@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/base-command.d.ts

@@ -4,6 +4,7 @@ import { type AssigneeResolution, type MemberKind, type SpaceMember } from './li
 import { type CliConfig } from './lib/config';
 import { type OutboxMethod } from './lib/outbox';
 import { type ResolvedCredential } from './lib/credential-resolver';
+import { type BrokerRefusalDescription } from './lib/daemonBrokerRefusal';
 import { type DefaultAgentResolution } from './lib/tasks';
 export declare function assigneePayloadNeedsResolution(payload: Record<string, unknown>): boolean;
 /**
@@ -68,6 +69,12 @@ export declare abstract class BaseCommand extends Command {
      */
     protected resolvedCredential: ResolvedCredential;
     protected bareMode: boolean;
+    /**
+     * Set when the auto-broker reached a live daemon and it REFUSED the hand-off.
+     * `requireAuth()` reports it instead of a bare "Not signed in", because the
+     * daemon's reason decides the repair (OSK-12149, OSK-12151).
+     */
+    protected brokerRefusal: BrokerRefusalDescription | null;
     init(): Promise<void>;
     /**
      * Read only the two global base flags. A narrow parser — oclif's

package/dist/base-command.js

@@ -29,11 +29,13 @@ var keychain_1 = require("./lib/keychain");
 Object.defineProperty(exports, "resolveProfileFromArgv", { enumerable: true, get: function () { return keychain_1.resolveProfileFromArgv; } });
 const data_provider_1 = require("@skrr-ai/data-provider");
 const auth_core_1 = require("@skrr-ai/auth-core");
+const auth_failure_1 = require("./lib/auth-failure");
 const assignee_resolver_1 = require("./lib/assignee-resolver");
 const task_ref_resolver_1 = require("./lib/task-ref-resolver");
 const space_resolver_1 = require("./lib/space-resolver");
 const projects_1 = require("./lib/projects");
 const config_1 = require("./lib/config");
+const cli_id_1 = require("./lib/cli-id");
 const keychain_2 = require("./lib/keychain");
 const outbox_1 = require("./lib/outbox");
 const node_adapter_1 = require("./lib/node-adapter");
@@ -41,6 +43,7 @@ const migrate_1 = require("./lib/migrate");
 const auth_core_init_1 = require("./lib/auth-core-init");
 const credential_resolver_1 = require("./lib/credential-resolver");
 const daemonBroker_1 = require("./lib/daemonBroker");
+const daemonBrokerRefusal_1 = require("./lib/daemonBrokerRefusal");
 const refresh_1 = require("./lib/refresh");
 const auth_storage_1 = require("./lib/auth-storage");
 const update_check_1 = require("./lib/update-check");
@@ -130,6 +133,12 @@ class BaseCommand extends core_1.Command {
      */
     resolvedCredential;
     bareMode = false;
+    /**
+     * Set when the auto-broker reached a live daemon and it REFUSED the hand-off.
+     * `requireAuth()` reports it instead of a bare "Not signed in", because the
+     * daemon's reason decides the repair (OSK-12149, OSK-12151).
+     */
+    brokerRefusal = null;
     async init() {
         await super.init();
         // The profile is resolved from raw argv, BEFORE oclif parses anything.
@@ -268,11 +277,13 @@ class BaseCommand extends core_1.Command {
         // skrr command reads it through the normal resolver chain — no
         // per-command broker round-trip.
         //
-        // Fail-quiet: any broker failure leaves resolvedCredential null and
-        // the command's own `requireAuth()` will surface the "Not signed
-        // in" error a moment later. Mismatched baseURL (a real foot-gun the
-        // user might not notice) is the one exception — we print a one-
-        // line hint so they know how to fix it.
+        // A broker failure leaves resolvedCredential null and the command's own
+        // `requireAuth()` surfaces the error a moment later. It is quiet only when
+        // no daemon was there to ask. A daemon that ANSWERED and refused is kept
+        // in `brokerRefusal`, and `requireAuth()` reports its reason and the
+        // repair that reason implies — "Not signed in. Run `skrr login`" was true
+        // and pointed at the wrong fix (OSK-12149). Rate limiting and a mismatched
+        // baseURL keep their own one-line hints below.
         if (!this.resolvedCredential.token) {
             const autoResult = await (0, daemonBroker_1.maybeAutoBroker)({
                 cliConfig: this.cliConfig,
@@ -317,6 +328,9 @@ class BaseCommand extends core_1.Command {
                         kind: (0, auth_core_1.classifyTokenKind)(accessToken),
                     };
                 }
+                else if ((this.brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin))) {
+                    // Reported by requireAuth(); nothing to print here.
+                }
                 else if (autoResult.outcome.reason === 'rate_limited') {
                     // Otherwise the only thing the user sees is "Not signed in", which is
                     // true and points at the wrong repair: they are signed in, the local
@@ -339,7 +353,12 @@ class BaseCommand extends core_1.Command {
             }
         }
         if (!this.resolvedCredential.token && ignoredStoredCredential) {
-            if (ignoredStoredCredential.originStatus === 'mismatch') {
+            const foreign = (0, auth_storage_1.describeForeignCredential)(ignoredStoredCredential);
+            if (foreign) {
+                process.stderr.write(`[skrr] ${foreign} Run \`skrr login\` to sign this configuration in; the other ` +
+                    `configuration keeps its own credential.\n`);
+            }
+            else if (ignoredStoredCredential.originStatus === 'mismatch') {
                 process.stderr.write(`[skrr] Ignoring stored credentials issued by ${ignoredStoredCredential.storedServerOrigin}; ` +
                     `skrr is configured for ${this.cliConfig.baseURL}. Run \`skrr login --base-url ${this.cliConfig.baseURL}\` ` +
                     `or switch back to the issuing server.\n`);
