@skrr-ai/cli 0.1.50 → 0.1.51

package/dist/base-command.js

@@ -29,6 +29,7 @@ var keychain_1 = require("./lib/keychain");
 Object.defineProperty(exports, "resolveProfileFromArgv", { enumerable: true, get: function () { return keychain_1.resolveProfileFromArgv; } });
 const data_provider_1 = require("@skrr-ai/data-provider");
 const auth_core_1 = require("@skrr-ai/auth-core");
+const auth_failure_1 = require("./lib/auth-failure");
 const assignee_resolver_1 = require("./lib/assignee-resolver");
 const task_ref_resolver_1 = require("./lib/task-ref-resolver");
 const space_resolver_1 = require("./lib/space-resolver");
@@ -1002,16 +1003,29 @@ class BaseCommand extends core_1.Command {
                 // `login` sends a CI job to do the one thing it cannot, and hides the
                 // real mistake (dogfood OSK-4693). Name the credential instead.
                 const presentedCiToken = Boolean(this.resolvedCredential?.token?.startsWith('osk_ci_'));
+                // OSK-12116 — the 401 is usually the SECOND failure: the token expired
+                // (routine) and renewing it was refused (the fault). The server's code
+                // for the retry is `TOKEN_EXPIRED`, which names the routine half; the
+                // latched refresh refusal names the half the reader can act on.
+                const refreshRefusal = presentedCiToken
+                    ? null
+                    : (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
+                        bin: this.config.bin,
+                        cliId: this.cliConfig?.cliId,
+                    });
                 this.failWithCliError({
                     message: say(presentedCiToken
                         ? `Authentication failed: this is an \`osk_ci_*\` token, which only bootstraps a ` +
                             `daemon (\`OVERSKY_TOKEN=<token> skrrd start\`). ${this.config.bin} commands do ` +
                             `not accept it — sign in with \`${this.config.bin} login\` instead.`
-                        : `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`),
-                    code: bodyCode || 'AUTHENTICATION_FAILED',
+                        : refreshRefusal
+                            ? `Authentication failed. ${refreshRefusal.message}`
+                            : `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`),
+                    code: refreshRefusal?.code || bodyCode || 'AUTHENTICATION_FAILED',
                     status: e.status,
                     exit: exitCode,
                     retryable: true,
+                    ...(refreshRefusal && bodyCode ? { details: { accessTokenCode: bodyCode } } : {}),
                 });
             }
             else if ((e.status === 403 || e.status === 504) &&
@@ -1287,6 +1301,36 @@ class BaseCommand extends core_1.Command {
         // attempt is assumed absent.
         const outage = (0, outbox_1.isOutageFailure)(err);
         const statusSuffix = e.status ? ` (HTTP ${e.status})` : '';
+        // OSK-12121 — a 401 is queued (the payload is authored, and it is worth
+        // keeping until someone signs in again), but it is an AUTHENTICATION
+        // failure, and saying "did not accept this write" left the reader to guess
+        // that. Lead with the sign-in, name the refused refresh when one is latched,
+        // and give the order the fix has to happen in: sign in, THEN replay.
+        if (e.status === 401) {
+            const refusal = (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
+                bin: this.config.bin,
+                cliId: this.cliConfig?.cliId,
+            });
+            const why = refusal
+                ? refusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
+                : 'The server did not accept this sign-in.';
+            this.failWithCliError({
+                message: `Authentication failed${statusSuffix}. ${why} Your ${write.summary} was not applied; it ` +
+                    `was saved locally as ${queuedId} so it is not lost. Sign in with ` +
+                    `\`${this.config.bin} login\`, then replay it with \`${this.config.bin} outbox retry\` ` +
+                    `(or discard it with \`${this.config.bin} outbox drop ${queuedId}\`).`,
+                code: refusal?.code || 'AUTHENTICATION_FAILED',
+                status: e.status,
+                exit: this.bareMode ? 75 : 2,
+                retryable: true,
+                details: {
+                    queued: true,
+                    outboxId: queuedId,
+                    idempotencyKey: write.idempotencyKey,
+                    ...(e.code ? { accessTokenCode: e.code } : {}),
+                },
+            });
+        }
         const lead = outage
             ? `${this.cliConfig.baseURL} is not serving requests right now${statusSuffix}. ` +
                 `Your ${write.summary} was queued locally as ${queuedId}; whether the server already ` +
@@ -1419,6 +1463,19 @@ function parseGlobalFlags(argv) {
     }
     return { bare, token, workspace };
 }
+/**
+ * The latched permanent refresh refusal, if any. Never throws: a surface that
+ * cannot read the latch falls back to its generic wording (OSK-12116).
+ */
+function readRefreshRefusal() {
+    try {
+        const state = (0, auth_core_1.needsReauthState)();
+        return state.needed ? { reason: state.reason, message: state.message } : null;
+    }
+    catch {
+        return null;
+    }
+}
 function parseErrorBody(body) {
     if (!body)
         return null;

