@skrr-ai/cli 0.1.37 → 0.1.39

package/dist/commands/tasks/review-queue.js

@@ -35,6 +35,9 @@ class TasksReviewQueue extends base_command_1.BaseCommand {
             description: 'Only Tasks where a Result is already in — the ones a reviewer can act on',
         }),
         limit: core_1.Flags.integer({ description: 'Maximum Tasks to inspect (default 100)', default: 100 }),
+        'include-closed': core_1.Flags.boolean({
+            description: 'Also list Tasks already closed — for auditing what was closed over',
+        }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
     };
     async run() {
@@ -66,7 +69,27 @@ class TasksReviewQueue extends base_command_1.BaseCommand {
             // unlooked-for empty answer this command refuses to give.
             this.error('--limit must be at least 1.', { exit: 1 });
         }
+        /*
+         * oclif's `required: true` asserts the flag was SUPPLIED, not that it says
+         * anything. `--space ""` — an unset shell variable, which is how it happens
+         * — satisfied it, and the empty string was then dropped from the query
+         * string as falsy, so the command silently widened from one Space to every
+         * Space the caller can see and reported that as the answer.
+         */
+        if (!flags.space.trim()) {
+            this.error('--space needs a Space id; it was given an empty value.', { exit: 1 });
+        }
         const tasks = [];
+        /*
+         * Whether the scan actually reached the end.
+         *
+         * The loop already followed the cursor, and then stopped at `--limit` with
+         * `has_more` still true and threw that fact away — so a Space with 95 owed
+         * Expectations reported on the first 11 and printed the same sentence it
+         * prints for a Space that owes nothing. The comment above states the
+         * principle this had to satisfy; nothing recorded whether it had.
+         */
+        let truncated = false;
         try {
             let cursor;
             for (;;) {
@@ -80,8 +103,12 @@ class TasksReviewQueue extends base_command_1.BaseCommand {
                         'say whether anything is owed. Refusing to report an empty queue.', { exit: 1 });
                 }
                 tasks.push(...response.data);
-                if (!response.has_more || !response.next_cursor || tasks.length >= flags.limit)
+                if (!response.has_more || !response.next_cursor)
+                    break;
+                if (tasks.length >= flags.limit) {
+                    truncated = true;
                     break;
+                }
                 cursor = response.next_cursor;
             }
         }
@@ -95,34 +122,101 @@ class TasksReviewQueue extends base_command_1.BaseCommand {
          * worse than no queue: the reviewer would believe they had seen everything.
          */
         const rows = [];
-        for (const task of tasks) {
-            const taskId = String(task.id ?? task._id ?? '');
-            if (!taskId)
-                continue;
-            const base = {
-                taskId,
-                identifier: String(task.identifier ?? taskId),
-                title: String(task.title ?? '(untitled)'),
-                status: String(task.status ?? '-'),
-                hasResult: Boolean(task.currentResultId),
-            };
-            try {
-                const acceptance = await data_provider_1.dataService.getTaskAcceptance(taskId);
-                const awaiting = acceptance.expectations.filter((e) => e.gating && !e.met);
-                if (awaiting.length > 0)
-                    rows.push({ ...base, awaiting });
-            }
-            catch (error) {
-                rows.push({ ...base, awaiting: [], error: error?.message || 'unreadable' });
+        /*
+         * A finished Task is not a worklist item.
+         *
+         * Closing is the closer's call now, so a Task can reach `done` over
+         * Expectations nobody judged — and those rows stayed in the queue forever,
+         * captioned in the present tense ("settling these will not close it") about
+         * something already closed. Every forced close permanently added noise to
+         * the list a reviewer is supposed to work down. `--include-closed` keeps the
+         * old view for anyone auditing what was closed over.
+         */
+        const CLOSED_STATUS_TYPES = new Set(['completed', 'cancelled']);
+        const candidates = tasks.filter((task) => flags['include-closed'] || !CLOSED_STATUS_TYPES.has(String(task.statusType ?? '')));
+        const skippedClosed = tasks.length - candidates.length;
+        /*
+         * Acceptance is one request per Task and there is no batch endpoint, so the
+         * serial loop this replaces took 61 seconds on 100 Tasks and printed nothing