@@ -615,6 +634,18 @@ class BaseCommand extends core_1.Command {
     /** Abort the command with a helpful message if the user isn't signed in. */
     requireAuth() {
         if (!this.resolvedCredential?.token) {
+            const refusal = this.brokerRefusal;
+            if (refusal) {
+                // Same code as the plain case — scripts branch on NOT_SIGNED_IN — with
+                // the daemon's answer in the message and in `details.broker`.
+                this.failWithCliError({
+                    message: `Not signed in. ${refusal.headline}\n→ ${refusal.remedy}`,
+                    code: 'NOT_SIGNED_IN',
+                    exit: 2,
+                    retryable: refusal.transient,
+                    details: { broker: refusal.broker, suggestion: refusal.remedy },
+                });
+            }
             this.failWithCliError({
                 message: `Not signed in. Run \`${this.config.bin} login\` first.`,
                 code: 'NOT_SIGNED_IN',
@@ -1002,16 +1033,29 @@ class BaseCommand extends core_1.Command {
                 // `login` sends a CI job to do the one thing it cannot, and hides the
                 // real mistake (dogfood OSK-4693). Name the credential instead.
                 const presentedCiToken = Boolean(this.resolvedCredential?.token?.startsWith('osk_ci_'));
+                // OSK-12116 — the 401 is usually the SECOND failure: the token expired
+                // (routine) and renewing it was refused (the fault). The server's code
+                // for the retry is `TOKEN_EXPIRED`, which names the routine half; the
+                // latched refresh refusal names the half the reader can act on.
+                const refreshRefusal = presentedCiToken
+                    ? null
+                    : (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
+                        bin: this.config.bin,
+                        cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
+                    });
                 this.failWithCliError({
                     message: say(presentedCiToken
                         ? `Authentication failed: this is an \`osk_ci_*\` token, which only bootstraps a ` +
                             `daemon (\`OVERSKY_TOKEN=<token> skrrd start\`). ${this.config.bin} commands do ` +
                             `not accept it — sign in with \`${this.config.bin} login\` instead.`
-                        : `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`),
-                    code: bodyCode || 'AUTHENTICATION_FAILED',
+                        : refreshRefusal
+                            ? `Authentication failed. ${refreshRefusal.message}`
+                            : `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`),
+                    code: refreshRefusal?.code || bodyCode || 'AUTHENTICATION_FAILED',
                     status: e.status,
                     exit: exitCode,
                     retryable: true,
+                    ...(refreshRefusal && bodyCode ? { details: { accessTokenCode: bodyCode } } : {}),
                 });
             }
             else if ((e.status === 403 || e.status === 504) &&
@@ -1287,6 +1331,36 @@ class BaseCommand extends core_1.Command {
         // attempt is assumed absent.
         const outage = (0, outbox_1.isOutageFailure)(err);
         const statusSuffix = e.status ? ` (HTTP ${e.status})` : '';
+        // OSK-12121 — a 401 is queued (the payload is authored, and it is worth
+        // keeping until someone signs in again), but it is an AUTHENTICATION
+        // failure, and saying "did not accept this write" left the reader to guess
+        // that. Lead with the sign-in, name the refused refresh when one is latched,
+        // and give the order the fix has to happen in: sign in, THEN replay.
+        if (e.status === 401) {
+            const refusal = (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
+                bin: this.config.bin,
+                cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
+            });
+            const why = refusal
+                ? refusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
+                : 'The server did not accept this sign-in.';
+            this.failWithCliError({
+                message: `Authentication failed${statusSuffix}. ${why} Your ${write.summary} was not applied; it ` +
+                    `was saved locally as ${queuedId} so it is not lost. Sign in with ` +
+                    `\`${this.config.bin} login\`, then replay it with \`${this.config.bin} outbox retry\` ` +
+                    `(or discard it with \`${this.config.bin} outbox drop ${queuedId}\`).`,
+                code: refusal?.code || 'AUTHENTICATION_FAILED',
+                status: e.status,
+                exit: this.bareMode ? 75 : 2,
+                retryable: true,
+                details: {
+                    queued: true,
+                    outboxId: queuedId,
+                    idempotencyKey: write.idempotencyKey,
+                    ...(e.code ? { accessTokenCode: e.code } : {}),
+                },
+            });
+        }
         const lead = outage
             ? `${this.cliConfig.baseURL} is not serving requests right now${statusSuffix}. ` +
                 `Your ${write.summary} was queued locally as ${queuedId}; whether the server already ` +
@@ -1419,6 +1493,19 @@ function parseGlobalFlags(argv) {
     }
     return { bare, token, workspace };
 }
+/**
+ * The latched permanent refresh refusal, if any. Never throws: a surface that
+ * cannot read the latch falls back to its generic wording (OSK-12116).
+ */
+function readRefreshRefusal() {
+    try {
+        const state = (0, auth_core_1.needsReauthState)();
+        return state.needed ? { reason: state.reason, message: state.message } : null;
+    }
+    catch {
+        return null;
+    }
+}
 function parseErrorBody(body) {
     if (!body)
         return null;