package/dist/commands/agents/chat.d.ts

@@ -1,3 +1,4 @@
+import { dataService } from '@skrr-ai/data-provider';
 import { BaseCommand } from '../../base-command';
 import { type AgenticStreamResult, type ReconciledTerminal } from '../../lib/agentic-stream';
 /**
@@ -141,6 +142,17 @@ export declare function daemonPinFields(localSkills: {
         pathHash: string;
     }>;
 } | Record<string, never>;
+type ChatPermissionMode = NonNullable<Parameters<typeof dataService.startAgenticChat>[0]['permissionMode']>;
+/**
+ * The per-turn permission-mode fragment of the chat-start payload (OSK-12124).
+ * It rides the same request layer the web composer's picker sends, which the
+ * server already honours above the agent's and the harness's stored defaults —
+ * so switching one conversation no longer means changing the agent for every
+ * conversation it has.
+ */
+export declare function permissionModeFields(mode: string | undefined): {
+    permissionMode: ChatPermissionMode;
+} | Record<string, never>;
 export default class AgentsChat extends BaseCommand {
     static description: string;
     static examples: string[];
@@ -157,6 +169,7 @@ export default class AgentsChat extends BaseCommand {
         jsonl: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'approve-tools': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'permission-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'local-skill': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         task: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
@@ -182,3 +195,4 @@ export default class AgentsChat extends BaseCommand {
     private resolveLocalSkills;
     run(): Promise<void>;
 }
+export {};

