@skrr-ai/cli 0.1.41 → 0.1.43

package/dist/commands/tasks/attachments/set-role.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+/**
+ * `skrr tasks attachments set-role <task> <attachment> --role …`
+ *
+ * The one way to change what an existing asset IS on a Task. Its real use is
+ * promotion: an agent may only upload `evidence` or `deliverable`, because an
+ * `input` is forwarded into every future Run of the Task — so when an agent's
+ * screenshot should become an input, a person promotes it here. The server
+ * refuses the call from an agent, whatever credential it holds, and moves the
+ * asset's ledger link with the role.
+ */
+class TasksAttachmentsSetRole extends base_command_1.BaseCommand {
+    static description = "Change an attachment's role (input, evidence, or deliverable). Making an asset an input " +
+        'sends it into every future Run of the task, so only a person can change a role.';
+    static examples = [
+        '<%= config.bin %> tasks attachments set-role <task-id> <attachment-id> --role input',
+        '<%= config.bin %> tasks attachments set-role <task-id> <attachment-id> --role evidence --json',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Task ID', required: true, ignoreStdin: true }),
+        attachmentId: core_1.Args.string({ description: 'Attachment ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        role: core_1.Flags.string({
+            required: true,
+            options: ['input', 'evidence', 'deliverable'],
+            description: 'input (forwarded into every future Run), evidence (supports an Update or Result), or deliverable (the media is the product)',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksAttachmentsSetRole);
+        let attachment;
+        try {
+            attachment = await data_provider_1.dataService.setTaskAttachmentRole({
+                taskId: args.id,
+                attachmentId: args.attachmentId,
+                role: flags.role,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(attachment, null, 2));
+            return;
+        }
+        const name = attachment.originalName || attachment.id;
+        const effect = attachment.role === 'input'
+            ? ' It will be sent into every future Run of this task.'
+            : ' It is no longer sent into Runs.';
+        this.log(`${name} is now ${attachment.role}.${effect}`);
+    }
+}
+exports.default = TasksAttachmentsSetRole;

package/dist/commands/tasks/attachments/upload.d.ts

@@ -8,6 +8,7 @@ export default class TasksAttachmentsUpload extends BaseCommand {
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        role: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/tasks/attachments/upload.js

@@ -1,50 +1,14 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const node_buffer_1 = require("node:buffer");
 const core_1 = require("@oclif/core");
-const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
-const file_mime_1 = require("../../../lib/file-mime");
+const task_asset_upload_1 = require("../../../lib/task-asset-upload");
 class TasksAttachmentsUpload extends base_command_1.BaseCommand {
     static description = 'Upload a file attachment to a task';
     static examples = [
         '<%= config.bin %> tasks attachments upload <task-id> --file ./report.pdf',
         '<%= config.bin %> tasks attachments upload <task-id> --file ./screenshot.png --json',
+        '<%= config.bin %> tasks attachments upload <task-id> --file ./demo.mp4 --role deliverable',
     ];
     static args = {
         id: core_1.Args.string({ description: 'Task ID', required: true, ignoreStdin: true }),
@@ -52,32 +16,34 @@ class TasksAttachmentsUpload extends base_command_1.BaseCommand {
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         file: core_1.Flags.string({ description: 'Path to the file to upload', required: true }),
+        role: core_1.Flags.string({
+            description: 'Asset role: evidence (supports an Update/Result), deliverable (the media is the product), or input (forwarded into every future Run — only a person may add one; a person promotes an agent upload with `attachments set-role`). Defaults to evidence when an agent uploads, input when a person does.',
+            options: ['input', 'evidence', 'deliverable'],
+        }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(TasksAttachmentsUpload);
-        const filePath = flags.file;
-        if (!fs.existsSync(filePath)) {
-            this.error(`File not found: ${filePath}`, { exit: 1 });
-        }
-        const buf = fs.readFileSync(filePath);
-        const filename = path.basename(filePath);
-        const fd = new FormData();
-        const mimeType = (0, file_mime_1.mimeTypeForFilename)(filename);
-        fd.append('file', new node_buffer_1.Blob([buf], { type: mimeType }), filename);
-        let result;
+        // The pipeline — buffered vs direct, session vs generic — lives in
+        // task-asset-upload.ts so `--attach` on updates/result/complete/comments
+        // makes the same routing decisions byte for byte (OSK-9863).
+        let asset;
         try {
-            result = await data_provider_1.dataService.uploadTaskAttachment({ taskId: args.id, formData: fd });
+            asset = await (0, task_asset_upload_1.uploadTaskAssetFile)({
+                taskId: args.id,
+                filePath: flags.file,
+                role: flags.role,
+            });
         }
         catch (err) {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(result, null, 2));
+            this.log(JSON.stringify(asset, null, 2));
             return;
         }
-        const a = result;
-        this.log(`Uploaded ${filename} (${buf.byteLength} bytes) → attachment ${a.id ?? a._id ?? '?'}`);
+        const dedup = asset.deduplicated ? ' (deduplicated — already on the task)' : '';
+        this.log(`Uploaded ${asset.filename} → attachment ${asset.id}${dedup}`);
     }
 }
 exports.default = TasksAttachmentsUpload;