package/dist/commands/agents/chat.d.ts

@@ -1,3 +1,4 @@
+import { dataService } from '@skrr-ai/data-provider';
 import { BaseCommand } from '../../base-command';
 import { type AgenticStreamResult, type ReconciledTerminal } from '../../lib/agentic-stream';
 /**
@@ -141,6 +142,17 @@ export declare function daemonPinFields(localSkills: {
         pathHash: string;
     }>;
 } | Record<string, never>;
+type ChatPermissionMode = NonNullable<Parameters<typeof dataService.startAgenticChat>[0]['permissionMode']>;
+/**
+ * The per-turn permission-mode fragment of the chat-start payload (OSK-12124).
+ * It rides the same request layer the web composer's picker sends, which the
+ * server already honours above the agent's and the harness's stored defaults —
+ * so switching one conversation no longer means changing the agent for every
+ * conversation it has.
+ */
+export declare function permissionModeFields(mode: string | undefined): {
+    permissionMode: ChatPermissionMode;
+} | Record<string, never>;
 export default class AgentsChat extends BaseCommand {
     static description: string;
     static examples: string[];
@@ -157,6 +169,7 @@ export default class AgentsChat extends BaseCommand {
         jsonl: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'approve-tools': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'permission-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'local-skill': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         task: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
@@ -182,3 +195,4 @@ export default class AgentsChat extends BaseCommand {
     private resolveLocalSkills;
     run(): Promise<void>;
 }
+export {};