package/dist/commands/agents/chat.js

@@ -9,6 +9,7 @@ exports.noOutputFailureMessage = noOutputFailureMessage;
 exports.noStreamJsonPayload = noStreamJsonPayload;
 exports.chatStreamHeaderLines = chatStreamHeaderLines;
 exports.daemonPinFields = daemonPinFields;
+exports.permissionModeFields = permissionModeFields;
 const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -157,6 +158,11 @@ function noStreamJsonPayload(input) {
         responseMessageId: result.responseMessageId,
         status: result.status,
         response: result.text,
+        // The model a local harness reported running (OSK-12111). Absent on a
+        // cloud turn and on a harness that reports none.
+        ...(typeof result.lastEvent?.harnessModel === 'string' && result.lastEvent.harnessModel
+            ? { harnessModel: result.lastEvent.harnessModel }
+            : {}),
         ...(result.status === 'failed'
             ? {
                 failureReason: result.lastEvent?.reason ??
@@ -211,11 +217,22 @@ function daemonPinFields(localSkills, daemonFlag) {
     }
     return {};
 }
+/**
+ * The per-turn permission-mode fragment of the chat-start payload (OSK-12124).
+ * It rides the same request layer the web composer's picker sends, which the
+ * server already honours above the agent's and the harness's stored defaults —
+ * so switching one conversation no longer means changing the agent for every
+ * conversation it has.
+ */
+function permissionModeFields(mode) {
+    return mode ? { permissionMode: mode } : {};
+}
 class AgentsChat extends base_command_1.BaseCommand {
     static description = 'Run an agent turn with live streaming, tool events, cancellation, and reconnects';
     static examples = [
         '<%= config.bin %> agents chat <agent-id> --prompt "Review the open tasks"',
         '<%= config.bin %> agents chat <agent-id> --prompt "Deploy the fix" --approve-tools',
+        '<%= config.bin %> agents chat <agent-id> --conversation <id> --prompt "Now apply it" --permission-mode acceptEdits',
         '<%= config.bin %> agents chat <agent-id> --prompt "Summarize" --jsonl',
         '<%= config.bin %> agents chat <agent-id> --prompt "Summarize" --no-stream --json',
         '<%= config.bin %> agents chat <agent-id> --prompt "Review this diff" --local-skill code-review',
@@ -250,7 +267,12 @@ class AgentsChat extends base_command_1.BaseCommand {
                 '`stream.gap` event means envelopes in that seq range never arrived and the streamed ' +
                 'text is short; `run.result` and the persisted message remain authoritative. Tool ' +
                 'calls arrive as `tool.started` / `tool.completed`, once per `toolUseId`, on cloud ' +
-                'and local-harness runs alike.',
+                'and local-harness runs alike. A `session.notice` with `notice: ' +
+                '"harness-session-reset"` means the local harness could not resume its previous ' +
+                'session and started a new one; `message` says why. A `permission.resolved` says ' +
+                'how a local harness permission request was decided: `decidedBy` in words, and ' +
+                '`basis` — `person` (with `surface`), `mode` (with `mode`), `policy` or ' +
+                '`session-grant` — beside the wire `by`.',
         }),
         json: core_1.Flags.boolean({
             description: 'Emit the final one-shot response as JSON (use with --no-stream)',
@@ -260,6 +282,15 @@ class AgentsChat extends base_command_1.BaseCommand {
                 'with no terminal the flag itself is the approval for this turn, and each one is ' +
                 'reported on the stream. Without it every such call is denied.',
         }),
+        'permission-mode': core_1.Flags.string({
+            description: 'Permission mode for THIS turn only, on a local-harness agent. It beats the agent’s and ' +
+                'the harness’s stored defaults for this turn and changes nothing else — pass it again ' +
+                'on each turn that needs it (`agents update --default-permission-mode` changes every ' +
+                'conversation of the agent). A mode the harness cannot honour runs as the one it can, ' +
+                'and run.started says which. --approve-tools is separate: it answers the approval ' +
+                'prompts a mode asks for.',
+            options: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
+        }),
         'local-skill': core_1.Flags.string({
             description: 'Invoke a skill on your machine on this turn, as `skrr skills local` lists it: its ' +
                 'name, or <root>/<name> when two roots share one. The turn runs on that machine. ' +
@@ -354,6 +385,10 @@ class AgentsChat extends base_command_1.BaseCommand {
                 'response and streams no events. Use --quick --json for a machine-readable ' +
                 'one-shot, or drop --quick for a real streamed turn.', { exit: 2 });
         }
+        if (flags.quick && flags['permission-mode']) {
+            this.error('--permission-mode has no meaning with --quick: the persona-only summarizer runs no ' +
+                'tools, so there is nothing for a mode to govern. Drop --quick for a real turn.', { exit: 2 });
+        }
         if (flags.quick && flags['local-skill']?.length) {
             this.error('--local-skill has no meaning with --quick: the persona-only summarizer runs no ' +
                 'runtime, so no skill on your machine can load. Drop --quick for a real turn.', { exit: 2 });
@@ -485,6 +520,7 @@ class AgentsChat extends base_command_1.BaseCommand {
                 // execution policy places it elsewhere keeps that placement, and the
                 // run fails saying why rather than running without the skill.
                 ...daemonPinFields(localSkills, flags.daemon),
+                ...permissionModeFields(flags['permission-mode']),
             });
         }
         catch (err) {