+         * at all until it finished. Bounded rather than `Promise.all`: 100
+         * simultaneous authorized reads hit the same cascade the `/cards` endpoint
+         * exists to avoid. Results are written by INDEX so output order stays the
+         * list's order regardless of which request returns first.
+         */
+        const ACCEPTANCE_CONCURRENCY = 6;
+        const settled = new Array(candidates.length).fill(null);
+        let next = 0;
+        const worker = async () => {
+            for (;;) {
+                const index = next;
+                next += 1;
+                if (index >= candidates.length)
+                    return;
+                const task = candidates[index];
+                const taskId = String(task.id ?? task._id ?? '');
+                if (!taskId)
+                    continue;
+                const base = {
+                    taskId,
+                    identifier: String(task.identifier ?? taskId),
+                    title: String(task.title ?? '(untitled)'),
+                    status: String(task.status ?? '-'),
+                    hasResult: Boolean(task.currentResultId),
+                };
+                try {
+                    const acceptance = await data_provider_1.dataService.getTaskAcceptance(taskId);
+                    const awaiting = acceptance.expectations.filter((e) => e.gating && !e.met);
+                    if (awaiting.length > 0)
+                        settled[index] = { ...base, awaiting };
+                }
+                catch (error) {
+                    settled[index] = {
+                        ...base,
+                        awaiting: [],
+                        error: error?.message || 'unreadable',
+                    };
+                }
             }
-        }
+        };
+        await Promise.all(Array.from({ length: Math.min(ACCEPTANCE_CONCURRENCY, candidates.length) }, worker));
+        rows.push(...settled.filter((row) => row !== null));
         const visible = flags.actionable ? rows.filter((row) => row.hasResult || row.error) : rows;
         if (flags.json) {
-            this.log(JSON.stringify({ space: flags.space, tasks: visible }, null, 2));
+            this.log(JSON.stringify({
+                space: flags.space,
+                inspected: candidates.length,
+                truncated,
+                ...(skippedClosed > 0 ? { skippedClosed } : {}),
+                owedTasks: rows.length,
+                tasks: visible,
+            }, null, 2));
             return;
         }
-        if (visible.length === 0) {
+        /*
+         * "Nothing is owed" may only be said by a scan that reached the end.
+         *
+         * One sentence used to cover four different states — a clean queue, a
+         * truncated scan, a filter that emptied the list, and a Space that does not
+         * exist — and in three of them it was false. Each now says its own thing,
+         * and the two that cannot support the claim refuse to make it, in the same
+         * shape as the misread-envelope guard above.
+         */
+        if (truncated && rows.length === 0) {
+            this.error(`Inspected only the first ${candidates.length} Task(s) of a longer list in ${flags.space}, ` +
+                'so it cannot say whether anything is owed. Refusing to report an empty queue. ' +
+                'Re-run with a larger --limit.', { exit: 1 });
+        }
+        if (rows.length === 0) {
+            await this.assertSpaceExists(flags.space);
             this.log(`Nothing in ${flags.space} is awaiting a judgement.`);
+            if (skippedClosed > 0) {
+                this.log(`  (${skippedClosed} closed Task(s) skipped — see them with --include-closed.)`);
+            }
+            return;
+        }
+        if (visible.length === 0) {
+            this.log(`${rows.length} Task(s) in ${flags.space} owe judgements, but none has a Result yet — ` +
+                're-run without --actionable to see them.');
             return;
         }
         let total = 0;
@@ -133,18 +227,37 @@ class TasksReviewQueue extends base_command_1.BaseCommand {
                 this.log(`  could not read its Expectations: ${row.error}`);
                 continue;
             }
-            // A Task with no Result yet is listed but marked: its Expectations are
-            // owed, and settling them still leaves it unclosable. Saying so here stops
-            // a reviewer working through a list that cannot finish.
+            /*
+             * State the fact, not a gate. This read "no Result submitted yet — settling
+             * these will not close it", which implied that a Result is what stands
+             * between these judgements and a close. Since `56a6ded703` it is not: a
