)(`/api/machines/leases/${encodeURIComponent(leaseId)}${query}`, { method: 'DELETE' });
+}
+function dedicatedLeaseId(lease) {
+    return String(lease?.id ?? '');
+}
+function dedicatedLeaseState(lease) {
+    return String(lease?.state ?? 'unknown');
+}
+function dedicatedLeaseDisplayName(lease) {
+    return lease?.displayName ? String(lease.displayName) : '-';
+}
+/**
+ * Dedicated Runtime commands are unusually likely to meet a server that has
+ * never heard of them.
+ *
+ * The CLI ships independently of the API (`@skrr-ai/cli` on npm), so "CLI newer
+ * than the deployed server" is the normal state for anyone who runs
+ * `npm update`, and this feature widened that window: twelve commands arrived at
+ * once, and three of them call endpoints that land in a later deploy. The server
+ * redacts an unknown-route 404 to "An unexpected error occurred.", so every one
+ * of those users got eight words that cannot be told apart from a wrong lease
+ * id or a broken server.
+ *
+ * A 404 carrying no product `code` is that case. Naming it is the difference
+ * between "wait for the deploy" and "open a bug".
+ */
+function describeMissingEndpoint(err) {
+    if (err.status !== 404) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(err.body || '');
+        // A product code means the server DID handle the route and refused on the
+        // merits — that message is the useful one and must not be overwritten.
+        if (parsed.code) {
+            return null;
+        }
+    }
+    catch {
+        // Unparseable body: no product code by definition.
+    }
+    return ('This server does not have that Dedicated Runtime endpoint. Your CLI is probably ahead of ' +
+        'the deployment — `skrr context` names the server it is talking to, and `skrr machines ' +
+        'dedicated list` will still work if the feature is deployed at all.');
+}
+function formatDedicatedRuntimeApiError(err) {
+    if (!(err instanceof api_fetch_1.ApiFetchError) || !err.body) {
+        return null;
+    }
+    if (err.status === 401) {
+        return null;
+    }
+    const missingEndpoint = describeMissingEndpoint(err);
+    if (missingEndpoint) {
+        return missingEndpoint;
+    }
+    try {
+        const parsed = JSON.parse(err.body);
+        return parsed.message || parsed.error || parsed.code || null;
+    }
+    catch {
+        return err.body.trim() || null;
+    }
+}

package/dist/lib/harnesses.d.ts

@@ -97,6 +97,11 @@ export interface HarnessLease {
         assignable?: boolean;
         reasons?: string[];
     } & Record<string, unknown>;
+    storage?: {
+        retentionClass?: string;
+        lastBackupAt?: string;
+        backupProfile?: string;
+    };
     createdAt?: string;
     updatedAt?: string;
 }

package/dist/lib/harnesses.js

@@ -177,8 +177,11 @@ async function listHarnessLeases(options = {}) {
         query.set('state', options.state);
     if (options.machineProduct)
         query.set('machineProduct', options.machineProduct);
-    const suffix = query.toString() ? `?${query.toString()}` : '';
-    return (0, api_fetch_1.apiFetch)(`/api/machines/leases${suffix}`);
+    const encoded = query.toString();
+    if (encoded) {
+        return (0, api_fetch_1.apiFetch)(`/api/machines/leases?${encoded}`);
+    }
+    return (0, api_fetch_1.apiFetch)('/api/machines/leases');
 }
 async function getHarnessLease(leaseId) {
     return (0, api_fetch_1.apiFetch)(`/api/machines/leases/${encodeURIComponent(leaseId)}`);

package/dist/lib/idempotency-scope.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A process running one autonomous ACTION binds every write to it, so the same
+ * action re-run in a new process converges on the server instead of writing
+ * twice. The rule itself lives in `@skrr-ai/data-provider` (`idempotency.ts`),
+ * shared with the web client; the CLI only says which action it is.
+ *
+ * Bound by both transports — the `dataService` adapter and `apiFetch` — because
+ * either may be the first to write.
+ */
+export declare function bindAutonomousIdempotencyScope(env?: NodeJS.ProcessEnv): void;

package/dist/lib/idempotency-scope.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bindAutonomousIdempotencyScope = bindAutonomousIdempotencyScope;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * A process running one autonomous ACTION binds every write to it, so the same
+ * action re-run in a new process converges on the server instead of writing
+ * twice. The rule itself lives in `@skrr-ai/data-provider` (`idempotency.ts`),
+ * shared with the web client; the CLI only says which action it is.
+ *
+ * Bound by both transports — the `dataService` adapter and `apiFetch` — because
+ * either may be the first to write.
+ */
+function bindAutonomousIdempotencyScope(env = process.env) {
+    (0, data_provider_1.setIdempotencyScope)(env.OVERSKY_AUTONOMOUS_ACTION_KEY?.trim() || null);
+}

