@skrr-ai/cli 0.1.49 → 0.1.51

package/README.md

@@ -1247,11 +1247,12 @@ Create a new goal. `--title` is required unless supplied via `--from-json`.
 ```bash
 sky goals create --title "Ship Q2 roadmap"
 sky goals create --title "Milestone 1" --level milestone --parent <parent-id>
+sky goals create --title "Launch" --label <existing-label-id>
 sky goals create --from-json goal.json
 ```
 
 Flags: `--title`, `--description`, `--level`, `--parent`, `--owner-agent`,
-`--dri-agent`, `--dri-user`, `--from-json <file|->`, `--json`.
+`--dri-agent`, `--dri-user`, `--label` (repeatable), `--from-json <file|->`, `--json`.
 
 ### `sky goals update <id>`
 
@@ -1351,7 +1352,7 @@ sky tasks create --title "QA pass" \
   --assignee-agent <agent-id> \
   --assignee-agent <other-agent-id> \
   --tag release --tag urgent \
-  --label-id <existing-label-id>
+  --label <existing-label-id>
 sky tasks create --title "Follow up" --source-conversation <conversation-id>
 sky tasks create --title "Spec task" --external-key ws0/spec --dry-run --json
 sky tasks create --from-json task.json
@@ -1379,14 +1380,14 @@ are globally resolvable.
 
 Tags are lightweight free-form keywords. Labels are shared workspace taxonomy
 and are attached by opaque ID; discover existing IDs with
-`sky tasks labels list --json`. Both are optional and repeatable at creation.
+`sky labels list --applicable-to task`. Both are optional and repeatable at creation.
 
 Flags: `--title`, `--description`, `--description-format`, `--external-key`,
 `--default-agent`,
 `--priority`, `--parent`, `--space`, `--goal`,
 `--source-conversation`, `--source-message`, `--assignee-agent`
 (repeatable), `--assignee-user` (repeatable), `--due-date`, `--tag`
-(repeatable), `--label-id` (repeatable), `--from-json <file|->`, `--dry-run`,
+(repeatable), `--label` (repeatable; `--label-id` is a compatibility alias), `--from-json <file|->`, `--dry-run`,
 `--json`.
 