+             * Task closes without one and the absence is recorded on
+             * `resolution.closure`. What a reviewer needs to know is only that there is
+             * no Result to judge the work against yet.
+             */
             if (!row.hasResult) {
-                this.log('  no Result submitted yet — settling these will not close it');
+                this.log('  no Result submitted yet — nothing to judge the work against');
             }
             for (const expectation of row.awaiting) {
                 total += 1;
-                const settledBy = expectation.assessedByKind
-                    ? ` [last judged by ${(0, task_closure_1.describeAssessor)(expectation.assessedByKind)}]`
-                    : '';
-                this.log(`  ${expectation.id}  ${expectation.sentence || expectation.text || ''}${settledBy}`);
+                this.log(`  ${expectation.id}  ${expectation.sentence || expectation.text || ''}`);
+                /*
+                 * The judgement itself, not just the KIND of judge.
+                 *
+                 * `[last judged by person]` named no person, no decision, no date and no
+                 * reason — so a reviewer working down this list could see that someone
+                 * had looked and not what they concluded, which is the one thing they
+                 * need before looking again. The acceptance projection carries all of it
+                 * now; this is where it was being dropped.
+                 */
+                if (expectation.assessedByKind) {
+                    const decision = expectation.decision || 'judged';
+                    const when = expectation.assessedAt
+                        ? ` on ${String(expectation.assessedAt).slice(0, 10)}`
+                        : '';
+                    const why = expectation.reason ? `: ${expectation.reason}` : '';
+                    this.log(`      ${decision} by ${(0, task_closure_1.describeAssessor)(expectation.assessedByKind)}${when}${why}`);
+                }
                 if (expectation.evidenceLevel) {
                     this.log(`      evidence: ${expectation.evidenceLevel}${expectation.requiredEvidence ? ` (asked for ${expectation.requiredEvidence})` : ''}`);
                 }
@@ -155,11 +268,47 @@ class TasksReviewQueue extends base_command_1.BaseCommand {
         }
         this.log('');
         this.log(`${total} Expectation(s) awaiting a judgement across ${visible.length} Task(s).`);
+        if (truncated) {
+            this.log(`Only the first ${candidates.length} Task(s) were inspected and more remain — ` +
+                're-run with a larger --limit to see the rest.');
+        }
+        if (skippedClosed > 0) {
+            this.log(`${skippedClosed} closed Task(s) skipped — see them with --include-closed.`);
+        }
         this.log('');
         this.log('Settle one:   skrr tasks expectations assess <task-id> <expectation-id> \\');
         this.log('                --decision met --reason "..."');
         this.log('Settle a Task: skrr tasks expectations assess <task-id> --all \\');
         this.log('                --decision met --reason "..."');
     }
+    /**
+     * An empty queue must not be how you learn a Space id is wrong.
+     *
+     * A UUID-shaped ref is accepted without a lookup (`base-command` short-circuits
+     * on the SHAPE, which is a cheap and correct optimisation nearly everywhere),
+     * and the list route deliberately never 404s — an unknown Space falls back to
+     * the ACL enumeration and returns an honest empty page. Those two reasonable
+     * decisions compose into "Nothing is awaiting a judgement", exit 0, for a
+     * Space that does not exist. A typo read as done.
+     *
+     * So the existence check is paid for ONLY on the path that is about to make
+     * the completeness claim — never on the path that found work.
+     */
+    async assertSpaceExists(spaceId) {
+        try {
+            await data_provider_1.dataService.getSpace(spaceId);
+        }
+        catch (error) {
+            // The status rides the error itself here, the way `base-command` reads it
+            // (`e.status === 404`) — not on a nested `response`.
+            const status = error?.status;
+            if (status === 404 || status === 403) {
+                this.error(`No Space ${spaceId} is visible to you, so there is nothing to report on. ` +
+                    'Check the id with `skrr spaces list`.', { exit: 2 });
+            }
+            // Any other failure is about this read, not about the Space. Let the
+            // empty answer stand rather than turning a blip into a false "not found".
+        }
+    }
 }
 exports.default = TasksReviewQueue;