package/dist/commands/agents/chat.js

@@ -9,6 +9,7 @@ exports.noOutputFailureMessage = noOutputFailureMessage;
 exports.noStreamJsonPayload = noStreamJsonPayload;
 exports.chatStreamHeaderLines = chatStreamHeaderLines;
 exports.daemonPinFields = daemonPinFields;
+exports.permissionModeFields = permissionModeFields;
 const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -157,6 +158,11 @@ function noStreamJsonPayload(input) {
         responseMessageId: result.responseMessageId,
         status: result.status,
         response: result.text,
+        // The model a local harness reported running (OSK-12111). Absent on a
+        // cloud turn and on a harness that reports none.
+        ...(typeof result.lastEvent?.harnessModel === 'string' && result.lastEvent.harnessModel
+            ? { harnessModel: result.lastEvent.harnessModel }
+            : {}),
         ...(result.status === 'failed'
             ? {
                 failureReason: result.lastEvent?.reason ??
@@ -211,11 +217,22 @@ function daemonPinFields(localSkills, daemonFlag) {
     }
     return {};
 }
+/**
+ * The per-turn permission-mode fragment of the chat-start payload (OSK-12124).
+ * It rides the same request layer the web composer's picker sends, which the
+ * server already honours above the agent's and the harness's stored defaults —
+ * so switching one conversation no longer means changing the agent for every
+ * conversation it has.
+ */
+function permissionModeFields(mode) {
+    return mode ? { permissionMode: mode } : {};
+}
 class AgentsChat extends base_command_1.BaseCommand {
     static description = 'Run an agent turn with live streaming, tool events, cancellation, and reconnects';
     static examples = [
         '<%= config.bin %> agents chat <agent-id> --prompt "Review the open tasks"',
         '<%= config.bin %> agents chat <agent-id> --prompt "Deploy the fix" --approve-tools',
+        '<%= config.bin %> agents chat <agent-id> --conversation <id> --prompt "Now apply it" --permission-mode acceptEdits',
         '<%= config.bin %> agents chat <agent-id> --prompt "Summarize" --jsonl',
         '<%= config.bin %> agents chat <agent-id> --prompt "Summarize" --no-stream --json',
         '<%= config.bin %> agents chat <agent-id> --prompt "Review this diff" --local-skill code-review',
@@ -250,7 +267,12 @@ class AgentsChat extends base_command_1.BaseCommand {
                 '`stream.gap` event means envelopes in that seq range never arrived and the streamed ' +
                 'text is short; `run.result` and the persisted message remain authoritative. Tool ' +
                 'calls arrive as `tool.started` / `tool.completed`, once per `toolUseId`, on cloud ' +
-                'and local-harness runs alike.',
+                'and local-harness runs alike. A `session.notice` with `notice: ' +
+                '"harness-session-reset"` means the local harness could not resume its previous ' +
+                'session and started a new one; `message` says why. A `permission.resolved` says ' +
+                'how a local harness permission request was decided: `decidedBy` in words, and ' +
+                '`basis` — `person` (with `surface`), `mode` (with `mode`), `policy` or ' +
+                '`session-grant` — beside the wire `by`.',
         }),
         json: core_1.Flags.boolean({
             description: 'Emit the final one-shot response as JSON (use with --no-stream)',
@@ -260,6 +282,15 @@ class AgentsChat extends base_command_1.BaseCommand {
                 'with no terminal the flag itself is the approval for this turn, and each one is ' +
                 'reported on the stream. Without it every such call is denied.',
         }),
+        'permission-mode': core_1.Flags.string({
+            description: 'Permission mode for THIS turn only, on a local-harness agent. It beats the agent’s and ' +
+                'the harness’s stored defaults for this turn and changes nothing else — pass it again ' +
+                'on each turn that needs it (`agents update --default-permission-mode` changes every ' +
+                'conversation of the agent). A mode the harness cannot honour runs as the one it can, ' +
+                'and run.started says which. --approve-tools is separate: it answers the approval ' +
+                'prompts a mode asks for.',
+            options: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
+        }),
         'local-skill': core_1.Flags.string({
             description: 'Invoke a skill on your machine on this turn, as `skrr skills local` lists it: its ' +
                 'name, or <root>/<name> when two roots share one. The turn runs on that machine. ' +
@@ -354,6 +385,10 @@ class AgentsChat extends base_command_1.BaseCommand {
                 'response and streams no events. Use --quick --json for a machine-readable ' +
                 'one-shot, or drop --quick for a real streamed turn.', { exit: 2 });
         }
+        if (flags.quick && flags['permission-mode']) {
+            this.error('--permission-mode has no meaning with --quick: the persona-only summarizer runs no ' +
+                'tools, so there is nothing for a mode to govern. Drop --quick for a real turn.', { exit: 2 });
+        }
         if (flags.quick && flags['local-skill']?.length) {
             this.error('--local-skill has no meaning with --quick: the persona-only summarizer runs no ' +
                 'runtime, so no skill on your machine can load. Drop --quick for a real turn.', { exit: 2 });
@@ -485,6 +520,7 @@ class AgentsChat extends base_command_1.BaseCommand {
                 // execution policy places it elsewhere keeps that placement, and the
                 // run fails saying why rather than running without the skill.
                 ...daemonPinFields(localSkills, flags.daemon),
+                ...permissionModeFields(flags['permission-mode']),
             });
         }
         catch (err) {