package/dist/commands/tasks/comments/add.d.ts

@@ -16,6 +16,7 @@ export default class TasksCommentsAdd extends BaseCommand {
         'parent-comment': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'anchor-mark-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'anchor-quote': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        attach: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
     /**

package/dist/commands/tasks/comments/add.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_crypto_1 = require("node:crypto");
 const core_1 = require("@oclif/core");
@@ -55,6 +88,11 @@ class TasksCommentsAdd extends base_command_1.BaseCommand {
         'anchor-quote': core_1.Flags.string({
             description: 'Captured quote for the anchor (≤1000 chars; truncated to 500 to match the editor). Enables inline-comment mode when used without --anchor-mark-id.',
         }),
+        attach: core_1.Flags.string({
+            multiple: true,
+            description: 'Upload a file as a Task asset and reference it in the comment body ' +
+                '(`![name](task-asset:<id>)`, resolved to a signed URL at read time). Repeatable.',
+        }),
     };
     async run() {
         this.requireAuth();
@@ -107,9 +145,36 @@ class TasksCommentsAdd extends base_command_1.BaseCommand {
         // mentionedAgentIds, reopen, and interrupt are preserved. Boolean flags
         // default to false; only pass them through when actually set so they
         // don't clobber a `true` value from the JSON file.
+        // --attach: upload first, then append `task-asset:` references to the
+        // body — comments store stable asset ids, not URLs (OSK-9856/9863).
+        let attachSuffix = '';
+        if (flags.attach?.length) {
+            const { uploadTaskAssetFile, taskAssetMarkdownRef } = await Promise.resolve().then(() => __importStar(require('../../../lib/task-asset-upload')));
+            const refs = [];
+            for (const filePath of flags.attach) {
+                try {
+                    const asset = await uploadTaskAssetFile({
+                        taskId: task.id,
+                        filePath,
+                        role: 'evidence',
+                    });
+                    refs.push(taskAssetMarkdownRef(asset));
+                }
+                catch (err) {
+                    this.error(`--attach failed: ${err.message}`, { exit: 1 });
+                }
+            }
+            if (refs.length)
+                attachSuffix = `\n\n${refs.join('\n')}`;
+        }
         const mentionedFromFlag = flags['mention-agent'];
+        const baseBody = flags.body ?? (typeof commentBody.body === 'string' ? commentBody.body : undefined);
         const data = (0, prompt_1.mergeDefined)(commentBody, {
-            body: flags.body,
+            body: baseBody
+                ? `${baseBody}${attachSuffix}`
+                : attachSuffix
+                    ? attachSuffix.trimStart()
+                    : undefined,
             mentionedAgentIds: Array.isArray(mentionedFromFlag) && mentionedFromFlag.length > 0
                 ? mentionedFromFlag
                 : undefined,
@@ -163,7 +228,7 @@ class TasksCommentsAdd extends base_command_1.BaseCommand {
                 ? await (0, api_fetch_1.apiFetch)(sessionPath, {
                     method: 'POST',
                     body: {
-                        body: flags.body ?? commentBody.body,
+                        body: data.body,
                         ...(mentioned ? { mentionedAgentIds: mentioned } : {}),
                     },
                     headers: { 'X-Idempotency-Key': idempotencyKey },