package/dist/lib/node-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { HttpAdapter } from '@skrr-ai/data-provider';
+import { type HttpAdapter } from '@skrr-ai/data-provider';
 import { type ResolvedCredential } from '@skrr-ai/auth-core';
 import './auth-core-init';
 /**

package/dist/lib/node-adapter.js

@@ -5,7 +5,8 @@ exports.clearAdapterCredentialOverride = clearAdapterCredentialOverride;
 exports.getAdapterCredentialOverride = getAdapterCredentialOverride;
 exports.createNodeAdapter = createNodeAdapter;
 exports.__recomputeCredentialForTest = __recomputeCredentialForTest;
-const node_crypto_1 = require("node:crypto");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const idempotency_scope_1 = require("./idempotency-scope");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const config_1 = require("./config");
 const auth_storage_1 = require("./auth-storage");
@@ -72,6 +73,7 @@ function currentCredential() {
 }
 function createNodeAdapter(opts = {}) {
     const { onTokenRefresh, onAuthFailure } = opts;
+    (0, idempotency_scope_1.bindAutonomousIdempotencyScope)();
     // In-process single-flight: collapses N parallel 401s into one refresh
     // round-trip. Cross-process serialization happens inside refresh.ts.
     let refreshInFlight = null;
@@ -157,15 +159,6 @@ function createNodeAdapter(opts = {}) {
             }
         }
         const finalUrl = appendQuery(resolveUrl(url), options?.params);
-        const actionKey = process.env.OVERSKY_AUTONOMOUS_ACTION_KEY?.trim();
-        const hasIdempotencyKey = Object.keys(headers).some((key) => key.toLowerCase() === 'x-idempotency-key');
-        if (actionKey && method !== 'GET' && !isFormData && !hasIdempotencyKey) {
-            const requestUrl = new URL(finalUrl);
-            const scope = `${actionKey}\u001f${method}\u001f${requestUrl.pathname}${requestUrl.search}\u001f${typeof finalBody === 'string' ? finalBody : ''}`;
-            headers['X-Idempotency-Key'] = `autonomous:${(0, node_crypto_1.createHash)('sha256')
-                .update(scope)
-                .digest('hex')}`;
-        }
         return fetch(finalUrl, { method, headers, body: finalBody });
     }
     /**
@@ -291,6 +284,15 @@ function createNodeAdapter(opts = {}) {
         return true;
     }
     async function request(method, url, body, options, isFormData = false) {
+        // Writes that arrive through `request.ts` already carry a key. A direct
+        // adapter call gets one by the same shared rule, chosen HERE, once, so the
+        // 401-refresh retries below resend the same key rather than a new one.
+        if (method !== 'GET' && !isFormData && !(0, data_provider_1.hasIdempotencyKey)(options?.headers)) {
+            options = {
+                ...(options ?? {}),
+                headers: (0, data_provider_1.withIdempotencyKey)(options?.headers, { method, url, body }),
+            };
+        }
         let res = await rawRequest(method, url, body, options, isFormData);
         // Never retry auth endpoints themselves — prevents refresh recursion
         // and lets login/logout/refresh surface their real errors.

package/dist/lib/task-legacy.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Tell a reader when an empty canonical view means "nothing happened" and when
+ * it means "this Task predates the records this view reads".
+ *
+ * Canonical Task Model v1 shipped with an explicit decision not to migrate
+ * legacy data, so a Task created before 2026-09-11 has no TaskUpdate, TaskResult
+ * or TaskActivityEvent rows — its history is in `activityLog`, `TaskWorkEvent`
+ * and TASK_OUTPUT comments. Every canonical read surface therefore answered
+ * "No activity." / "Result: none submitted" / nothing at all for Tasks with
+ * years of history, stating absence as fact.
+ *
+ * The marker is that `specVersion` is ABSENT — a field the caller can only
+ * notice by its own missingness, which is why this belongs in one helper rather
+ * than in each command.
+ */
+export declare function isLegacyTask(taskId: string): Promise<boolean>;
+/**
+ * The sentence to print instead of claiming emptiness. `surface` names what the
+ * reader just asked for, so the message says which view is empty rather than
+ * implying the Task is.
+ */
+export declare function legacyEmptyStateMessage(surface: string): string;
+/** Render the right empty state for a canonical view that came back empty. */
+export declare function emptyCanonicalView(taskId: string, surface: string): Promise<string>;