package/dist/commands/agents/show.d.ts

@@ -13,6 +13,15 @@ export declare function agentToneLine(agent: {
     toneMode?: unknown;
     toneId?: unknown;
 }): string;
+/**
+ * The permission mode this agent runs with on its harness, and the layer that
+ * decided it (OSK-12069). The server resolves it (`effectivePermissionMode`) the
+ * way the dispatch does; the stored agent field alone is one of four layers, so
+ * printing it read "not set" for an agent whose harness default governed.
+ * Falls back to the stored field against a server that does not send the
+ * resolution, and says that is all it knows.
+ */
+export declare function agentPermissionLines(agent: Record<string, unknown>, harness: string): string[];
 /** Text rendering is deliberately based on the server projection, with a
  * storage-shape fallback while all stored policies are migrated. */
 export declare function agentExecutionOrderLines(agent: Record<string, unknown>): string[];

package/dist/commands/agents/show.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.agentToneLine = agentToneLine;
+exports.agentPermissionLines = agentPermissionLines;
 exports.agentExecutionOrderLines = agentExecutionOrderLines;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -31,6 +32,46 @@ function agentToneLine(agent) {
         return 'inherit — see `skrr agents tone show`';
     return '-';
 }
+const PERMISSION_SOURCE_LABELS = {
+    agent: "this agent's default",
+    harness: "the harness's default",
+};
+/**
+ * The permission mode this agent runs with on its harness, and the layer that
+ * decided it (OSK-12069). The server resolves it (`effectivePermissionMode`) the
+ * way the dispatch does; the stored agent field alone is one of four layers, so
+ * printing it read "not set" for an agent whose harness default governed.
+ * Falls back to the stored field against a server that does not send the
+ * resolution, and says that is all it knows.
+ */
+function agentPermissionLines(agent, harness) {
+    const effective = agent.effectivePermissionMode;
+    const pad = '             ';
+    if (!effective || typeof effective.source !== 'string') {
+        const stored = typeof agent.defaultPermissionMode === 'string' && agent.defaultPermissionMode
+            ? agent.defaultPermissionMode
+            : "not set on the agent (the harness's or the daemon's default applies)";
+        return [`Permission:  ${stored} — enforced by the ${harness} harness`];
+    }
+    const lines = [];
+    if (typeof effective.mode === 'string' && effective.mode) {
+        const from = PERMISSION_SOURCE_LABELS[effective.source] ?? effective.source;
+        lines.push(`Permission:  ${effective.mode} (from ${from}) — enforced by the ${harness} harness`);
+    }
+    else {
+        lines.push(`Permission:  set by the daemon's own config on that machine — no agent or harness mode is set`);
+    }
+    if (typeof effective.coercedFrom === 'string' && effective.coercedFrom) {
+        lines.push(`${pad}${effective.coercedFrom} is configured, but ${harness} cannot honour it, so it runs as ${String(effective.mode)}.`);
+    }
+    const supported = Array.isArray(effective.supportedModes)
+        ? effective.supportedModes.filter((m) => typeof m === 'string')
+        : [];
+    if (supported.length > 0)
+        lines.push(`${pad}${harness} accepts: ${supported.join(', ')}`);
+    lines.push(`${pad}A turn's own mode (\`agents chat --permission-mode\`) overrides this for that turn.`);
+    return lines;
+}
 /** Text rendering is deliberately based on the server projection, with a
  * storage-shape fallback while all stored policies are migrated. */
 function agentExecutionOrderLines(agent) {
@@ -163,6 +204,18 @@ class AgentsShow extends base_command_1.BaseCommand {
             this.log(line);
         if (a.harnessName || a.harnessProvider || a.harnessStatus) {
             this.log(`Harness:     ${a.harnessName ?? (typeof a.harnessProvider === 'string' ? (0, harness_provider_input_1.canonicalHarnessInput)(a.harnessProvider) : a.harnessProvider) ?? '-'}${a.harnessStatus ? ` (${a.harnessStatus})` : ''}`);
+            // On a harness, the HARNESS decides what runs and which permission modes
+            // exist — `Provider` is only the cloud model contract, so an agent read
+            // as "anthropic" while running Codex (OSK-12071). And the mode itself was
+            // visible only in --json (OSK-12069).
+            if (typeof a.harnessProvider === 'string' && a.harnessProvider) {
+                const harness = (0, harness_provider_input_1.canonicalHarnessInput)(a.harnessProvider);
+                for (const line of agentPermissionLines(a, harness))
+                    this.log(line);
+                if (typeof a.provider === 'string' && a.provider && a.provider !== harness) {
+                    this.log(`             Runs on ${harness}; Provider "${a.provider}" is only the cloud model contract.`);
+                }
+            }
             // An offline engine is the difference between "this agent works" and
             // "this agent silently does nothing", and the display name alone cannot
             // carry it: two runtimes for the same machine share an identical name,