package/dist/commands/agents/create.js

@@ -246,22 +246,26 @@ class AgentsCreate extends base_command_1.BaseCommand {
                 '09:00-18:00@America/Los_Angeles',
         }),
         // Retired (OSK-11975): a Commitment turn works under the Agent's own
-        // permissions, so these three are stored but no longer read at runtime.
+        // permissions. Hidden, warned on use, and never sent (OSK-12068) — see
+        // `mergeAgentConfigFlags`. Kept parseable so an old script still runs.
         'reasoning-tool-escape': core_1.Flags.string({
-            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
+            description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.REASONING_TOOL_ESCAPES],
             multiple: true,
             deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            hidden: true,
         }),
         'commitment-responsibility': core_1.Flags.string({
-            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
+            description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
             deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            hidden: true,
         }),
         'commitment-responsibility-ceiling': core_1.Flags.string({
-            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
+            description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
             deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            hidden: true,
         }),
         'max-turns': core_1.Flags.integer({ description: 'Maximum turns in one agent run (1-500)' }),
         'tool-resources': core_1.Flags.string({

package/dist/commands/agents/show.d.ts

@@ -13,6 +13,15 @@ export declare function agentToneLine(agent: {
     toneMode?: unknown;
     toneId?: unknown;
 }): string;
+/**
+ * The permission mode this agent runs with on its harness, and the layer that
+ * decided it (OSK-12069). The server resolves it (`effectivePermissionMode`) the
+ * way the dispatch does; the stored agent field alone is one of four layers, so
+ * printing it read "not set" for an agent whose harness default governed.
+ * Falls back to the stored field against a server that does not send the
+ * resolution, and says that is all it knows.
+ */
+export declare function agentPermissionLines(agent: Record<string, unknown>, harness: string): string[];
 /** Text rendering is deliberately based on the server projection, with a
  * storage-shape fallback while all stored policies are migrated. */
 export declare function agentExecutionOrderLines(agent: Record<string, unknown>): string[];