package/dist/lib/task-legacy.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLegacyTask = isLegacyTask;
+exports.legacyEmptyStateMessage = legacyEmptyStateMessage;
+exports.emptyCanonicalView = emptyCanonicalView;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * Tell a reader when an empty canonical view means "nothing happened" and when
+ * it means "this Task predates the records this view reads".
+ *
+ * Canonical Task Model v1 shipped with an explicit decision not to migrate
+ * legacy data, so a Task created before 2026-09-11 has no TaskUpdate, TaskResult
+ * or TaskActivityEvent rows — its history is in `activityLog`, `TaskWorkEvent`
+ * and TASK_OUTPUT comments. Every canonical read surface therefore answered
+ * "No activity." / "Result: none submitted" / nothing at all for Tasks with
+ * years of history, stating absence as fact.
+ *
+ * The marker is that `specVersion` is ABSENT — a field the caller can only
+ * notice by its own missingness, which is why this belongs in one helper rather
+ * than in each command.
+ */
+async function isLegacyTask(taskId) {
+    try {
+        const task = (await data_provider_1.dataService.getTask(taskId));
+        return task !== undefined && task !== null && task.specVersion === undefined;
+    }
+    catch {
+        // Never turn a diagnostic into a failure: the caller is rendering an empty
+        // state, not making a decision.
+        return false;
+    }
+}
+/**
+ * The sentence to print instead of claiming emptiness. `surface` names what the
+ * reader just asked for, so the message says which view is empty rather than
+ * implying the Task is.
+ */
+function legacyEmptyStateMessage(surface) {
+    return (`No ${surface} recorded under the canonical Task model.\n` +
+        'This Task predates it, so its history was never migrated — read it with ' +
+        '`skrr tasks show`, `skrr tasks comments list`, or `skrr tasks transcript`.');
+}
+/** Render the right empty state for a canonical view that came back empty. */
+async function emptyCanonicalView(taskId, surface) {
+    return (await isLegacyTask(taskId))
+        ? legacyEmptyStateMessage(surface)
+        : `No ${surface} recorded yet.`;
+}

package/dist/lib/tasks.d.ts

@@ -59,6 +59,7 @@ export type TaskCreateFlagValues = {
         description?: string;
         presetKey?: string;
     }>;
+    'review-policy'?: string;
     'start-date'?: string;
     'due-date'?: string;
     estimate?: number;
@@ -98,6 +99,37 @@ export declare function parseExpectations(specs: string[] | undefined): {
     error: string;
 };
 export declare const EXPECT_FLAG_HELP: string;
+/**
+ * What `--default-expect` means, as a value rather than a side effect.
+ *
+ * `clear` REMOVES the Space default, and it has to exist. Every Expectation gates
+ * closure and a Space default is inherited by every task created afterwards, so a
+ * default set by mistake — or one that outlived its project — gated the whole
+ * board with no way back. `tasks update --expect` already had this sentinel; the
+ * Space flag, the one the design calls "configured once and then holds", did not.
+ * The only exit was to waive the expectation on every task, which writes `dropped`
+ * into the ledger about a requirement that was never real. That is a false record,
+ * not a workaround.
+ *
+ * `null` rather than `[]`: the route declares the field `.nullable()` and the API
+ * turns null into an `$unset`, so the Space stops carrying a default instead of
+ * carrying an empty one. `undefined` means the flag was not passed and the
+ * existing default must be left exactly as it is.
+ *
+ * `clear` must be the SOLE value. Combined with an expectation it is two
+ * contradictory instructions, and honouring one of them silently is how a caller
+ * ends up with a contract they did not ask for.
+ *
+ * Extracted so the three outcomes can be tested without a command harness — the
+ * bug being fixed was in this decision, not in the HTTP call after it.
+ */
+export declare function resolveDefaultExpectations(values: string[] | undefined): {
+    ok: true;
+    value: Array<Record<string, unknown>> | null | undefined;
+} | {
+    ok: false;
+    error: string;
+};
 /**
  * Parse a deliverable coordinate. Also delegated — `:` and `@` and now `/` all
  * mean different things, and a second implementation of that grammar is how the