package/dist/commands/tasks/show.d.ts

@@ -1,4 +1,15 @@
 import { BaseCommand } from '../../base-command';
+/**
+ * Where to look next — as COMMANDS, not as facts about the task.
+ *
+ * These used to print as `What the agent produced: skrr tasks output <ref>`,
+ * in the same `Label: value` grammar as every line above them, so the line read
+ * as a statement of what the agent had produced. It also printed on tasks no
+ * agent had ever run, asserting output that did not exist (OSK-9669). They are
+ * now a visibly separate list, and only once a run, a conversation or a Result
+ * exists for them to show.
+ */
+export declare function taskPointerLines(t: Record<string, unknown>, ref: string, bin?: string): string[];
 /**
  * The failure rows of `tasks show`, when there are any. (S3 dogfood finding)
  *

package/dist/commands/tasks/show.js

@@ -1,14 +1,43 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskPointerLines = taskPointerLines;
 exports.taskFailureLines = taskFailureLines;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const api_fetch_1 = require("../../lib/api-fetch");
 const session_task_endpoints_1 = require("../../lib/session-task-endpoints");
 const base_command_1 = require("../../base-command");
+const task_closure_1 = require("../../lib/task-closure");
 const task_resolver_1 = require("../../lib/task-resolver");
 const web_url_1 = require("../../lib/web-url");
 const html_text_1 = require("../../lib/html-text");
+/**
+ * Where to look next — as COMMANDS, not as facts about the task.
+ *
+ * These used to print as `What the agent produced: skrr tasks output <ref>`,
+ * in the same `Label: value` grammar as every line above them, so the line read
+ * as a statement of what the agent had produced. It also printed on tasks no
+ * agent had ever run, asserting output that did not exist (OSK-9669). They are
+ * now a visibly separate list, and only once a run, a conversation or a Result
+ * exists for them to show.
+ */
+function taskPointerLines(t, ref, bin = 'skrr') {
+    const hasSomethingToShow = Boolean(t.conversationId || t.lastFinalizedRunId || t.checkoutRunId || t.currentResultId);
+    if (!hasSomethingToShow)
+        return [];
+    const pointers = [
+        [`${bin} tasks output ${ref}`, 'what the agent produced'],
+    ];
+    if (t.conversationId) {
+        pointers.push([`${bin} tasks transcript ${ref}`, 'the full agent transcript']);
+    }
+    const width = Math.max(...pointers.map(([command]) => command.length));
+    return [
+        '',
+        'See also:',
+        ...pointers.map(([command, what]) => `  ${command.padEnd(width)}  ${what}`),
+    ];
+}
 /**
  * The failure rows of `tasks show`, when there are any. (S3 dogfood finding)
  *
@@ -179,13 +208,80 @@ class TasksShow extends base_command_1.BaseCommand {
          * it stood on at close. Show it so a bare "done" never reads as "clean."
          */
         const resolution = t.resolution;
-        if (resolution?.closure && resolution.closure.closable === false) {
-            const parts = [];
-            const unmet = resolution.closure.expectations?.unmet?.length ?? 0;
-            if (unmet > 0)
-                parts.push(`${unmet} Expectation${unmet === 1 ? '' : 's'} still unmet`);
-            parts.push(...(resolution.closure.blockers || []).filter((c) => c !== 'TASK_EXPECTATIONS_NOT_MET'));
-            this.log(`Resolution:  ${resolution.kind ?? '-'} — closed over ${parts.join('; ') || 'outstanding items'}`);
+        /*
+         * Same renderer as the `tasks move` receipt, so the two cannot disagree
+         * about a Task they are both describing.
+         *
+         * This copy showed an owner's ordinary close as an override:
+         * `TASK_RESULT_REVIEW_REQUIRED` lands in `blockers` whenever the policy is
+         * unsatisfied — including when the owner, who is not bound by the Review
+         * they declared, closes it themselves — and this rendered it identically to
+         * a genuine forced close. So the only read surface for "was this gate
+         * overridden?" could not answer the question.
+         */
+        if (resolution?.closure) {
+            const sentences = (0, task_closure_1.closureSnapshotLines)(resolution.closure);
+            if (sentences.length > 0) {
+                this.log(`Resolution:  ${resolution.kind ?? '-'} — ${sentences.join(' ')}`);
+            }
+        }
+        /*
+         * A Result orphaned by a spec edit is not the same as no Result.
+         *
+         * Editing a `description` or an Expectation advances `specVersion`, which
+         * unsets `currentResultId` by design — the old answer replied to a question
+         * that has changed. But every CLI surface then reported the Task as though
