@skrr-ai/cli 0.1.42 → 0.1.43

package/dist/commands/balance/overage.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
 const base_command_1 = require("../../base-command");
 const balance_1 = require("../../lib/balance");
 class BalanceOverage extends base_command_1.BaseCommand {
-    static description = 'Enable or disable personal Sky Code overage after included allowance is exhausted';
+    static description = `Enable or disable personal ${auth_core_1.FIRST_PARTY_HARNESS.displayName} overage after included allowance is exhausted`;
     static examples = [
         '<%= config.bin %> balance overage enabled',
         '<%= config.bin %> balance overage disabled',
@@ -12,7 +13,7 @@ class BalanceOverage extends base_command_1.BaseCommand {
     ];
     static args = {
         state: core_1.Args.string({
-            description: 'Whether personal stored balance may pay for Sky Code overage',
+            description: `Whether personal stored balance may pay for ${auth_core_1.FIRST_PARTY_HARNESS.displayName} overage`,
             required: true,
             options: ['enabled', 'disabled'],
             ignoreStdin: true,
@@ -34,7 +35,7 @@ class BalanceOverage extends base_command_1.BaseCommand {
             this.log(JSON.stringify({ ownerType: 'user', overageEnabled: result?.enabled === true }, null, 2));
             return;
         }
-        this.log(`Sky Code overage ${result?.enabled ? 'enabled' : 'disabled'} for your personal billing account.`);
+        this.log(`${auth_core_1.FIRST_PARTY_HARNESS.displayName} overage ${result?.enabled ? 'enabled' : 'disabled'} for your personal billing account.`);
         this.log(result?.enabled
             ? 'New admissions may use stored balance after included allowance is exhausted.'
             : 'New admissions will stop when included allowance is exhausted.');

package/dist/commands/balance/plan.js

@@ -2,12 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderSkyCodePlan = renderSkyCodePlan;
 const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const balance_1 = require("../../lib/balance");
 const web_url_1 = require("../../lib/web-url");
 class BalancePlan extends base_command_1.BaseCommand {
-    static description = 'Show your Sky Code plan, renewal state, available tiers, and the matching lifecycle page';
+    static description = `Show your ${auth_core_1.FIRST_PARTY_HARNESS.displayName} plan, renewal state, available tiers, and the matching lifecycle page`;
     static examples = [
         '<%= config.bin %> balance plan',
         '<%= config.bin %> balance plan --json',
@@ -33,7 +34,7 @@ class BalancePlan extends base_command_1.BaseCommand {
 }
 exports.default = BalancePlan;
 function renderSkyCodePlan(subscription, lifecycleUrl, log) {
-    log(`Sky Code plan — ${subscription.tierName}`);
+    log(`${auth_core_1.FIRST_PARTY_HARNESS.displayName} plan — ${subscription.tierName}`);
     log(`  Status                  ${subscription.status}`);
     log(`  Price                   $${subscription.monthlyPriceUsd}/month`);
     log(`  Current period          ${subscription.currentPeriodStart ?? 'not started'}`);
@@ -43,10 +44,13 @@ function renderSkyCodePlan(subscription, lifecycleUrl, log) {
     log(`  Concurrent sessions     ${subscription.concurrentSessions ?? 'not reported'}`);
     log(`  Requests per minute     ${subscription.rateLimitPerMin}`);
     log('');
-    log('Available Sky Code plans:');
-    for (const key of data_provider_1.SKY_CODE_PLAN_KEYS.filter((plan) => plan !== 'free')) {
-        const plan = data_provider_1.SKY_CODE_PLAN_CATALOG[key];
-        log(`  ${plan.displayName.padEnd(18)} $${plan.monthlyPriceUsd}/month · ` +
+    log(`Available ${auth_core_1.FIRST_PARTY_HARNESS.displayName} plans:`);
+    const paidPlans = data_provider_1.SKY_CODE_PLAN_KEYS.filter((plan) => plan !== 'free').map((key) => data_provider_1.SKY_CODE_PLAN_CATALOG[key]);
+    // Padded to the longest name rather than a fixed width: plan names embed the
+    // product's display name, whose length is not this renderer's to assume.
+    const nameWidth = Math.max(...paidPlans.map((plan) => plan.displayName.length)) + 1;
+    for (const plan of paidPlans) {
+        log(`  ${plan.displayName.padEnd(nameWidth)} $${plan.monthlyPriceUsd}/month · ` +
             `${(0, data_provider_1.usageMicrosToDisplayCredits)(plan.includedUsageMicros).toLocaleString()} monthly credits · ` +
             `${(0, data_provider_1.usageMicrosToDisplayCredits)(plan.fiveHourUsageMicros).toLocaleString()} per 5 hours · ` +
             `${plan.concurrentSessions} sessions · ${plan.requestsPerMinute} RPM`);