package/dist/lib/tasks.js

@@ -6,6 +6,7 @@ exports.taskUpdateMutationGuard = taskUpdateMutationGuard;
 exports.executionIsolationFromWorktreeFlag = executionIsolationFromWorktreeFlag;
 exports.parseExpectation = parseExpectation;
 exports.parseExpectations = parseExpectations;
+exports.resolveDefaultExpectations = resolveDefaultExpectations;
 exports.parseDeliverableCoordinate = parseDeliverableCoordinate;
 exports.buildTaskCreatePayload = buildTaskCreatePayload;
 exports.boundSessionAgentId = boundSessionAgentId;
@@ -156,10 +157,54 @@ const kindsForHelp = Array.isArray(data_provider_1.TASK_OUTCOME_KINDS)
 const presetsForHelp = Array.isArray(data_provider_1.EXPECTATION_PRESETS)
     ? data_provider_1.EXPECTATION_PRESETS.map((preset) => `@${preset.key}`).join(', ')
     : '@merged-to-main, @pdf-delivered';
-exports.EXPECT_FLAG_HELP = 'What this task must produce, as <kind>[/<format>][:<target>] or @<preset> — ' +
+exports.EXPECT_FLAG_HELP = 'What this task must produce. Each one GATES closure: the Task cannot enter a ' +
+    'completed state until every Expectation is assessed met or waived ' +
+    '(`tasks expectations assess`). Form: <kind>[/<format>][:<target>] or @<preset> — ' +
     `e.g. 'code:origin/main', 'file/pdf:Drive/Reports', '@merged-to-main'. ` +
     `Kinds: ${kindsForHelp}. Presets: ${presetsForHelp}. ` +
     'Anything else is stored as a plain-language expectation a person settles. Repeatable.';
+/**
+ * What `--default-expect` means, as a value rather than a side effect.
+ *
+ * `clear` REMOVES the Space default, and it has to exist. Every Expectation gates
+ * closure and a Space default is inherited by every task created afterwards, so a
+ * default set by mistake — or one that outlived its project — gated the whole
+ * board with no way back. `tasks update --expect` already had this sentinel; the
+ * Space flag, the one the design calls "configured once and then holds", did not.
+ * The only exit was to waive the expectation on every task, which writes `dropped`
+ * into the ledger about a requirement that was never real. That is a false record,
+ * not a workaround.
+ *
+ * `null` rather than `[]`: the route declares the field `.nullable()` and the API
+ * turns null into an `$unset`, so the Space stops carrying a default instead of
+ * carrying an empty one. `undefined` means the flag was not passed and the
+ * existing default must be left exactly as it is.
+ *
+ * `clear` must be the SOLE value. Combined with an expectation it is two
+ * contradictory instructions, and honouring one of them silently is how a caller
+ * ends up with a contract they did not ask for.
+ *
+ * Extracted so the three outcomes can be tested without a command harness — the
+ * bug being fixed was in this decision, not in the HTTP call after it.
+ */
+function resolveDefaultExpectations(values) {
+    if (values === undefined || values.length === 0)
+        return { ok: true, value: undefined };
+    const clears = values.filter((value) => value.trim().toLowerCase() === 'clear');
+    if (clears.length > 0 && values.length > 1) {
+        return {
+            ok: false,
+            error: '--default-expect clear removes the space default and cannot be combined with an ' +
+                'expectation. Run it alone, then set the new default.',
+        };
+    }
+    if (clears.length > 0)
+        return { ok: true, value: null };
+    const parsed = parseExpectations(values);
+    if (!parsed.ok)
+        return { ok: false, error: parsed.error };
+    return { ok: true, value: parsed.value };
+}
 /**
  * Parse a deliverable coordinate. Also delegated — `:` and `@` and now `/` all
  * mean different things, and a second implementation of that grammar is how the
@@ -214,6 +259,7 @@ function buildTaskCreatePayload(body, flags = {}) {
         assigneeUserIds: flags['assignee-user'],
         executionMode: flags['execution-mode'],
         expectations: flags.expectations,
+        reviewPolicy: flags['review-policy'],
         startDate: flags['start-date'],
         dueDate: flags['due-date'],
         estimate: flags.estimate,

package/dist/lib/triggers.js

@@ -147,6 +147,13 @@ exports.TRIGGER_EVENT_CATALOG = {
         'task.assigned',
         'task.completed',
         'task.archived',
+        'task.unassigned',
+        'task.scheduled',
+        'task.rescheduled',
+        'task.unscheduled',
+        'task.deleted',
+        'task.execution_completed',
+        'task.execution_failed',
     ],
     space: [
         'space.created',