+         * nothing had ever been submitted, and the prior Result is still there. The
+         * web already says this correctly ("No Result answers the current Task spec
+         * vN", plus the previous one); the CLI said nothing at all.
+         *
+         * The extra request is paid only in the ambiguous case — when there is no
+         * current Result — and `tasks show` is a detail view, so one call to
+         * distinguish "nobody answered" from "the answer is out of date" is worth
+         * it. A failed lookup degrades to silence rather than to a claim.
+         */
+        const taskSpecVersion = Number(t.specVersion) || 1;
+        if (t.currentResultId) {
+            this.log(`Result:      ${String(t.currentResultId)} (answers spec v${taskSpecVersion})`);
+            /*
+             * The Review on that Result, with its REASON.
+             *
+             * Closing over a `changes_requested` Review is allowed and recorded, and
+             * the closure line says "a reviewer requested changes" — the verdict. What
+             * they asked for lived only on the Review row, which no text surface
+             * printed, so the objection survived as a fact and lost its content. One
+             * read, on a detail view, only when there is a Result to have been
+             * reviewed; a failed read says nothing rather than implying no Review.
+             */
+            try {
+                const history = await data_provider_1.dataService.listTaskResults(taskIdentity.id);
+                const review = (history?.reviews || []).find((row) => row.resultId === String(t.currentResultId));
+                if (review) {
+                    const who = (0, task_closure_1.describeAssessor)(review.reviewedBy?.kind);
+                    const when = review.reviewedAt ? ` on ${String(review.reviewedAt).slice(0, 10)}` : '';
+                    const why = review.rationale ? `: ${review.rationale}` : '';
+                    this.log(`Review:      ${review.decision} by ${who}${when}${why}`);
+                }
+            }
+            catch {
+                // Silence, not "no Review": this read failing is not evidence of absence.
+            }
+        }
+        else {
+            let priorLine = 'none submitted';
+            try {
+                const history = await data_provider_1.dataService.listTaskResults(taskIdentity.id);
+                const prior = history?.results?.[0];
+                if (prior) {
+                    priorLine =
+                        `none answers spec v${taskSpecVersion} — previous v${prior.version} ` +
+                            `answered spec v${prior.specVersion ?? '?'}`;
+                }
+            }
+            catch {
+                priorLine = 'none answers the current spec (earlier Results could not be read)';
+            }
+            this.log(`Result:      ${priorLine}`);
         }
         this.log(`Executor:    ${t.executionMode ?? 'legacy / inferred'}`);
         this.log(`Priority:    ${t.priority ?? '-'}`);
@@ -333,11 +429,8 @@ class TasksShow extends base_command_1.BaseCommand {
             // Silent: a Task this caller can VIEW but whose acceptance they cannot
             // read is a permissions shape, not something to shout about mid-page.
         }
-        this.log('');
-        this.log(`What the agent produced: skrr tasks output ${ref}`);
-        if (t.conversationId) {
-            this.log(`Full agent transcript:   skrr tasks transcript ${ref}`);
-        }
+        for (const line of taskPointerLines(t, ref, this.config.bin))
+            this.log(line);
     }
 }
 exports.default = TasksShow;

package/dist/commands/tasks/trust.js

@@ -41,8 +41,13 @@ class TasksTrust extends base_command_1.BaseCommand {
         level: core_1.Flags.string({
             options: [...data_provider_1.DELIVERABLE_AUTHORITIES],
             required: true,
-            description: 'How well evidenced the answer must be: self_reported (the doer says so), ' +
-                'human_confirmed (someone else looked), observation_backed (the platform saw it).',
+            description: 
+            // `observation_backed` is a RETIRED rung name for this domain — the flag
+            // rejects it, so the only two values the help explained were one real one
+            // and one the command refuses. The four the enum actually accepts:
+            'How well evidenced the answer must be: self_reported (the doer says so), ' +
+                'human_confirmed (a person confirmed it), system_observed (the platform saw it), ' +
+                'external_receipt (a provider receipt proves it).',
         }),
         reason: core_1.Flags.string({
             required: true,