package/dist/commands/balance/usage/events.js

@@ -2,10 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderSkyCodeUsageEvents = renderSkyCodeUsageEvents;
 const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
 const base_command_1 = require("../../../base-command");
 const balance_1 = require("../../../lib/balance");
 class BalanceUsageEvents extends base_command_1.BaseCommand {
-    static description = 'List the Sky Code charges and run/session attribution behind aggregate allowance usage';
+    static description = `List the ${auth_core_1.FIRST_PARTY_HARNESS.displayName} charges and run/session attribution behind aggregate allowance usage`;
     static examples = [
         '<%= config.bin %> balance usage events',
         '<%= config.bin %> balance usage events --limit 20 --json',
@@ -44,7 +45,7 @@ class BalanceUsageEvents extends base_command_1.BaseCommand {
 }
 exports.default = BalanceUsageEvents;
 function renderSkyCodeUsageEvents(events, log) {
-    log(`Sky Code usage events · ${events.ownerType} ${events.ownerId}`);
+    log(`${auth_core_1.FIRST_PARTY_HARNESS.displayName} usage events · ${events.ownerType} ${events.ownerId}`);
     log(`  Window ${events.from} to ${events.to}`);
     if (events.items.length === 0) {
         log('  No usage events in this window.');

package/dist/commands/balance/usage.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderSkyCodeUsage = renderSkyCodeUsage;
 const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
 const base_command_1 = require("../../base-command");
 const balance_1 = require("../../lib/balance");
 /**
@@ -40,7 +41,7 @@ class BalanceUsage extends base_command_1.BaseCommand {
 }
 exports.default = BalanceUsage;
 function renderSkyCodeUsage(usage, log) {
-    log(`Sky Code ${usage.plan ?? 'current'} plan · ${usage.ownerType} ${usage.ownerId}`);
+    log(`${auth_core_1.FIRST_PARTY_HARNESS.displayName} ${usage.plan ?? 'current'} plan · ${usage.ownerType} ${usage.ownerId}`);
     log(`  Monthly used            ${(0, balance_1.formatCreditsWithUsd)(usage.monthly.usedUsageMicros)}`);
     log(`  Monthly reserved        ${(0, balance_1.formatCreditsWithUsd)(usage.monthly.reservedUsageMicros)}`);
     log(`  Monthly remaining       ${(0, balance_1.formatCreditsWithUsd)(usage.monthly.remainingUsageMicros)}`);

package/dist/commands/browser/install.js

@@ -23,8 +23,9 @@ class BrowserInstall extends core_1.Command {
     async run() {
         const { flags } = await this.parse(BrowserInstall);
         const args = ['install'];
-        // Any spelling of the first-party harness is accepted here and handed to the
-        // daemon in the spelling every installed daemon understands.
+        // Any ACCEPTED spelling of the first-party harness is handed to the daemon in
+        // the wire spelling; anything else — a retired spelling included — is forwarded
+        // unchanged for the daemon's own parser to accept or refuse.
         if (flags.harness)
             args.push('--harness', (0, harness_provider_input_1.daemonHarnessArgument)(flags.harness));
         if (flags.config)

package/dist/commands/browser/uninstall.js

@@ -23,8 +23,9 @@ class BrowserUninstall extends core_1.Command {
     async run() {
         const { flags } = await this.parse(BrowserUninstall);
         const args = ['uninstall'];
-        // Any spelling of the first-party harness is accepted here and handed to the
-        // daemon in the spelling every installed daemon understands.
+        // Any ACCEPTED spelling of the first-party harness is handed to the daemon in
+        // the wire spelling; anything else — a retired spelling included — is forwarded
+        // unchanged for the daemon's own parser to accept or refuse.
         if (flags.harness)
             args.push('--harness', (0, harness_provider_input_1.daemonHarnessArgument)(flags.harness));
         if (flags.config)