package/dist/commands/agents/show.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.agentToneLine = agentToneLine;
+exports.agentPermissionLines = agentPermissionLines;
 exports.agentExecutionOrderLines = agentExecutionOrderLines;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -31,6 +32,46 @@ function agentToneLine(agent) {
         return 'inherit — see `skrr agents tone show`';
     return '-';
 }
+const PERMISSION_SOURCE_LABELS = {
+    agent: "this agent's default",
+    harness: "the harness's default",
+};
+/**
+ * The permission mode this agent runs with on its harness, and the layer that
+ * decided it (OSK-12069). The server resolves it (`effectivePermissionMode`) the
+ * way the dispatch does; the stored agent field alone is one of four layers, so
+ * printing it read "not set" for an agent whose harness default governed.
+ * Falls back to the stored field against a server that does not send the
+ * resolution, and says that is all it knows.
+ */
+function agentPermissionLines(agent, harness) {
+    const effective = agent.effectivePermissionMode;
+    const pad = '             ';
+    if (!effective || typeof effective.source !== 'string') {
+        const stored = typeof agent.defaultPermissionMode === 'string' && agent.defaultPermissionMode
+            ? agent.defaultPermissionMode
+            : "not set on the agent (the harness's or the daemon's default applies)";
+        return [`Permission:  ${stored} — enforced by the ${harness} harness`];
+    }
+    const lines = [];
+    if (typeof effective.mode === 'string' && effective.mode) {
+        const from = PERMISSION_SOURCE_LABELS[effective.source] ?? effective.source;
+        lines.push(`Permission:  ${effective.mode} (from ${from}) — enforced by the ${harness} harness`);
+    }
+    else {
+        lines.push(`Permission:  set by the daemon's own config on that machine — no agent or harness mode is set`);
+    }
+    if (typeof effective.coercedFrom === 'string' && effective.coercedFrom) {
+        lines.push(`${pad}${effective.coercedFrom} is configured, but ${harness} cannot honour it, so it runs as ${String(effective.mode)}.`);
+    }
+    const supported = Array.isArray(effective.supportedModes)
+        ? effective.supportedModes.filter((m) => typeof m === 'string')
+        : [];
+    if (supported.length > 0)
+        lines.push(`${pad}${harness} accepts: ${supported.join(', ')}`);
+    lines.push(`${pad}A turn's own mode (\`agents chat --permission-mode\`) overrides this for that turn.`);
+    return lines;
+}
 /** Text rendering is deliberately based on the server projection, with a
  * storage-shape fallback while all stored policies are migrated. */
 function agentExecutionOrderLines(agent) {
@@ -163,6 +204,18 @@ class AgentsShow extends base_command_1.BaseCommand {
             this.log(line);
         if (a.harnessName || a.harnessProvider || a.harnessStatus) {
             this.log(`Harness:     ${a.harnessName ?? (typeof a.harnessProvider === 'string' ? (0, harness_provider_input_1.canonicalHarnessInput)(a.harnessProvider) : a.harnessProvider) ?? '-'}${a.harnessStatus ? ` (${a.harnessStatus})` : ''}`);
+            // On a harness, the HARNESS decides what runs and which permission modes
+            // exist — `Provider` is only the cloud model contract, so an agent read
+            // as "anthropic" while running Codex (OSK-12071). And the mode itself was
+            // visible only in --json (OSK-12069).
+            if (typeof a.harnessProvider === 'string' && a.harnessProvider) {
+                const harness = (0, harness_provider_input_1.canonicalHarnessInput)(a.harnessProvider);
+                for (const line of agentPermissionLines(a, harness))
+                    this.log(line);
+                if (typeof a.provider === 'string' && a.provider && a.provider !== harness) {
+                    this.log(`             Runs on ${harness}; Provider "${a.provider}" is only the cloud model contract.`);
+                }
+            }
             // An offline engine is the difference between "this agent works" and
             // "this agent silently does nothing", and the display name alone cannot
             // carry it: two runtimes for the same machine share an identical name,