package/dist/commands/tasks/complete.d.ts

@@ -26,6 +26,7 @@ export default class TasksComplete extends BaseCommand {
         'structured-json': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         deliverable: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         evidence: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        attach: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         remaining: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'source-run': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'run-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/tasks/complete.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.describePendingReview = describePendingReview;
 const core_1 = require("@oclif/core");
@@ -97,6 +130,11 @@ class TasksComplete extends base_command_1.BaseCommand {
             description: 'Exact Task Resource link id produced by `tasks deliverable add`',
         }),
         evidence: core_1.Flags.string({ multiple: true, description: 'Evidence as <kind>:<id-or-uri>' }),
+        attach: core_1.Flags.string({
+            multiple: true,
+            description: 'Upload a file as a Task asset (role: evidence) and cite it in evidenceRefs. ' +
+                'Repeatable. Re-attaching identical bytes dedupes on the server.',
+        }),
         remaining: core_1.Flags.string({ multiple: true, description: 'Remaining work item' }),
         'source-run': core_1.Flags.string({ multiple: true, description: 'Contributing Task Run id' }),
         'run-id': core_1.Flags.string({ description: 'Expected current Task Run id' }),
@@ -214,6 +252,23 @@ class TasksComplete extends base_command_1.BaseCommand {
                 retryable: false,
             });
         }
+        // --attach: upload once the input is known to be valid — a closeout the CLI
+        // is about to refuse must not leave stored bytes behind — and before the
+        // idempotency key is derived, so a retry sees the same refs.
+        const evidenceRefs = Array.isArray(input.evidenceRefs) ? [...input.evidenceRefs] : [];
+        if (flags.attach?.length) {
+            const { attachTaskAssetFiles } = await Promise.resolve().then(() => __importStar(require('../../lib/task-asset-upload')));
+            try {
+                evidenceRefs.push(...(await attachTaskAssetFiles({
+                    taskId: identity.id,
+                    files: flags.attach,
+                    role: 'evidence',
+                })));
+            }
+            catch (err) {
+                this.error(`--attach failed: ${err.message}`, { exit: 1 });
+            }
+        }
         const payload = {
             status,
             summary,
@@ -223,7 +278,7 @@ class TasksComplete extends base_command_1.BaseCommand {
             resourceLinkIds: Array.isArray(input.resourceLinkIds)
                 ? stringArray(input.resourceLinkIds)
                 : [],
-            evidenceRefs: Array.isArray(input.evidenceRefs) ? input.evidenceRefs : [],
+            evidenceRefs,
             remainingWork: Array.isArray(input.remainingWork) ? input.remainingWork : [],
             contributors: Array.isArray(input.contributors)
                 ? input.contributors
@@ -255,6 +310,19 @@ class TasksComplete extends base_command_1.BaseCommand {
             });
         }
         catch (error) {
+            // Completing records a Result, so a closed Task refuses it the same way
+            // `tasks result submit` is refused, with the same way forward.
+            const refusal = (0, base_command_1.apiRefusal)(error);
+            if (refusal.code === 'TASK_REOPEN_REQUIRED') {
+                this.error([
+                    refusal.message ?? 'This Task is closed.',
+                    ...(0, task_closure_1.reopenRequiredLines)({
+                        bin: this.config.bin,
+                        task: identity.id,
+                        command: 'complete',
+                    }),
+                ].join('\n'), { exit: 1, code: 'TASK_REOPEN_REQUIRED' });
+            }
             this.handleApiError(error);
         }
         const url = (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, { id: taskId });