package/dist/commands/code/install.js

@@ -201,8 +201,9 @@ class CodeInstall extends base_command_1.BaseCommand {
     async installerNote(daemonId) {
         try {
             const res = await (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers`, { credential: this.resolvedCredential });
-            // Any spelling: a daemon lists the provider the way it registered it, and
-            // one that predates or postdates a rename spells it differently.
+            // Any accepted spelling: a daemon lists the provider the way it registered it,
+            // and during a rename's alias window one that predates or postdates the flip
+            // spells it differently.
             const row = (res.providers ?? []).find((p) => (0, auth_core_1.isFirstPartyHarnessProvider)(p.provider));
             const reason = row?.installDisabledReason?.trim();
             if (!reason)

package/dist/commands/harnesses/install.d.ts

@@ -46,6 +46,17 @@ export default class HarnessesInstall extends BaseCommand {
      * reason the daemon already words. Both are answered before anything runs.
      */
     private update;
+    /**
+     * Start an install or update, and survive a gateway that cut the request off.
+     *
+     * The relay holds the request while the daemon answers, and a gateway can end
+     * it first: an update returned HTTP 504 after 21.9s while the job it started
+     * ran to success, and the caller was told the outcome was unknown (OSK-10096
+     * verifier). The daemon is the only party that knows whether the request
+     * arrived, so on a server-side failure we ask it, and follow the job it
+     * started rather than reporting a result we do not have.
+     */
+    private start;
     /** Follow a job to its end, or report why it could not be followed (and return nothing). */
     private follow;
     /** What the daemon says about this provider right now, best effort. */

package/dist/commands/harnesses/install.js

@@ -74,14 +74,9 @@ class HarnessesInstall extends base_command_1.BaseCommand {
             await this.update(daemonId, provider, Boolean(flags.json));
             return;
         }
-        let start;
-        try {
-            start = await (0, cli_installers_1.startManagedCliInstall)(daemonId, provider, this.resolvedCredential);
-        }
-        catch (err) {
-            this.handleApiError(err);
+        const start = await this.start(daemonId, provider, () => (0, cli_installers_1.startManagedCliInstall)(daemonId, provider, this.resolvedCredential), Boolean(flags.json));
+        if (!start)
             return;
-        }
         const jobId = start.job?.id;
         if (!start.started || !jobId) {
             // The daemon declined and already knows why. Read its own reason off the
@@ -163,14 +158,9 @@ class HarnessesInstall extends base_command_1.BaseCommand {
             });
             return;
         }
-        let start;
-        try {
-            start = await (0, cli_installers_1.startManagedCliUpdate)(daemonId, provider, this.resolvedCredential);
-        }
-        catch (err) {
-            this.handleApiError(err);
+        const start = await this.start(daemonId, provider, () => (0, cli_installers_1.startManagedCliUpdate)(daemonId, provider, this.resolvedCredential), json);
+        if (!start)
             return;
-        }
         const jobId = start.job?.id;
         if (!start.started || !jobId) {
             this.log(start.alreadyRunning
@@ -199,6 +189,35 @@ class HarnessesInstall extends base_command_1.BaseCommand {
         this.log((0, cli_installers_1.updateOutcomeLine)(job) ??
             `${provider} updated${job.installedVersion ? ` to ${job.installedVersion}` : ''}.`);
     }
+    /**
+     * Start an install or update, and survive a gateway that cut the request off.
+     *
+     * The relay holds the request while the daemon answers, and a gateway can end
+     * it first: an update returned HTTP 504 after 21.9s while the job it started
+     * ran to success, and the caller was told the outcome was unknown (OSK-10096
+     * verifier). The daemon is the only party that knows whether the request
+     * arrived, so on a server-side failure we ask it, and follow the job it
+     * started rather than reporting a result we do not have.
+     */
+    async start(daemonId, provider, begin, json) {
+        try {
+            return await begin();
+        }
+        catch (err) {
+            const status = err.status ?? 0;
+            if (status >= 500 || status === 408) {
+                const job = await (0, cli_installers_1.jobStartedDespiteTimeout)(daemonId, provider, this.resolvedCredential);
+                if (job?.id) {
+                    if (!json) {
+                        this.logToStderr(`The request to ${daemonId} did not come back (HTTP ${status}), but the daemon started job ${job.id}. Following it.`);
+                    }
+                    return { started: true, job };
+                }
+            }
+            this.handleApiError(err);
+            return undefined;
+        }
+    }
     /** Follow a job to its end, or report why it could not be followed (and return nothing). */
     async follow(daemonId, jobId, verb, json) {
         const outcome = await (0, cli_installers_1.followManagedCliInstallJob)({