package/dist/commands/agents/update.d.ts

@@ -55,3 +55,12 @@ export default class AgentsUpdate extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * What changing the agent's default permission mode actually changed
+ * (OSK-12124). It is the AGENT's default, so it governs every conversation,
+ * task run and Commitment Run of the agent from its next turn — which the bare
+ * "Updated agent" line never said, and the only way to learn that a live
+ * conversation picked it up was to spend another turn. Names the per-turn
+ * alternative for the case that wanted one conversation changed.
+ */
+export declare function defaultPermissionModeNote(requested: string | undefined, updated: Record<string, unknown>): string | null;

package/dist/commands/agents/update.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultPermissionModeNote = defaultPermissionModeNote;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agent_visual_refs_1 = require("../../lib/agent-visual-refs");
@@ -50,6 +51,8 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         }),
         'default-permission-mode': core_1.Flags.string({
             description: "Permission mode for this agent's local-harness sessions (every harness, not only Claude Code). " +
+                'It is the default for EVERY conversation, task run and Commitment Run of the agent; for one ' +
+                'turn only use `agents chat --permission-mode`. ' +
                 'One-shot harnesses (gemini, opencode, cursor, copilot, goose, pi, openclaw) can only run as ' +
                 'bypassPermissions; any other mode is refused for them.',
             options: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
@@ -213,6 +216,30 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         const a = updated;
         this.log(`Updated agent ${a.id ?? a._id ?? args.id} — ${a.name ?? '(no name)'}`);
         this.log(`URL: ${(0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, { ...a, id: a.id ?? a._id ?? args.id }).url ?? '-'}`);
+        const modeNote = defaultPermissionModeNote(flags['default-permission-mode'], a);
+        if (modeNote)
+            this.log(modeNote);
     }
 }
 exports.default = AgentsUpdate;
+/**
+ * What changing the agent's default permission mode actually changed
+ * (OSK-12124). It is the AGENT's default, so it governs every conversation,
+ * task run and Commitment Run of the agent from its next turn — which the bare
+ * "Updated agent" line never said, and the only way to learn that a live
+ * conversation picked it up was to spend another turn. Names the per-turn
+ * alternative for the case that wanted one conversation changed.
+ */
+function defaultPermissionModeNote(requested, updated) {
+    if (!requested)
+        return null;
+    const stored = typeof updated.defaultPermissionMode === 'string' && updated.defaultPermissionMode
+        ? updated.defaultPermissionMode
+        : requested;
+    return [
+        `Permission: ${stored} is now this agent's default for EVERY conversation, task run and`,
+        '            Commitment Run, starting with each one’s next turn. A turn that names its own',
+        '            mode still wins. To change one turn only, leave the default alone and pass',
+        `            \`skrr agents chat <agent> --conversation <id> --permission-mode ${requested}\`.`,
+    ].join('\n');
+}