package/dist/commands/agents/update.d.ts

@@ -55,3 +55,35 @@ export default class AgentsUpdate extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * The per-Agent mutation fence's "another request holds this right now"
+ * refusals. `updateAgent` takes a short lease on the Agent before it writes, so
+ * a concurrent writer — or, until OSK-12138, a lagging replica read of a lease
+ * row the same request had just created — refuses the update with one of these.
+ * Nothing was written, so repeating the identical PATCH is safe.
+ */
+export declare const AGENT_FENCE_RETRY_CODES: ReadonlySet<string>;
+/**
+ * Run an Agent write, and repeat it ONCE if the fence refused it as transient.
+ *
+ * Retried only when the server said both things: a fence code AND
+ * `retryable: true`. `MARKETPLACE_SOURCE_LIFECYCLE_BUSY` also covers a source
+ * that is being deleted or published, where the server answers
+ * `retryable: false`, and those must surface rather than be repeated. One retry,
+ * after a short pause, because the dogfooded case (OSK-12138) cleared on the
+ * first identical retry; anything that survives it is worth showing.
+ *
+ * Exported for tests.
+ */
+export declare function retryOnceOnAgentFence<T>(operation: () => Promise<T>, { delayMs }?: {
+    delayMs?: number;
+}): Promise<T>;
+/**
+ * What changing the agent's default permission mode actually changed
+ * (OSK-12124). It is the AGENT's default, so it governs every conversation,
+ * task run and Commitment Run of the agent from its next turn — which the bare
+ * "Updated agent" line never said, and the only way to learn that a live
+ * conversation picked it up was to spend another turn. Names the per-turn
+ * alternative for the case that wanted one conversation changed.
+ */
+export declare function defaultPermissionModeNote(requested: string | undefined, updated: Record<string, unknown>): string | null;