package/dist/commands/harnesses/installers.d.ts

@@ -1,4 +1,5 @@
 import { BaseCommand } from '../../base-command';
+import { type ManagedCliProviderState } from '../../lib/cli-installers';
 /**
  * What each managed provider's state is on one machine.
  *
@@ -43,3 +44,12 @@ export default class HarnessesInstallers extends BaseCommand {
      */
     private daemonIdFor;
 }
+/**
+ * What each installed CLI's update story is, as sentences under the table.
+ *
+ * Sentences, not a column: an update reason is "the copy inside Devin.app
+ * updates with that app", which no column fits. Silent for a daemon that
+ * reports no update fields at all — it cannot say, and inventing "no" for it
+ * would be worse than nothing.
+ */
+export declare function updateNotes(providers: readonly ManagedCliProviderState[], bin: string): string[];

package/dist/commands/harnesses/installers.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateNotes = updateNotes;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -126,6 +127,14 @@ class HarnessesInstallers extends base_command_1.BaseCommand {
             for (const note of notes)
                 this.log(`  ${note.provider}: ${note.detail}`);
         }
+        // The VERSION column is where a reader asks "can I get a newer one", and
+        // the answer lived only in `--json` (OSK-10096 verifier).
+        const updateLines = updateNotes(providers, this.config.bin);
+        if (updateLines.length > 0) {
+            this.log('');
+            for (const line of updateLines)
+                this.log(`  ${line}`);
+        }
         // A provider the platform knows and this daemon did not mention. Without
         // this it simply is not on the list, which reads as dropped support rather
         // than as an older daemon — `devin` arrived in the 0.8.45 daemon release, so 0.8.35
@@ -177,3 +186,25 @@ class HarnessesInstallers extends base_command_1.BaseCommand {
     }
 }
 exports.default = HarnessesInstallers;
+/**
+ * What each installed CLI's update story is, as sentences under the table.
+ *
+ * Sentences, not a column: an update reason is "the copy inside Devin.app
+ * updates with that app", which no column fits. Silent for a daemon that
+ * reports no update fields at all — it cannot say, and inventing "no" for it
+ * would be worse than nothing.
+ */
+function updateNotes(providers, bin) {
+    const lines = [];
+    for (const provider of providers) {
+        if (provider.updatable === true) {
+            lines.push(`${provider.provider}: update it with \`${bin} harnesses install ${provider.provider} --update\``);
+        }
+    }
+    for (const provider of providers) {
+        if (provider.updatable === false && provider.installed && provider.updateDisabledReason) {
+            lines.push(`${provider.provider}: ${provider.updateDisabledReason}`);
+        }
+    }
+    return lines;
+}

package/dist/commands/harnesses/list.js

@@ -421,8 +421,9 @@ class HarnessesList extends base_command_1.BaseCommand {
         // mode. Materialize that default before the request so JSON cannot quietly
         // return every historical offline row while the table shows seven live ones.
         const status = flags.online ? 'online' : (flags.status ?? (flags.all ? undefined : 'online'));
-        // Any spelling of the first-party harness filters the same rows; the server is
-        // asked for the canonical one, which it matches against every stored spelling.
+        // Any accepted spelling of the first-party harness filters the same rows; the
+        // server is asked for the canonical one, which it matches against every
+        // accepted stored spelling.
         const provider = flags.provider ? (0, harness_provider_input_1.canonicalHarnessInput)(flags.provider) : undefined;
         const params = new URLSearchParams();
         const serverStatus = serverStatusParam(status);