package/dist/commands/balance/show.d.ts

@@ -1,5 +1,6 @@
 import type { TSkyCodeUsageSnapshot } from '@skrr-ai/data-provider';
 import { BaseCommand } from '../../base-command';
+import type { WorkspaceBalance } from '../../lib/balance';
 import { type RuntimeMonthlySpend } from '../../lib/harnesses';
 /**
  * The hosted-runtime monthly cap rows, as lines.
@@ -8,6 +9,32 @@ import { type RuntimeMonthlySpend } from '../../lib/harnesses';
  * the wording is part of the observable contract and is pinned directly.
  */
 export declare function renderRuntimeSpend(spend: RuntimeMonthlySpend[], log: (line: string) => void): void;
+/**
+ * The workspace the next session on this machine is billed to, and why that one.
+ *
+ * `selected`: `workspaces use` / `--workspace` / a daemon handoff put it in
+ * `OVERSKY_WORKSPACE_ID`. `default`: nothing is selected, so the session carries
+ * the caller's server-side default workspace — the same resolution `whoami` and
+ * `workspaces list` describe ("resolves to your default workspace").
+ */
+export interface SessionBillingTarget {
+    workspaceId: string;
+    name?: string;
+    source: 'selected' | 'default';
+}
+/**
+ * The account the NEXT session bills against, as lines — printed FIRST (OSK-12122).
+ *
+ * `skrr balance` opened on the personal account, so a user whose sessions bill
+ * the default workspace read `Credits: 999,503,672,326 ($999,503.67)` while every
+ * session was refused against that workspace's $0. The screen that exists to
+ * answer "why was I refused for credit" answered for the one account the
+ * refusal was not about, and nothing on it said which account that was.
+ *
+ * `balance` absent means the read failed: say so, never print a figure.
+ * Pure so the wording is pinned directly, like `renderRuntimeSpend`.
+ */
+export declare function renderSessionBillingAccount(target: SessionBillingTarget, balance: WorkspaceBalance | null, log: (line: string) => void, bin?: string): void;
 /**
  * Your plan's ceilings, as lines.
  *
@@ -66,6 +93,13 @@ export default class BalanceShow extends BaseCommand {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * Which workspace the next session carries: the selected one, else the
+     * caller's default. Fail-open — an unreadable listing with nothing selected
+     * returns null and the screen falls back to the personal view it always had,
+     * rather than guessing an account.
+     */
+    private resolveSessionBillingTarget;
     /**
      * Your plan's ceilings, beside the balance they are spent before.
      *