package/dist/lib/work-sync.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Work Sync's own telemetry, readable.
+ *
+ * Work Sync v1 is ON at 100% (owner decision, 2026-09-08) with two of its exit
+ * criteria knowingly overridden rather than satisfied: `shadow_mismatch` and
+ * `resume_error` rows from a one-user sample were unexplained, and
+ * revocation-to-purge latency had never been measured. Root `CLAUDE.md` records
+ * that an unexplained board divergence is therefore "a live hypothesis, not an
+ * impossibility, and is the first thing to suspect".
+ *
+ * The server has computed the verdict all along — `GET
+ * /api/work-sync/spaces/:spaceId/telemetry-summary` returns the per-event counts,
+ * the repair backlog, and a `ready`/`hold`/`insufficient_evidence` decision with
+ * its reasons. Nothing outside the API could read it, so checking the criteria
+ * meant a query against the production database. An exit criterion that can only
+ * be read by hand is one that does not get read.
+ *
+ * A domain lib rather than an inline `/api/...` in the command, per the repo's
+ * CLI rule: a command reaches the API through its domain lib or `dataService`,
+ * never by composing the URL at the call site.
+ */
+export type WorkSyncEventStats = {
+    count: number;
+    p50DurationMs: number | null;
+    p95DurationMs: number | null;
+    p50Bytes: number | null;
+    p95Bytes: number | null;
+    mismatchCount: number;
+};
+/**
+ * What happened to WRITES of one operation kind, from the durable command queue.
+ * Rates are `null` when their denominator is zero: conflict rates are over
+ * settled commands (accepted + dead-lettered), the duplicate rate over deliveries.
+ */
+export type WorkSyncCommandStats = {
+    commands: number;
+    deliveries: number;
+    duplicateDeliveries: number;
+    accepted: number;
+    pending: number;
+    deadLettered: number;
+    versionConflicts: number;
+    authorizationChanged: number;
+    expired: number;
+    retryExhausted: number;
+    otherRejections: number;
+    rates: {
+        versionConflict: number | null;
+        authorizationChanged: number | null;
+        duplicateDelivery: number | null;
+    };
+};
+export type WorkSyncTelemetrySummary = {
+    sampledEvents: number;
+    events: Record<string, WorkSyncEventStats>;
+    /** Absent from a server older than the write-side rates. */
+    commands?: Record<string, WorkSyncCommandStats>;
+    /**
+     * Cold opens of a task detail plane that found (hit) or did not find (miss) a
+     * completed coverage record on the device. `hitRate` is null with no cold
+     * opens. Absent from a server older than the coverage read path.
+     */
+    coverage?: {
+        hits: number;
+        misses: number;
+        hitRate: number | null;
+    };
+    repairBacklog: number;
+    rollout: {
+        verdict: 'ready' | 'hold' | 'insufficient_evidence';
+        reasons: string[];
+    };
+};
+/** What each `rollout.reasons` code means, in the reader's terms. */
+export declare const WORK_SYNC_HOLD_REASONS: Record<string, string>;
+export declare function fetchWorkSyncTelemetrySummary(spaceId: string, { limit }?: {
+    limit?: number;
+}): Promise<WorkSyncTelemetrySummary>;
+/**
+ * What `POST /reconcile` actually returns, field for field.
+ *
+ * This was typed `{repaired?: number; remaining?: number}` — two names the server
+ * has never sent. A wrong optional type is worse than none: every field reads as
+ * `undefined` at runtime and TypeScript agrees it might be, so a command printing
+ * `repaired` would have compiled, run, and reported nothing wrong.
+ *
+ * `upserts` is the one that answers the question a reader is asking: how many
+ * projection entries were found STALE against authoritative task truth. It is a
+ * divergence count, which is why this command exists — it is the same question the
+ * browser's shadow comparison answers, asked server-side and without a browser.
+ */
+export type WorkSyncReconciliation = {
+    /** Projection entries found stale against task truth and republished. */
+    upserts: number;
+    /** TaskCards published for tasks that no longer exist. */
+    removes: number;
+    summaryUpserts: number;
+    summaryRemoves: number;
+    /** Pending repair rows queued by earlier failures, before this run settled them. */
+    backlog: number;
+    /** A scope larger than the 1000-row read cap: the verdict covers only a prefix. */
+    truncated: boolean;
+    success?: boolean;
+};
+export declare function reconcileWorkSyncScope(spaceId: string): Promise<WorkSyncReconciliation>;