package/dist/commands/tasks/attachments/set-role.d.ts

@@ -0,0 +1,24 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr tasks attachments set-role <task> <attachment> --role …`
+ *
+ * The one way to change what an existing asset IS on a Task. Its real use is
+ * promotion: an agent may only upload `evidence` or `deliverable`, because an
+ * `input` is forwarded into every future Run of the Task — so when an agent's
+ * screenshot should become an input, a person promotes it here. The server
+ * refuses the call from an agent, whatever credential it holds, and moves the
+ * asset's ledger link with the role.
+ */
+export default class TasksAttachmentsSetRole extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        attachmentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        role: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tasks/attachments/set-role.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+/**
+ * `skrr tasks attachments set-role <task> <attachment> --role …`
+ *
+ * The one way to change what an existing asset IS on a Task. Its real use is
+ * promotion: an agent may only upload `evidence` or `deliverable`, because an
+ * `input` is forwarded into every future Run of the Task — so when an agent's
+ * screenshot should become an input, a person promotes it here. The server
+ * refuses the call from an agent, whatever credential it holds, and moves the
+ * asset's ledger link with the role.
+ */
+class TasksAttachmentsSetRole extends base_command_1.BaseCommand {
+    static description = "Change an attachment's role (input, evidence, or deliverable). Making an asset an input " +
+        'sends it into every future Run of the task, so only a person can change a role.';
+    static examples = [
+        '<%= config.bin %> tasks attachments set-role <task-id> <attachment-id> --role input',
+        '<%= config.bin %> tasks attachments set-role <task-id> <attachment-id> --role evidence --json',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Task ID', required: true, ignoreStdin: true }),
+        attachmentId: core_1.Args.string({ description: 'Attachment ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        role: core_1.Flags.string({
+            required: true,
+            options: ['input', 'evidence', 'deliverable'],
+            description: 'input (forwarded into every future Run), evidence (supports an Update or Result), or deliverable (the media is the product)',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksAttachmentsSetRole);
+        let attachment;
+        try {
+            attachment = await data_provider_1.dataService.setTaskAttachmentRole({
+                taskId: args.id,
+                attachmentId: args.attachmentId,
+                role: flags.role,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(attachment, null, 2));
+            return;
+        }
+        const name = attachment.originalName || attachment.id;
+        const effect = attachment.role === 'input'
+            ? ' It will be sent into every future Run of this task.'
+            : ' It is no longer sent into Runs.';
+        this.log(`${name} is now ${attachment.role}.${effect}`);
+    }
+}
+exports.default = TasksAttachmentsSetRole;

package/dist/commands/tasks/attachments/upload.d.ts

@@ -8,6 +8,7 @@ export default class TasksAttachmentsUpload extends BaseCommand {
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        role: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/tasks/attachments/upload.js

@@ -1,50 +1,14 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const node_buffer_1 = require("node:buffer");
 const core_1 = require("@oclif/core");
-const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
-const file_mime_1 = require("../../../lib/file-mime");
+const task_asset_upload_1 = require("../../../lib/task-asset-upload");
 class TasksAttachmentsUpload extends base_command_1.BaseCommand {
     static description = 'Upload a file attachment to a task';
     static examples = [
         '<%= config.bin %> tasks attachments upload <task-id> --file ./report.pdf',
         '<%= config.bin %> tasks attachments upload <task-id> --file ./screenshot.png --json',
+        '<%= config.bin %> tasks attachments upload <task-id> --file ./demo.mp4 --role deliverable',
     ];
     static args = {
         id: core_1.Args.string({ description: 'Task ID', required: true, ignoreStdin: true }),
@@ -52,32 +16,34 @@ class TasksAttachmentsUpload extends base_command_1.BaseCommand {
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         file: core_1.Flags.string({ description: 'Path to the file to upload', required: true }),
+        role: core_1.Flags.string({
+            description: 'Asset role: evidence (supports an Update/Result), deliverable (the media is the product), or input (forwarded into every future Run — only a person may add one; a person promotes an agent upload with `attachments set-role`). Defaults to evidence when an agent uploads, input when a person does.',
+            options: ['input', 'evidence', 'deliverable'],
+        }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(TasksAttachmentsUpload);
-        const filePath = flags.file;
-        if (!fs.existsSync(filePath)) {
-            this.error(`File not found: ${filePath}`, { exit: 1 });
-        }
-        const buf = fs.readFileSync(filePath);
-        const filename = path.basename(filePath);
-        const fd = new FormData();
-        const mimeType = (0, file_mime_1.mimeTypeForFilename)(filename);
-        fd.append('file', new node_buffer_1.Blob([buf], { type: mimeType }), filename);
-        let result;
+        // The pipeline — buffered vs direct, session vs generic — lives in
+        // task-asset-upload.ts so `--attach` on updates/result/complete/comments
+        // makes the same routing decisions byte for byte (OSK-9863).
+        let asset;
         try {
-            result = await data_provider_1.dataService.uploadTaskAttachment({ taskId: args.id, formData: fd });
+            asset = await (0, task_asset_upload_1.uploadTaskAssetFile)({
+                taskId: args.id,
+                filePath: flags.file,
+                role: flags.role,
+            });
         }
         catch (err) {
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(result, null, 2));
+            this.log(JSON.stringify(asset, null, 2));
             return;
         }
-        const a = result;
-        this.log(`Uploaded ${filename} (${buf.byteLength} bytes) → attachment ${a.id ?? a._id ?? '?'}`);
+        const dedup = asset.deduplicated ? ' (deduplicated — already on the task)' : '';
+        this.log(`Uploaded ${asset.filename} → attachment ${asset.id}${dedup}`);
     }
 }
 exports.default = TasksAttachmentsUpload;