package/dist/commands/balance/show.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderRuntimeSpend = renderRuntimeSpend;
+exports.renderSessionBillingAccount = renderSessionBillingAccount;
 exports.renderPlanCeilings = renderPlanCeilings;
 const core_1 = require("@oclif/core");
 const auth_core_1 = require("@skrr-ai/auth-core");
@@ -37,6 +38,45 @@ function renderRuntimeSpend(spend, log) {
         }
     }
 }
+/**
+ * The account the NEXT session bills against, as lines — printed FIRST (OSK-12122).
+ *
+ * `skrr balance` opened on the personal account, so a user whose sessions bill
+ * the default workspace read `Credits: 999,503,672,326 ($999,503.67)` while every
+ * session was refused against that workspace's $0. The screen that exists to
+ * answer "why was I refused for credit" answered for the one account the
+ * refusal was not about, and nothing on it said which account that was.
+ *
+ * `balance` absent means the read failed: say so, never print a figure.
+ * Pure so the wording is pinned directly, like `renderRuntimeSpend`.
+ */
+function renderSessionBillingAccount(target, balance, log, bin = 'skrr') {
+    const label = target.name ? `"${target.name}" (${target.workspaceId})` : target.workspaceId;
+    const why = target.source === 'selected'
+        ? 'the workspace selected for this CLI'
+        : 'no workspace is selected, so sessions resolve to your default workspace';
+    log(`Next session bills: workspace ${label}`);
+    log(`  (${why})`);
+    if (!balance) {
+        log(`  Balance:        unavailable (\`${bin} balance show --workspace ${target.workspaceId}\` to retry)`);
+        return;
+    }
+    if (!balance.exists) {
+        log('  No billing account yet — nothing has ever been funded or spent here.');
+        log('  WARNING: a managed session carrying this workspace cannot be funded; it will be refused.');
+    }
+    else {
+        for (const line of (0, balance_1.workspaceBalanceLines)(balance))
+            log(line);
+        if (balance.availableMicros <= 0) {
+            log('  WARNING: nothing available — managed sessions billed here are refused for credit, ' +
+                'whatever your personal balance below says.');
+        }
+    }
+    if (balance.availableMicros <= 0) {
+        log(`  Add credit to this workspace, or bill another one with \`${bin} workspaces use <workspace>\`.`);
+    }
+}
 /**
  * Your plan's ceilings, as lines.
  *
@@ -135,17 +175,42 @@ class BalanceShow extends base_command_1.BaseCommand {
         catch (err) {
             this.handleApiError(err);
         }
+        // OSK-12122 — the account the next session bills, resolved the way the
+        // session resolves it, read before anything is printed so it can go first.
+        const sessionTarget = await this.resolveSessionBillingTarget();
+        let sessionBalance = null;
+        if (sessionTarget) {
+            try {
+                sessionBalance = await (0, balance_1.getWorkspaceBalance)(sessionTarget.workspaceId);
+            }
+            catch {
+                sessionBalance = null;
+            }
+        }
         if (flags.json) {
-            this.log(JSON.stringify(balance, null, 2));
+            // Additive: the personal balance keeps its shape, and the account a
+            // session bills rides beside it (`null` when no workspace resolves).
+            this.log(JSON.stringify({
+                ...(balance ?? {}),
+                sessionBilling: sessionTarget
+                    ? { ...sessionTarget, balance: sessionBalance, balanceReadable: !!sessionBalance }
+                    : null,
+            }, null, 2));
             return;
         }
         if (!balance) {
             this.error('No balance record for this account.', { exit: 1 });
         }
+        if (sessionTarget) {
+            renderSessionBillingAccount(sessionTarget, sessionBalance, (line) => this.log(line), this.config.bin);
+            this.log('');
+        }
         // Name the account. "Hosted usage balance" alone reads as "the balance
         // that matters here", which is exactly the wrong reading for someone sent
         // by a workspace refusal.
-        this.log('Hosted usage balance — your personal account');
+        this.log(sessionTarget
+            ? 'Hosted usage balance — your personal account (not what the session above bills)'
+            : 'Hosted usage balance — your personal account');
         // Credits AND dollars, because a credit is a micro-dollar and nothing on
         // this surface said so. Four spend screens reported four units with no
         // stated relationship between them (OSK-4664).
@@ -235,6 +300,31 @@ class BalanceShow extends base_command_1.BaseCommand {
         this.log('`skrr balance show --workspace <id>`. `skrr payments wallet` is the');
         this.log('separate x402 crypto wallet, in USDC — not this balance.');
     }
+    /**
+     * Which workspace the next session carries: the selected one, else the
+     * caller's default. Fail-open — an unreadable listing with nothing selected
+     * returns null and the screen falls back to the personal view it always had,
+     * rather than guessing an account.
+     */
+    async resolveSessionBillingTarget() {
+        const selected = process.env.OVERSKY_WORKSPACE_ID?.trim();
+        let listing = null;
+        try {
+            listing = await (0, workspaces_1.listWorkspaceListing)();
+        }
+        catch {
+            listing = null;
+        }
+        const workspaceId = selected || listing?.defaultWorkspaceId || null;
+        if (!workspaceId)
+            return null;
+        const name = listing?.rows.find((row) => row.id === workspaceId)?.name;
+        return {
+            workspaceId,
+            ...(name ? { name } : {}),
+            source: selected ? 'selected' : 'default',
+        };
+    }
     /**
      * Your plan's ceilings, beside the balance they are spent before.
      *

package/dist/commands/commitments/doctor.d.ts

@@ -6,6 +6,7 @@ export declare function doctorVerdict(input: {
 }): {
     verdict: string;
     next: string;
+    why?: string;
 };
 export default class CommitmentsDoctor extends BaseCommand {
     static description: string;