package/dist/commands/tasks/update.js

@@ -251,26 +251,62 @@ class TasksUpdate extends base_command_1.BaseCommand {
          * rewrote the list and revoked the assessments with no warning at all.
          * Same write, same price: the disclosure belongs on the effective change.
          */
-        if (expectationsPatch !== undefined || body.expectations !== undefined) {
-            let settledCount = 0;
+        /*
+         * The DESCRIPTION is a spec field too.
+         *
+         * `TaskSpecFence.TASK_SPEC_FIELDS` is `['description', 'expectations']`, and
+         * both advance `specVersion` — which revokes every assessment, because they
+         * are matched by exact version. The disclosure was wired to the Expectations
+         * payload alone, so fixing a typo in the prose voided a reviewer's sign-off
+         * with no warning and no receipt. Same write, same price, same disclosure.
+         */
+        const changesSpec = expectationsPatch !== undefined ||
+            body.expectations !== undefined ||
+            flags.description !== undefined ||
+            body.description !== undefined;
+        if (changesSpec) {
+            let settled = [];
+            let unreadable = false;
             try {
                 const acceptance = await data_provider_1.dataService.getTaskAcceptance(taskIdentity.id);
-                settledCount = acceptance.expectations.filter((e) => e.assessmentId).length;
+                settled = acceptance.expectations.filter((e) => e.assessmentId);
             }
             catch {
                 // An unreadable acceptance is not a reason to refuse the edit. Warn
                 // without a number rather than inventing one or blocking the write.
-                settledCount = -1;
+                unreadable = true;
             }
-            if (settledCount !== 0 && !flags.yes) {
-                const noun = settledCount === 1 ? 'assessment' : 'assessments';
-                const count = settledCount < 0 ? 'Any existing' : `${settledCount} existing`;
-                this.log(`Changing Expectations advances the Task specification, so ${count} ${noun} ` +
+            if ((unreadable || settled.length > 0) && !flags.yes) {
+                const noun = settled.length === 1 ? 'assessment' : 'assessments';
+                const count = unreadable ? 'Any existing' : `${settled.length} existing`;
+                const field = expectationsPatch !== undefined || body.expectations !== undefined
+                    ? 'Changing Expectations'
+                    : 'Changing the description';
+                this.log(`${field} advances the Task specification, so ${count} ${noun} ` +
                     'will stop counting and must be recorded again.');
+                /*
+                 * NAME them. The count alone made the warning unactionable — and it is
+                 * task-WIDE, so Expectations you are not touching lose their judgements
+                 * too, which a bare number actively hides.
+                 */
+                for (const row of settled) {
+                    this.log(`  ${row.id}  ${row.sentence || row.text || ''}`);
+                }
+                if (settled.length > 0) {
+                    this.log('Revocation covers every Expectation on this Task, including ones this edit ' +
+                        'does not touch.');
+                }
                 const ok = await this.confirm('Continue? [y/N] ');
                 if (!ok) {
-                    this.log('No change made.');
-                    return;
+                    /*
+                     * Non-zero, because the edit did NOT happen.
+                     *
+                     * This printed "No change made." and exited 0, so `skrr tasks update
+                     * … && echo applied` printed `applied`. The guard exists to protect
+                     * the non-interactive path, and the non-interactive path is precisely
+                     * the one that cannot see a message — it can only read the exit code.
+                     */
+                    this.error('No change made — re-run with `--yes` to accept the revocation.', { exit: 2 });
                 }
             }
         }