package/dist/commands/tasks/comments/add.d.ts

@@ -16,6 +16,7 @@ export default class TasksCommentsAdd extends BaseCommand {
         'parent-comment': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'anchor-mark-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'anchor-quote': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        attach: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
     /**

package/dist/commands/tasks/comments/add.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_crypto_1 = require("node:crypto");
 const core_1 = require("@oclif/core");
@@ -55,6 +88,11 @@ class TasksCommentsAdd extends base_command_1.BaseCommand {
         'anchor-quote': core_1.Flags.string({
             description: 'Captured quote for the anchor (≤1000 chars; truncated to 500 to match the editor). Enables inline-comment mode when used without --anchor-mark-id.',
         }),
+        attach: core_1.Flags.string({
+            multiple: true,
+            description: 'Upload a file as a Task asset and reference it in the comment body ' +
+                '(`![name](task-asset:<id>)`, resolved to a signed URL at read time). Repeatable.',
+        }),
     };
     async run() {
         this.requireAuth();
@@ -107,9 +145,36 @@ class TasksCommentsAdd extends base_command_1.BaseCommand {
         // mentionedAgentIds, reopen, and interrupt are preserved. Boolean flags
         // default to false; only pass them through when actually set so they
         // don't clobber a `true` value from the JSON file.
+        // --attach: upload first, then append `task-asset:` references to the
+        // body — comments store stable asset ids, not URLs (OSK-9856/9863).
+        let attachSuffix = '';
+        if (flags.attach?.length) {
+            const { uploadTaskAssetFile, taskAssetMarkdownRef } = await Promise.resolve().then(() => __importStar(require('../../../lib/task-asset-upload')));
+            const refs = [];
+            for (const filePath of flags.attach) {
+                try {
+                    const asset = await uploadTaskAssetFile({
+                        taskId: task.id,
+                        filePath,
+                        role: 'evidence',
+                    });
+                    refs.push(taskAssetMarkdownRef(asset));
+                }
+                catch (err) {
+                    this.error(`--attach failed: ${err.message}`, { exit: 1 });
+                }
+            }
+            if (refs.length)
+                attachSuffix = `\n\n${refs.join('\n')}`;
+        }
         const mentionedFromFlag = flags['mention-agent'];
+        const baseBody = flags.body ?? (typeof commentBody.body === 'string' ? commentBody.body : undefined);
         const data = (0, prompt_1.mergeDefined)(commentBody, {
-            body: flags.body,
+            body: baseBody
+                ? `${baseBody}${attachSuffix}`
+                : attachSuffix
+                    ? attachSuffix.trimStart()
+                    : undefined,
             mentionedAgentIds: Array.isArray(mentionedFromFlag) && mentionedFromFlag.length > 0
                 ? mentionedFromFlag
                 : undefined,
@@ -163,7 +228,7 @@ class TasksCommentsAdd extends base_command_1.BaseCommand {
                 ? await (0, api_fetch_1.apiFetch)(sessionPath, {
                     method: 'POST',
                     body: {
-                        body: flags.body ?? commentBody.body,
+                        body: data.body,
                         ...(mentioned ? { mentionedAgentIds: mentioned } : {}),
                     },
                     headers: { 'X-Idempotency-Key': idempotencyKey },

package/dist/commands/tasks/complete.d.ts

@@ -26,6 +26,7 @@ export default class TasksComplete extends BaseCommand {
         'structured-json': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         deliverable: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         evidence: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        attach: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         remaining: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'source-run': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'run-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;