package/dist/commands/commitments/doctor.js

@@ -15,8 +15,12 @@ function doctorVerdict(input) {
     if (operatingState.status === 'waiting_approval') {
         return { verdict: 'waiting_approval', next: 'Open the pending prepared action for review' };
     }
-    if (operatingState.coverage && operatingState.coverage.complete === false) {
-        return { verdict: 'degraded', next: 'Retry doctor; one or more operating-state projections are unavailable' };
+    if (operatingState.coverage &&
+        operatingState.coverage.complete === false) {
+        return {
+            verdict: 'degraded',
+            next: 'Retry doctor; one or more operating-state projections are unavailable',
+        };
     }
     const autonomy = operatingState.autonomy;
     const budget = autonomy?.budget;
@@ -30,9 +34,18 @@ function doctorVerdict(input) {
     }
     if (operatingState.status && commitment.status === 'active') {
         const status = String(operatingState.status);
+        const healthy = ['on_track', 'healthy'].includes(status);
+        // Where the latest cycle stopped, as the server words it. "Read the raw
+        // trace" was the only next step an unhealthy Commitment was ever given,
+        // even when the stop already named the fix (OSK-12120).
+        const latestCheck = operatingState.latestCheck;
+        const stop = latestCheck?.stop;
+        const fix = typeof stop?.fix === 'string' && stop.fix ? stop.fix : undefined;
+        const why = typeof stop?.detail === 'string' && stop.detail ? stop.detail : undefined;
         return {
-            verdict: ['on_track', 'healthy'].includes(status) ? 'active_healthy' : status,
-            next: 'skrr commitments trace <id> --limit 50',
+            verdict: healthy ? 'active_healthy' : status,
+            next: !healthy && fix ? fix : 'skrr commitments trace <id> --limit 50',
+            ...(!healthy && why ? { why } : {}),
         };
     }
     if (commitment.status !== 'active')
@@ -81,6 +94,8 @@ class CommitmentsDoctor extends base_command_1.BaseCommand {
             this.log(JSON.stringify(report, null, 2));
         else {
             this.log(`Verdict: ${diagnosis.verdict}`);
+            if (diagnosis.why)
+                this.log(`Why:     ${diagnosis.why}`);
             this.log(`Next:    ${diagnosis.next.replace('<id>', args.id)}`);
             const autonomy = operatingState.autonomy;
             if (autonomy) {

package/dist/commands/commitments/effective-policy.js

@@ -15,6 +15,9 @@ function effectivePolicyLines(policy) {
     const governance = policy.governance || {};
     const owner = policy.owner || {};
     const lines = [`Mode in force: ${(0, commitment_product_1.productModeLabel)(governance.effectiveAutonomyMode)}`];
+    // Whose permissions a run uses (OSK-11975), directly under the mode it can
+    // contradict — an Execute Commitment on a plan-mode Agent (OSK-12065).
+    lines.push(...(0, commitments_1.permissionLines)(policy.permissions));
     if (governance.blocked) {
         lines.push(`Workspace status: blocked${governance.blockedReason ? ` — ${governance.blockedReason}` : ''}`);
     }
@@ -56,7 +59,18 @@ function effectivePolicyLines(policy) {
     // part that is NOT enforced, because that is the one an operator granting
     // it has to see.
     const observation = policy.observation;
-    if (observation?.sensing) {
+    if (observation?.sensing && observation.retired) {
+        // OSK-11975 retired the sensing fence: printing "granted — read-only" for
+        // a grant that no longer fences anything is the claim this must not make.
+        const recorded = [
+            observation.shell?.granted ? 'shell' : null,
+            observation.browser?.granted ? 'browser' : null,
+        ].filter(Boolean);
+        lines.push(`Sensing runs: the Agent's own permissions${recorded.length
+            ? ` (recorded ${recorded.join(' and ')} grant is retired and has no effect)`
+            : ''}`);
+    }
+    else if (observation?.sensing) {
         lines.push(`Sensing shell: ${observation.shell?.granted
             ? 'granted — read-only filesystem on the Hosted Machine; network NOT fenced (a command can still change remote state); withheld on your own machine'
             : 'not granted'}`);

package/dist/commands/commitments/next-tick.js

@@ -75,7 +75,9 @@ function formatNextTick(projection) {
         `Posture:    ${decision.posture ?? '-'}`,
         `Health:     ${decision.health ?? '-'}`,
         `Risk:       ${decision.riskLevel ?? '-'}`,
-        `Confidence: ${decision.confidence ?? '-'}`,
+        // Two decimals: the arbiter's arithmetic yields values like
+        // 0.6000000000000001, which reads as a precision the number does not have.
+        `Confidence: ${typeof decision.confidence === 'number' ? decision.confidence.toFixed(2) : '-'}`,
     ];
     if (decision.whyNow)
         lines.push(`Why now:    ${decision.whyNow}`);