package/dist/commands/tasks/result/submit.d.ts

@@ -15,6 +15,7 @@ export default class TasksResultSubmit extends BaseCommand {
         'structured-json': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         deliverable: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         evidence: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        attach: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         remaining: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'run-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'source-run': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
@@ -23,4 +24,6 @@ export default class TasksResultSubmit extends BaseCommand {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /** The two ways forward from a closed Task, named where the commands are known. */
+    private reopenRequired;
 }

package/dist/commands/tasks/result/submit.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -43,6 +76,11 @@ class TasksResultSubmit extends base_command_1.BaseCommand {
             multiple: true,
             description: 'Evidence reference as <kind>:<id-or-uri>',
         }),
+        attach: core_1.Flags.string({
+            multiple: true,
+            description: 'Upload a file as a Task asset (role: evidence) and cite it in evidenceRefs. ' +
+                'Repeatable. Re-attaching identical bytes dedupes on the server.',
+        }),
         remaining: core_1.Flags.string({ multiple: true, description: 'Remaining work item (repeatable)' }),
         'run-id': core_1.Flags.string({ description: 'Canonical Task Run that produced this Result' }),
         'source-run': core_1.Flags.string({ multiple: true, description: 'Contributing Run id (repeatable)' }),
@@ -85,6 +123,36 @@ class TasksResultSubmit extends base_command_1.BaseCommand {
             const value = raw.slice(split + 1);
             return /^https?:|^file:/.test(value) ? { kind, uri: value } : { kind, id: value };
         });
+        // --attach: upload first so the Result cites real asset ids. Uploads land
+        // before the idempotency key is derived, so a retry sees the same refs.
+        if (flags.attach?.length) {
+            const { attachTaskAssetFiles, readTaskForUpload } = await Promise.resolve().then(() => __importStar(require('../../../lib/task-asset-upload')));
+            // A closed Task refuses the Result, and the files would already be
+            // stored — indexed as unreferenced uploads nobody asked for. Ask first.
+            // The server's refusal below stays the authority; this only keeps a
+            // refusal we can already see from costing an upload.
+            let target;
+            try {
+                target = await readTaskForUpload(task.id);
+            }
+            catch (err) {
+                this.error(`--attach failed: ${err.message}`, { exit: 1 });
+            }
+            if ((0, task_closure_1.taskIsSettled)(target)) {
+                this.reopenRequired(task.id, 'This Task is closed, and a Result can only be submitted while it is open. ' +
+                    'Nothing was uploaded.');
+            }
+            try {
+                evidenceRefs.push(...(await attachTaskAssetFiles({
+                    taskId: task.id,
+                    files: flags.attach,
+                    role: 'evidence',
+                })));
+            }
+            catch (err) {
+                this.error(`--attach failed: ${err.message}`, { exit: 1 });
+            }
+        }
         const payload = {
             summary: flags.summary,
             body: flags.body,
@@ -122,14 +190,12 @@ class TasksResultSubmit extends base_command_1.BaseCommand {
                 : await data_provider_1.dataService.submitTaskResult({ taskId: task.id, data });
         }
         catch (error) {
-            // A closed Task refuses a Result. Name the two ways forward here, where
-            // the commands are known: the API's own message stays surface-neutral
+            // A closed Task refuses a Result. Name the way forward here, where the
+            // commands are known: the API's own message stays surface-neutral
             // (OSK-10031).
             const refusal = (0, base_command_1.apiRefusal)(error);
             if (refusal.code === 'TASK_REOPEN_REQUIRED') {
-                this.error(`${refusal.message ?? 'This Task is closed.'}\n` +
-                    `→ Reopen it and submit again: ${this.config.bin} tasks move ${task.id} --status in_progress\n` +
-                    `→ Or record the Result and close it in one step: ${this.config.bin} tasks complete ${task.id} --summary "…"`, { exit: 1, code: 'TASK_REOPEN_REQUIRED' });
+                this.reopenRequired(task.id, refusal.message ?? 'This Task is closed.');
             }
             this.handleApiError(error);
         }
@@ -149,5 +215,12 @@ class TasksResultSubmit extends base_command_1.BaseCommand {
         if (url)
             this.log(`Task: ${url}`);
     }
+    /** The two ways forward from a closed Task, named where the commands are known. */
+    reopenRequired(taskId, message) {
+        this.error([
+            message,
+            ...(0, task_closure_1.reopenRequiredLines)({ bin: this.config.bin, task: taskId, command: 'result submit' }),
+        ].join('\n'), { exit: 1, code: 'TASK_REOPEN_REQUIRED' });
+    }
 }
 exports.default = TasksResultSubmit;