 ### `sky tasks upsert`

package/dist/base-command.js

@@ -29,6 +29,7 @@ var keychain_1 = require("./lib/keychain");
 Object.defineProperty(exports, "resolveProfileFromArgv", { enumerable: true, get: function () { return keychain_1.resolveProfileFromArgv; } });
 const data_provider_1 = require("@skrr-ai/data-provider");
 const auth_core_1 = require("@skrr-ai/auth-core");
+const auth_failure_1 = require("./lib/auth-failure");
 const assignee_resolver_1 = require("./lib/assignee-resolver");
 const task_ref_resolver_1 = require("./lib/task-ref-resolver");
 const space_resolver_1 = require("./lib/space-resolver");
@@ -298,10 +299,22 @@ class BaseCommand extends core_1.Command {
                     const accessToken = autoResult.outcome.accessToken;
                     this.resolvedCredential = {
                         token: accessToken,
-                        // The backend the broker actually wrote to. Hard-coding
-                        // 'keychain' labelled a Linux credential (always the file)
-                        // "macOS Keychain" in the same process that minted it.
-                        source: autoResult.outcome.storedIn === 'keychain' ? 'keychain' : 'file',
+                        // A `brokered` outcome is a daemon-owned access token held for
+                        // THIS process only — nothing was persisted, so no stored-backend
+                        // label applies. 'env-token' is the honest slot the shared
+                        // CredentialSource union has for "a token this process holds in
+                        // memory": `ensureFreshCliCredential` skips non-stored sources,
+                        // which is correct — renewal happens by re-redeeming the
+                        // descriptor (see api-fetch's 401 path), not by rotating a
+                        // family that was never ours.
+                        source: autoResult.outcome.brokered
+                            ? 'env-token'
+                            : // The backend the broker actually wrote to. Hard-coding
+                                // 'keychain' labelled a Linux credential (always the file)
+                                // "macOS Keychain" in the same process that minted it.
+                                autoResult.outcome.storedIn === 'keychain'
+                                    ? 'keychain'
+                                    : 'file',
                         kind: (0, auth_core_1.classifyTokenKind)(accessToken),
                     };
                 }
@@ -990,16 +1003,29 @@ class BaseCommand extends core_1.Command {
                 // `login` sends a CI job to do the one thing it cannot, and hides the
                 // real mistake (dogfood OSK-4693). Name the credential instead.
                 const presentedCiToken = Boolean(this.resolvedCredential?.token?.startsWith('osk_ci_'));
+                // OSK-12116 — the 401 is usually the SECOND failure: the token expired
+                // (routine) and renewing it was refused (the fault). The server's code
+                // for the retry is `TOKEN_EXPIRED`, which names the routine half; the
+                // latched refresh refusal names the half the reader can act on.
+                const refreshRefusal = presentedCiToken
+                    ? null
+                    : (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
+                        bin: this.config.bin,
+                        cliId: this.cliConfig?.cliId,
+                    });
                 this.failWithCliError({
                     message: say(presentedCiToken
                         ? `Authentication failed: this is an \`osk_ci_*\` token, which only bootstraps a ` +
                             `daemon (\`OVERSKY_TOKEN=<token> skrrd start\`). ${this.config.bin} commands do ` +
                             `not accept it — sign in with \`${this.config.bin} login\` instead.`
-                        : `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`),
-                    code: bodyCode || 'AUTHENTICATION_FAILED',
+                        : refreshRefusal
+                            ? `Authentication failed. ${refreshRefusal.message}`
+                            : `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`),
+                    code: refreshRefusal?.code || bodyCode || 'AUTHENTICATION_FAILED',
                     status: e.status,
                     exit: exitCode,
                     retryable: true,
+                    ...(refreshRefusal && bodyCode ? { details: { accessTokenCode: bodyCode } } : {}),
                 });
             }
             else if ((e.status === 403 || e.status === 504) &&
@@ -1275,6 +1301,36 @@ class BaseCommand extends core_1.Command {
         // attempt is assumed absent.
         const outage = (0, outbox_1.isOutageFailure)(err);
         const statusSuffix = e.status ? ` (HTTP ${e.status})` : '';
+        // OSK-12121 — a 401 is queued (the payload is authored, and it is worth
+        // keeping until someone signs in again), but it is an AUTHENTICATION
+        // failure, and saying "did not accept this write" left the reader to guess
+        // that. Lead with the sign-in, name the refused refresh when one is latched,
+        // and give the order the fix has to happen in: sign in, THEN replay.
+        if (e.status === 401) {
+            const refusal = (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
+                bin: this.config.bin,
+                cliId: this.cliConfig?.cliId,
+            });
+            const why = refusal
+                ? refusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
+                : 'The server did not accept this sign-in.';
+            this.failWithCliError({
+                message: `Authentication failed${statusSuffix}. ${why} Your ${write.summary} was not applied; it ` +
+                    `was saved locally as ${queuedId} so it is not lost. Sign in with ` +
+                    `\`${this.config.bin} login\`, then replay it with \`${this.config.bin} outbox retry\` ` +
+                    `(or discard it with \`${this.config.bin} outbox drop ${queuedId}\`).`,
+                code: refusal?.code || 'AUTHENTICATION_FAILED',
+                status: e.status,
+                exit: this.bareMode ? 75 : 2,
+                retryable: true,
+                details: {
+                    queued: true,
+                    outboxId: queuedId,
+                    idempotencyKey: write.idempotencyKey,
+                    ...(e.code ? { accessTokenCode: e.code } : {}),
+                },
+            });
+        }
         const lead = outage
             ? `${this.cliConfig.baseURL} is not serving requests right now${statusSuffix}. ` +
                 `Your ${write.summary} was queued locally as ${queuedId}; whether the server already ` +
@@ -1407,6 +1463,19 @@ function parseGlobalFlags(argv) {
     }
     return { bare, token, workspace };
 }
+/**
+ * The latched permanent refresh refusal, if any. Never throws: a surface that
+ * cannot read the latch falls back to its generic wording (OSK-12116).
+ */
+function readRefreshRefusal() {
+    try {
+        const state = (0, auth_core_1.needsReauthState)();
+        return state.needed ? { reason: state.reason, message: state.message } : null;
+    }
+    catch {
+        return null;
+    }
+}
 function parseErrorBody(body) {
     if (!body)
         return null;