package/dist/commands/tasks/updates/add.js

@@ -42,7 +42,7 @@ class TasksUpdatesAdd extends base_command_1.BaseCommand {
                 'fields are required even when empty. ' +
                 'progress {completedSinceLast:[],nextActions:[],currentFocus?} · ' +
                 'finding {finding,evidenceRefs:[],impact?,severity?} · ' +
-                'decision {decision,rationale,alternativesConsidered?} · ' +
+                'decision {decision,rationale,alternativesConsidered?:[]} · ' +
                 'blocker {cause,requiredAction,nextOwner} · ' +
                 'verification {claim,result:passed|failed|inconclusive,evidenceRefs:[]}. ' +
                 'nextOwner is a principal object like {"kind":"human","userId":"..."}, not a name. ' +

package/dist/commands/token/list.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr token list`
+ *
+ * The other half of `token mint`. Minting binds a long-lived refresh session to
+ * a machine and records the `--label` with it — which reads as a promise that
+ * the credential can be found again — and there was no way to see it: `token`
+ * had only `mint`, and `list-tokens` shows CI tokens, a different credential
+ * type, so `revoke-token` had nothing to aim at. The only remedy was
+ * `logout --all-devices`, which signs every machine out.
+ *
+ * `GET /api/auth/sessions/refresh` has served exactly this list all along; it
+ * was simply not reachable from the CLI.
+ */
+export default class TokenList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/token/list.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const api_fetch_1 = require("../../lib/api-fetch");
+const format_1 = require("../../lib/format");
+/**
+ * `skrr token list`
+ *
+ * The other half of `token mint`. Minting binds a long-lived refresh session to
+ * a machine and records the `--label` with it — which reads as a promise that
+ * the credential can be found again — and there was no way to see it: `token`
+ * had only `mint`, and `list-tokens` shows CI tokens, a different credential
+ * type, so `revoke-token` had nothing to aim at. The only remedy was
+ * `logout --all-devices`, which signs every machine out.
+ *
+ * `GET /api/auth/sessions/refresh` has served exactly this list all along; it
+ * was simply not reachable from the CLI.
+ */
+class TokenList extends base_command_1.BaseCommand {
+    static description = 'List the active sessions a minted token belongs to — the other half of `token mint`';
+    static examples = [
+        '<%= config.bin %> token list',
+        '<%= config.bin %> token list --json',
+    ];
+    static flags = { json: core_1.Flags.boolean({ description: 'Output JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(TokenList);
+        let data = null;
+        try {
+            data = await (0, api_fetch_1.apiFetch)('/api/auth/sessions/refresh', {
+                method: 'GET',
+                credential: this.resolvedCredential,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        const sessions = data?.sessions || [];
+        if (flags.json)
+            return this.log(JSON.stringify({ sessions, count: sessions.length }, null, 2));
+        if (!sessions.length)
+            return this.log('No active sessions.');
+        (0, format_1.renderTable)(sessions.map((session) => ({
+            id: session.id,
+            kind: session.kind,
+            // The operator's own name for the credential wins over a derived
+            // device string — it is what they would search by.
+            device: session.label || session.device || '-',
+            ip: session.ip || '-',
+            lastActive: session.lastActiveAt || session.createdAt || '-',
+            // The session you are typing in. Revoking it signs THIS machine out,
+            // which is the one outcome nobody means when they revoke a credential.
+            current: session.current ? 'yes' : '',
+        })), [
+            { key: 'id', header: 'ID' },
+            { key: 'kind', header: 'KIND' },
+            { key: 'device', header: 'DEVICE', maxWidth: 34 },
+            { key: 'ip', header: 'IP' },
+            { key: 'lastActive', header: 'LAST ACTIVE' },
+            { key: 'current', header: 'CURRENT' },
+        ], (line) => this.log(line));
+        this.log('');
+        this.log('Retire one with: skrr token revoke <id>');
+    }
+}
+exports.default = TokenList;

package/dist/commands/token/revoke.d.ts

@@ -0,0 +1,23 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr token revoke <id>`
+ *
+ * Retire ONE session — the credential `token mint` handed to one machine —
+ * without signing every other machine out. `logout --all-devices` was the only
+ * way to do this, which is a blunt instrument for "that one CI box is
+ * decommissioned".
+ *
+ * Owner-gated server-side: a row that is not the caller's returns
+ * `{ revoked: false }` rather than an error, so ids cannot be enumerated.
+ */
+export default class TokenRevoke extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}