package/dist/commands/tasks/update.js

@@ -97,7 +97,9 @@ class TasksUpdate extends base_command_1.BaseCommand {
         // set of "move this task somewhere" options — which is how a reader
         // concludes the CLI cannot change a task's project at all (dogfood
         // OSK-4652). It can: `tasks move <id> --project <id|none>`.
-        goal: core_1.Flags.string({ description: 'Move task to a different goal' }),
+        goal: core_1.Flags.string({
+            description: 'Move task to a different goal (goal id), or "none" to detach it from its goal',
+        }),
         cycle: core_1.Flags.string({
             description: 'Set planning cycle by ID, or "current" / "next" in the task Space',
         }),
@@ -324,7 +326,7 @@ class TasksUpdate extends base_command_1.BaseCommand {
             // sees it and answers with the sentence that names `tasks move`.
             status: flags.status,
             duplicateOfId: flags['duplicate-of'],
-            goalId: flags.goal,
+            goalId: (0, tasks_2.resolveTaskGoalFlag)(flags.goal),
             cycleId: flags.cycle,
             spaceId: flags.space,
             assigneeAgentIds: flags['assignee-agent'],

package/dist/commands/tasks/updates/add.d.ts

@@ -15,6 +15,7 @@ export default class TasksUpdatesAdd extends BaseCommand {
         'spec-version': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         supersedes: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         reference: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        attach: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'idempotency-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };

package/dist/commands/tasks/updates/add.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -64,6 +97,12 @@ class TasksUpdatesAdd extends base_command_1.BaseCommand {
         }),
         supersedes: core_1.Flags.string({ description: 'Update id this correction supersedes' }),
         reference: core_1.Flags.string({ multiple: true, description: 'Reference as <kind>:<id-or-uri>' }),
+        attach: core_1.Flags.string({
+            multiple: true,
+            description: 'Upload a file as a Task asset (role: evidence) and cite it in this Update — appended to ' +
+                'data.evidenceRefs for finding/verification payloads, to the Update references otherwise. ' +
+                'Repeatable. Re-attaching identical bytes dedupes on the server.',
+        }),
         'idempotency-key': core_1.Flags.string({ description: 'Stable retry key for this exact Update' }),
         json: core_1.Flags.boolean({ description: 'Output JSON' }),
     };
@@ -88,6 +127,30 @@ class TasksUpdatesAdd extends base_command_1.BaseCommand {
             const value = raw.slice(split + 1);
             return /^https?:|^file:/.test(value) ? { kind, uri: value } : { kind, id: value };
         });
+        // --attach: upload first so the Update can cite the asset ids. For
+        // finding/verification the citation lands in data.evidenceRefs where the
+        // evidence renderer reads it; for the other Update kinds it becomes a
+        // task_attachment reference on the Update itself.
+        if (flags.attach?.length) {
+            const { attachTaskAssetFiles } = await Promise.resolve().then(() => __importStar(require('../../../lib/task-asset-upload')));
+            let refs;
+            try {
+                refs = await attachTaskAssetFiles({
+                    taskId: task.id,
+                    files: flags.attach,
+                    role: 'evidence',
+                });
+            }
+            catch (err) {
+                this.error(`--attach failed: ${err.message}`, { exit: 1 });
+            }
+            if (Array.isArray(data.evidenceRefs)) {
+                data = { ...data, evidenceRefs: [...data.evidenceRefs, ...refs] };
+            }
+            else {
+                references.push(...refs);
+            }
+        }
         const idempotencyKey = flags['idempotency-key'] ||
             (0, outbox_1.idempotencyKeyFor)('task-update', task.id, JSON.stringify({ type: flags.type, summary: flags.summary, data, resume }));
         let result;