package/dist/commands/agents/chat.d.ts

@@ -1,3 +1,4 @@
+import { dataService } from '@skrr-ai/data-provider';
 import { BaseCommand } from '../../base-command';
 import { type AgenticStreamResult, type ReconciledTerminal } from '../../lib/agentic-stream';
 /**
@@ -141,6 +142,17 @@ export declare function daemonPinFields(localSkills: {
         pathHash: string;
     }>;
 } | Record<string, never>;
+type ChatPermissionMode = NonNullable<Parameters<typeof dataService.startAgenticChat>[0]['permissionMode']>;
+/**
+ * The per-turn permission-mode fragment of the chat-start payload (OSK-12124).
+ * It rides the same request layer the web composer's picker sends, which the
+ * server already honours above the agent's and the harness's stored defaults —
+ * so switching one conversation no longer means changing the agent for every
+ * conversation it has.
+ */
+export declare function permissionModeFields(mode: string | undefined): {
+    permissionMode: ChatPermissionMode;
+} | Record<string, never>;
 export default class AgentsChat extends BaseCommand {
     static description: string;
     static examples: string[];
@@ -157,6 +169,7 @@ export default class AgentsChat extends BaseCommand {
         jsonl: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'approve-tools': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'permission-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'local-skill': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         task: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
@@ -182,3 +195,4 @@ export default class AgentsChat extends BaseCommand {
     private resolveLocalSkills;
     run(): Promise<void>;
 }
+export {};

package/dist/commands/agents/chat.js

@@ -9,6 +9,7 @@ exports.noOutputFailureMessage = noOutputFailureMessage;
 exports.noStreamJsonPayload = noStreamJsonPayload;
 exports.chatStreamHeaderLines = chatStreamHeaderLines;
 exports.daemonPinFields = daemonPinFields;
+exports.permissionModeFields = permissionModeFields;
 const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -157,6 +158,11 @@ function noStreamJsonPayload(input) {
         responseMessageId: result.responseMessageId,
         status: result.status,
         response: result.text,
+        // The model a local harness reported running (OSK-12111). Absent on a
+        // cloud turn and on a harness that reports none.
+        ...(typeof result.lastEvent?.harnessModel === 'string' && result.lastEvent.harnessModel
+            ? { harnessModel: result.lastEvent.harnessModel }
+            : {}),
         ...(result.status === 'failed'
             ? {
                 failureReason: result.lastEvent?.reason ??
@@ -211,11 +217,22 @@ function daemonPinFields(localSkills, daemonFlag) {
     }
     return {};
 }
+/**
+ * The per-turn permission-mode fragment of the chat-start payload (OSK-12124).
+ * It rides the same request layer the web composer's picker sends, which the
+ * server already honours above the agent's and the harness's stored defaults —
+ * so switching one conversation no longer means changing the agent for every
+ * conversation it has.
+ */
+function permissionModeFields(mode) {
+    return mode ? { permissionMode: mode } : {};
+}
 class AgentsChat extends base_command_1.BaseCommand {
     static description = 'Run an agent turn with live streaming, tool events, cancellation, and reconnects';
     static examples = [
         '<%= config.bin %> agents chat <agent-id> --prompt "Review the open tasks"',
         '<%= config.bin %> agents chat <agent-id> --prompt "Deploy the fix" --approve-tools',
+        '<%= config.bin %> agents chat <agent-id> --conversation <id> --prompt "Now apply it" --permission-mode acceptEdits',
         '<%= config.bin %> agents chat <agent-id> --prompt "Summarize" --jsonl',
         '<%= config.bin %> agents chat <agent-id> --prompt "Summarize" --no-stream --json',
         '<%= config.bin %> agents chat <agent-id> --prompt "Review this diff" --local-skill code-review',
@@ -250,7 +267,12 @@ class AgentsChat extends base_command_1.BaseCommand {
                 '`stream.gap` event means envelopes in that seq range never arrived and the streamed ' +
                 'text is short; `run.result` and the persisted message remain authoritative. Tool ' +
                 'calls arrive as `tool.started` / `tool.completed`, once per `toolUseId`, on cloud ' +
-                'and local-harness runs alike.',
+                'and local-harness runs alike. A `session.notice` with `notice: ' +
+                '"harness-session-reset"` means the local harness could not resume its previous ' +
+                'session and started a new one; `message` says why. A `permission.resolved` says ' +
+                'how a local harness permission request was decided: `decidedBy` in words, and ' +
+                '`basis` — `person` (with `surface`), `mode` (with `mode`), `policy` or ' +
+                '`session-grant` — beside the wire `by`.',
         }),
         json: core_1.Flags.boolean({
             description: 'Emit the final one-shot response as JSON (use with --no-stream)',
@@ -260,6 +282,15 @@ class AgentsChat extends base_command_1.BaseCommand {
                 'with no terminal the flag itself is the approval for this turn, and each one is ' +
                 'reported on the stream. Without it every such call is denied.',
         }),
+        'permission-mode': core_1.Flags.string({
+            description: 'Permission mode for THIS turn only, on a local-harness agent. It beats the agent’s and ' +
+                'the harness’s stored defaults for this turn and changes nothing else — pass it again ' +
+                'on each turn that needs it (`agents update --default-permission-mode` changes every ' +
+                'conversation of the agent). A mode the harness cannot honour runs as the one it can, ' +
+                'and run.started says which. --approve-tools is separate: it answers the approval ' +
+                'prompts a mode asks for.',
+            options: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
+        }),
         'local-skill': core_1.Flags.string({
             description: 'Invoke a skill on your machine on this turn, as `skrr skills local` lists it: its ' +
                 'name, or <root>/<name> when two roots share one. The turn runs on that machine. ' +
@@ -354,6 +385,10 @@ class AgentsChat extends base_command_1.BaseCommand {
                 'response and streams no events. Use --quick --json for a machine-readable ' +
                 'one-shot, or drop --quick for a real streamed turn.', { exit: 2 });
         }
+        if (flags.quick && flags['permission-mode']) {
+            this.error('--permission-mode has no meaning with --quick: the persona-only summarizer runs no ' +
+                'tools, so there is nothing for a mode to govern. Drop --quick for a real turn.', { exit: 2 });
+        }
         if (flags.quick && flags['local-skill']?.length) {
             this.error('--local-skill has no meaning with --quick: the persona-only summarizer runs no ' +
                 'runtime, so no skill on your machine can load. Drop --quick for a real turn.', { exit: 2 });
@@ -485,6 +520,7 @@ class AgentsChat extends base_command_1.BaseCommand {
                 // execution policy places it elsewhere keeps that placement, and the
                 // run fails saying why rather than running without the skill.
                 ...daemonPinFields(localSkills, flags.daemon),
+                ...permissionModeFields(flags['permission-mode']),
             });
         }
         catch (err) {