package/dist/commands/agents/update.js

@@ -1,5 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_FENCE_RETRY_CODES = void 0;
+exports.retryOnceOnAgentFence = retryOnceOnAgentFence;
+exports.defaultPermissionModeNote = defaultPermissionModeNote;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agent_visual_refs_1 = require("../../lib/agent-visual-refs");
@@ -50,6 +53,8 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         }),
         'default-permission-mode': core_1.Flags.string({
             description: "Permission mode for this agent's local-harness sessions (every harness, not only Claude Code). " +
+                'It is the default for EVERY conversation, task run and Commitment Run of the agent; for one ' +
+                'turn only use `agents chat --permission-mode`. ' +
                 'One-shot harnesses (gemini, opencode, cursor, copilot, goose, pi, openclaw) can only run as ' +
                 'bypassPermissions; any other mode is refused for them.',
             options: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
@@ -96,22 +101,26 @@ class AgentsUpdate extends base_command_1.BaseCommand {
                 '09:00-18:00@America/Los_Angeles',
         }),
         // Retired (OSK-11975): a Commitment turn works under the Agent's own
-        // permissions, so these three are stored but no longer read at runtime.
+        // permissions. Hidden, warned on use, and never sent (OSK-12068) — see
+        // `mergeAgentConfigFlags`. Kept parseable so an old script still runs.
         'reasoning-tool-escape': core_1.Flags.string({
-            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
+            description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.REASONING_TOOL_ESCAPES],
             multiple: true,
             deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            hidden: true,
         }),
         'commitment-responsibility': core_1.Flags.string({
-            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
+            description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
             deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            hidden: true,
         }),
         'commitment-responsibility-ceiling': core_1.Flags.string({
-            description: "Deprecated — no longer has any effect. Commitment runs use the agent's own permissions.",
+            description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
             deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            hidden: true,
         }),
         'max-turns': core_1.Flags.integer({ description: 'Maximum turns in one agent run (1-500)' }),
         'tool-resources': core_1.Flags.string({
@@ -181,16 +190,18 @@ class AgentsUpdate extends base_command_1.BaseCommand {
             this.error(err.message, { exit: 1 });
         }
         if (Object.keys(payload).length === 0) {
-            this.error('Nothing to update. Pass at least one flag (e.g. --name) or --from-json.', {
-                exit: 1,
-            });
+            const retired = agent_config_1.RETIRED_COMMITMENT_PERMISSION_FLAGS.filter((flag) => flags[flag] !== undefined);
+            this.error(retired.length > 0
+                ? `Nothing to update: ${retired.map((flag) => `--${flag}`).join(', ')} ` +
+                    `${retired.length === 1 ? 'is' : 'are'} retired and not sent. ${agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED}`
+                : 'Nothing to update. Pass at least one flag (e.g. --name) or --from-json.', { exit: 1 });
         }
         let updated;
         try {
-            updated = await data_provider_1.dataService.updateAgent({
+            updated = await retryOnceOnAgentFence(() => data_provider_1.dataService.updateAgent({
                 agent_id: args.id,
                 data: payload,
-            });
+            }));
         }
         catch (err) {
             this.handleApiError(err);
@@ -213,6 +224,67 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         const a = updated;
         this.log(`Updated agent ${a.id ?? a._id ?? args.id} — ${a.name ?? '(no name)'}`);
         this.log(`URL: ${(0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, { ...a, id: a.id ?? a._id ?? args.id }).url ?? '-'}`);
+        const modeNote = defaultPermissionModeNote(flags['default-permission-mode'], a);
+        if (modeNote)
+            this.log(modeNote);
     }
 }
 exports.default = AgentsUpdate;
+/**
+ * The per-Agent mutation fence's "another request holds this right now"
+ * refusals. `updateAgent` takes a short lease on the Agent before it writes, so
+ * a concurrent writer — or, until OSK-12138, a lagging replica read of a lease
+ * row the same request had just created — refuses the update with one of these.
+ * Nothing was written, so repeating the identical PATCH is safe.
+ */
+exports.AGENT_FENCE_RETRY_CODES = new Set([
+    'MARKETPLACE_SOURCE_LIFECYCLE_RACE',
+    'MARKETPLACE_SOURCE_LIFECYCLE_BUSY',
+    'MARKETPLACE_SOURCE_LIFECYCLE_CAS_LOST',
+]);
+/**
+ * Run an Agent write, and repeat it ONCE if the fence refused it as transient.
+ *
+ * Retried only when the server said both things: a fence code AND
+ * `retryable: true`. `MARKETPLACE_SOURCE_LIFECYCLE_BUSY` also covers a source
+ * that is being deleted or published, where the server answers
+ * `retryable: false`, and those must surface rather than be repeated. One retry,
+ * after a short pause, because the dogfooded case (OSK-12138) cleared on the
+ * first identical retry; anything that survives it is worth showing.
+ *
+ * Exported for tests.
+ */
+async function retryOnceOnAgentFence(operation, { delayMs = 750 } = {}) {
+    try {
+        return await operation();
+    }
+    catch (err) {
+        const { code, body } = (0, base_command_1.apiRefusal)(err);
+        if (!code || !exports.AGENT_FENCE_RETRY_CODES.has(code) || body?.retryable !== true)
+            throw err;
+        if (delayMs > 0)
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+        return operation();
+    }
+}
+/**
+ * What changing the agent's default permission mode actually changed
+ * (OSK-12124). It is the AGENT's default, so it governs every conversation,
+ * task run and Commitment Run of the agent from its next turn — which the bare
+ * "Updated agent" line never said, and the only way to learn that a live
+ * conversation picked it up was to spend another turn. Names the per-turn
+ * alternative for the case that wanted one conversation changed.
+ */
+function defaultPermissionModeNote(requested, updated) {
+    if (!requested)
+        return null;
+    const stored = typeof updated.defaultPermissionMode === 'string' && updated.defaultPermissionMode
+        ? updated.defaultPermissionMode
+        : requested;
+    return [
+        `Permission: ${stored} is now this agent's default for EVERY conversation, task run and`,
+        '            Commitment Run, starting with each one’s next turn. A turn that names its own',
+        '            mode still wins. To change one turn only, leave the default alone and pass',
+        `            \`skrr agents chat <agent> --conversation <id> --permission-mode ${requested}\`.`,
+    ].join('\n');
+}