package/dist/commands/agents/create.js

@@ -163,10 +163,11 @@ class AgentsCreate extends base_command_1.BaseCommand {
         }),
         description: core_1.Flags.string({ description: 'Agent description' }),
         provider: core_1.Flags.string({
-            description: 'Model provider (required unless set via --from-json)',
+            description: 'Model provider (default: agentic when --name is given)',
         }),
         model: core_1.Flags.string({
-            description: 'Model identifier (required unless set via --from-json)',
+            description: 'Model identifier (default: `default`, auto-routing). On a local harness, any id the harness ' +
+                'accepts — `skrr harnesses models <harness>` lists the known ones.',
         }),
         instructions: core_1.Flags.string({
             description: 'Initial raw custom instructions (creates one inline block; use `agents instructions` to compose reusable blocks later)',
@@ -199,7 +200,9 @@ class AgentsCreate extends base_command_1.BaseCommand {
             description: 'Single-purpose agent: skip the system-managed relationship portfolio (conversation continuity, relationship pulse, commitment incubator, open-loop closer). Self-reflection is still seeded.',
         }),
         'default-permission-mode': core_1.Flags.string({
-            description: 'Default Claude permission mode for sessions',
+            description: "Permission mode for this agent's local-harness sessions (every harness, not only Claude Code). " +
+                'One-shot harnesses (gemini, opencode, cursor, copilot, goose, pi, openclaw) can only run as ' +
+                'bypassPermissions; any other mode is refused for them.',
             options: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
         }),
         tools: core_1.Flags.string({
@@ -242,19 +245,23 @@ class AgentsCreate extends base_command_1.BaseCommand {
             description: 'When this agent schedules its own work: HH:MM-HH:MM[@<IANA timezone>], e.g. ' +
                 '09:00-18:00@America/Los_Angeles',
         }),
+        // Retired (OSK-11975): a Commitment turn works under the Agent's own
+        // permissions, so these three are stored but no longer read at runtime.
         'reasoning-tool-escape': core_1.Flags.string({
-            description: 'Tool a reasoning-only turn may still use (repeatable; replaces the list). ' +
-                'These are ESCAPES, not a fenced tool surface.',
+            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.REASONING_TOOL_ESCAPES],
             multiple: true,
+            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
         }),
         'commitment-responsibility': core_1.Flags.string({
-            description: "Default work authority for this agent's commitments",
+            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
+            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
         }),
         'commitment-responsibility-ceiling': core_1.Flags.string({
-            description: 'Ceiling a commitment may not exceed, whatever it asks for',
+            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
+            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
         }),
         'max-turns': core_1.Flags.integer({ description: 'Maximum turns in one agent run (1-500)' }),
         'tool-resources': core_1.Flags.string({

package/dist/commands/agents/show.d.ts

@@ -13,6 +13,15 @@ export declare function agentToneLine(agent: {
     toneMode?: unknown;
     toneId?: unknown;
 }): string;
+/**
+ * The permission mode this agent runs with on its harness, and the layer that
+ * decided it (OSK-12069). The server resolves it (`effectivePermissionMode`) the
+ * way the dispatch does; the stored agent field alone is one of four layers, so
+ * printing it read "not set" for an agent whose harness default governed.
+ * Falls back to the stored field against a server that does not send the
+ * resolution, and says that is all it knows.
+ */
+export declare function agentPermissionLines(agent: Record<string, unknown>, harness: string): string[];
 /** Text rendering is deliberately based on the server projection, with a
  * storage-shape fallback while all stored policies are migrated. */
 export declare function agentExecutionOrderLines(agent: Record<string, unknown>): string[];

package/dist/commands/agents/show.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.agentToneLine = agentToneLine;
+exports.agentPermissionLines = agentPermissionLines;
 exports.agentExecutionOrderLines = agentExecutionOrderLines;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -31,6 +32,46 @@ function agentToneLine(agent) {
         return 'inherit — see `skrr agents tone show`';
     return '-';
 }
+const PERMISSION_SOURCE_LABELS = {
+    agent: "this agent's default",
+    harness: "the harness's default",
+};
+/**
+ * The permission mode this agent runs with on its harness, and the layer that
+ * decided it (OSK-12069). The server resolves it (`effectivePermissionMode`) the
+ * way the dispatch does; the stored agent field alone is one of four layers, so
+ * printing it read "not set" for an agent whose harness default governed.
+ * Falls back to the stored field against a server that does not send the
+ * resolution, and says that is all it knows.
+ */
+function agentPermissionLines(agent, harness) {
+    const effective = agent.effectivePermissionMode;
+    const pad = '             ';
+    if (!effective || typeof effective.source !== 'string') {
+        const stored = typeof agent.defaultPermissionMode === 'string' && agent.defaultPermissionMode
+            ? agent.defaultPermissionMode
+            : "not set on the agent (the harness's or the daemon's default applies)";
+        return [`Permission:  ${stored} — enforced by the ${harness} harness`];
+    }
+    const lines = [];
+    if (typeof effective.mode === 'string' && effective.mode) {
+        const from = PERMISSION_SOURCE_LABELS[effective.source] ?? effective.source;
+        lines.push(`Permission:  ${effective.mode} (from ${from}) — enforced by the ${harness} harness`);
+    }
+    else {
+        lines.push(`Permission:  set by the daemon's own config on that machine — no agent or harness mode is set`);
+    }
+    if (typeof effective.coercedFrom === 'string' && effective.coercedFrom) {
+        lines.push(`${pad}${effective.coercedFrom} is configured, but ${harness} cannot honour it, so it runs as ${String(effective.mode)}.`);
+    }
+    const supported = Array.isArray(effective.supportedModes)
+        ? effective.supportedModes.filter((m) => typeof m === 'string')
+        : [];
+    if (supported.length > 0)
+        lines.push(`${pad}${harness} accepts: ${supported.join(', ')}`);
+    lines.push(`${pad}A turn's own mode (\`agents chat --permission-mode\`) overrides this for that turn.`);
+    return lines;
+}
 /** Text rendering is deliberately based on the server projection, with a
  * storage-shape fallback while all stored policies are migrated. */
 function agentExecutionOrderLines(agent) {
@@ -163,6 +204,18 @@ class AgentsShow extends base_command_1.BaseCommand {
             this.log(line);
         if (a.harnessName || a.harnessProvider || a.harnessStatus) {
             this.log(`Harness:     ${a.harnessName ?? (typeof a.harnessProvider === 'string' ? (0, harness_provider_input_1.canonicalHarnessInput)(a.harnessProvider) : a.harnessProvider) ?? '-'}${a.harnessStatus ? ` (${a.harnessStatus})` : ''}`);
+            // On a harness, the HARNESS decides what runs and which permission modes
+            // exist — `Provider` is only the cloud model contract, so an agent read
+            // as "anthropic" while running Codex (OSK-12071). And the mode itself was
+            // visible only in --json (OSK-12069).
+            if (typeof a.harnessProvider === 'string' && a.harnessProvider) {
+                const harness = (0, harness_provider_input_1.canonicalHarnessInput)(a.harnessProvider);
+                for (const line of agentPermissionLines(a, harness))
+                    this.log(line);
+                if (typeof a.provider === 'string' && a.provider && a.provider !== harness) {
+                    this.log(`             Runs on ${harness}; Provider "${a.provider}" is only the cloud model contract.`);
+                }
+            }
             // An offline engine is the difference between "this agent works" and
             // "this agent silently does nothing", and the display name alone cannot
             // carry it: two runtimes for the same machine share an identical name,

package/dist/commands/agents/update.d.ts

@@ -55,3 +55,12 @@ export default class AgentsUpdate extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * What changing the agent's default permission mode actually changed
+ * (OSK-12124). It is the AGENT's default, so it governs every conversation,
+ * task run and Commitment Run of the agent from its next turn — which the bare
+ * "Updated agent" line never said, and the only way to learn that a live
+ * conversation picked it up was to spend another turn. Names the per-turn
+ * alternative for the case that wanted one conversation changed.
+ */
+export declare function defaultPermissionModeNote(requested: string | undefined, updated: Record<string, unknown>): string | null;

package/dist/commands/agents/update.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultPermissionModeNote = defaultPermissionModeNote;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agent_visual_refs_1 = require("../../lib/agent-visual-refs");
@@ -49,7 +50,11 @@ class AgentsUpdate extends base_command_1.BaseCommand {
             description: 'Default working directory for local Harness sessions',
         }),
         'default-permission-mode': core_1.Flags.string({
-            description: 'Default Claude permission mode for sessions',
+            description: "Permission mode for this agent's local-harness sessions (every harness, not only Claude Code). " +
+                'It is the default for EVERY conversation, task run and Commitment Run of the agent; for one ' +
+                'turn only use `agents chat --permission-mode`. ' +
+                'One-shot harnesses (gemini, opencode, cursor, copilot, goose, pi, openclaw) can only run as ' +
+                'bypassPermissions; any other mode is refused for them.',
             options: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
         }),
         tools: core_1.Flags.string({
@@ -93,19 +98,23 @@ class AgentsUpdate extends base_command_1.BaseCommand {
             description: 'When this agent schedules its own work: HH:MM-HH:MM[@<IANA timezone>], e.g. ' +
                 '09:00-18:00@America/Los_Angeles',
         }),
+        // Retired (OSK-11975): a Commitment turn works under the Agent's own
+        // permissions, so these three are stored but no longer read at runtime.
         'reasoning-tool-escape': core_1.Flags.string({
-            description: 'Tool a reasoning-only turn may still use (repeatable; replaces the list). ' +
-                'These are ESCAPES, not a fenced tool surface.',
+            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.REASONING_TOOL_ESCAPES],
             multiple: true,
+            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
         }),
         'commitment-responsibility': core_1.Flags.string({
-            description: "Default work authority for this agent's commitments",
+            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
+            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
         }),
         'commitment-responsibility-ceiling': core_1.Flags.string({
-            description: 'Ceiling a commitment may not exceed, whatever it asks for',
+            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
+            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
         }),
         'max-turns': core_1.Flags.integer({ description: 'Maximum turns in one agent run (1-500)' }),
         'tool-resources': core_1.Flags.string({
@@ -207,6 +216,30 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         const a = updated;
         this.log(`Updated agent ${a.id ?? a._id ?? args.id} — ${a.name ?? '(no name)'}`);
         this.log(`URL: ${(0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, { ...a, id: a.id ?? a._id ?? args.id }).url ?? '-'}`);
+        const modeNote = defaultPermissionModeNote(flags['default-permission-mode'], a);
+        if (modeNote)
+            this.log(modeNote);
     }
 }
 exports.default = AgentsUpdate;
+/**
+ * What changing the agent's default permission mode actually changed
+ * (OSK-12124). It is the AGENT's default, so it governs every conversation,
+ * task run and Commitment Run of the agent from its next turn — which the bare
+ * "Updated agent" line never said, and the only way to learn that a live
+ * conversation picked it up was to spend another turn. Names the per-turn
+ * alternative for the case that wanted one conversation changed.
+ */
+function defaultPermissionModeNote(requested, updated) {
+    if (!requested)
+        return null;
+    const stored = typeof updated.defaultPermissionMode === 'string' && updated.defaultPermissionMode
+        ? updated.defaultPermissionMode
+        : requested;
+    return [
+        `Permission: ${stored} is now this agent's default for EVERY conversation, task run and`,
+        '            Commitment Run, starting with each one’s next turn. A turn that names its own',
+        '            mode still wins. To change one turn only, leave the default alone and pass',
+        `            \`skrr agents chat <agent> --conversation <id> --permission-mode ${requested}\`.`,
+    ].join('\n');
+}

package/dist/commands/balance/show.d.ts

@@ -1,5 +1,6 @@
 import type { TSkyCodeUsageSnapshot } from '@skrr-ai/data-provider';
 import { BaseCommand } from '../../base-command';
+import type { WorkspaceBalance } from '../../lib/balance';
 import { type RuntimeMonthlySpend } from '../../lib/harnesses';
 /**
  * The hosted-runtime monthly cap rows, as lines.
@@ -8,6 +9,32 @@ import { type RuntimeMonthlySpend } from '../../lib/harnesses';
  * the wording is part of the observable contract and is pinned directly.
  */
 export declare function renderRuntimeSpend(spend: RuntimeMonthlySpend[], log: (line: string) => void): void;
+/**
+ * The workspace the next session on this machine is billed to, and why that one.
+ *
+ * `selected`: `workspaces use` / `--workspace` / a daemon handoff put it in
+ * `OVERSKY_WORKSPACE_ID`. `default`: nothing is selected, so the session carries
+ * the caller's server-side default workspace — the same resolution `whoami` and
+ * `workspaces list` describe ("resolves to your default workspace").
+ */
+export interface SessionBillingTarget {
+    workspaceId: string;
+    name?: string;
+    source: 'selected' | 'default';
+}
+/**
+ * The account the NEXT session bills against, as lines — printed FIRST (OSK-12122).
+ *
+ * `skrr balance` opened on the personal account, so a user whose sessions bill
+ * the default workspace read `Credits: 999,503,672,326 ($999,503.67)` while every
+ * session was refused against that workspace's $0. The screen that exists to
+ * answer "why was I refused for credit" answered for the one account the
+ * refusal was not about, and nothing on it said which account that was.
+ *
+ * `balance` absent means the read failed: say so, never print a figure.
+ * Pure so the wording is pinned directly, like `renderRuntimeSpend`.
+ */
+export declare function renderSessionBillingAccount(target: SessionBillingTarget, balance: WorkspaceBalance | null, log: (line: string) => void, bin?: string): void;
 /**
  * Your plan's ceilings, as lines.
  *
@@ -66,6 +93,13 @@ export default class BalanceShow extends BaseCommand {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * Which workspace the next session carries: the selected one, else the
+     * caller's default. Fail-open — an unreadable listing with nothing selected
+     * returns null and the screen falls back to the personal view it always had,
+     * rather than guessing an account.
+     */
+    private resolveSessionBillingTarget;
     /**
      * Your plan's ceilings, beside the balance they are spent before.
      *