@skrr-ai/cli 0.1.51 → 0.1.53

package/dist/commands/login.js

@@ -7,6 +7,7 @@ const base_command_1 = require("../base-command");
 const daemonHandoff_1 = require("../lib/daemonHandoff");
 const daemon_setup_1 = require("../lib/daemon-setup");
 const config_1 = require("../lib/config");
+const cli_id_1 = require("../lib/cli-id");
 const keychain_1 = require("../lib/keychain");
 const login_1 = require("../lib/login");
 const device_code_1 = require("../lib/device-code");
@@ -40,16 +41,33 @@ const prompt_1 = require("../lib/prompt");
  * `cliLoginWithRefreshToken` for the full rationale.
  */
 class Login extends base_command_1.BaseCommand {
-    static description = 'Sign in to a skrr instance (PKCE localhost callback; device-code fallback). ' +
-        'On an interactive first login on a computer without the skrr background service, skrr ' +
-        'offers to install it. Choose no, or set SKRR_SKIP_DAEMON_HANDOFF=1 before running this ' +
-        'command, to skip that optional setup.';
+    // OSK-12152 — the help used to describe only the browser flow. `skrr login`
+    // asks the local daemon FIRST, and nothing said so; nor that what it stores
+    // differs from what plain commands borrow from the daemon on their own.
+    static description = 'Sign in to a skrr instance and store a durable session for this profile.\n\n' +
+        'It tries, in order:\n' +
+        '  1. the skrr background service on this computer, when one is running and signed in to the ' +
+        'same server — it mints this profile a CLI session with no browser;\n' +
+        '  2. a browser sign-in through a localhost callback (PKCE);\n' +
+        '  3. a device code — under SSH, with --device-code, or when the callback cannot run.\n' +
+        'If the background service answers but refuses, skrr says why before moving on.\n\n' +
+        'What it stores: a refresh session in this profile’s credential store (the macOS Keychain, ' +
+        'or ~/.skrr/cli-auth.json elsewhere) that keeps renewing itself. Plain skrr commands on a ' +
+        'computer whose background service is signed in need no login at all: they borrow a ' +
+        'short-lived token from it for each run and store nothing (an older background service ' +
+        'mints them a stored session instead). On a Dedicated Runtime, where the service only ' +
+        'lends short-lived tokens, nothing is stored.\n\n' +
+        'Set OVERSKY_SKIP_DAEMON_BROKER=1 to skip step 1 (--device-code skips it too). After signing ' +
+        'in, skrr also signs the background service in, and on an interactive first login on a ' +
+        'computer without it, offers to install it. Set SKRR_SKIP_DAEMON_HANDOFF=1 to skip that ' +
+        'optional setup; it does not skip step 1.';
     static examples = [
         '<%= config.bin %> login',
         '<%= config.bin %> login --env prod',
         '<%= config.bin %> login --base-url https://skrr.ai',
         '<%= config.bin %> login --server http://localhost:3090',
         '<%= config.bin %> login --device-code',
+        'OVERSKY_SKIP_DAEMON_BROKER=1 <%= config.bin %> login',
         '<%= config.bin %> login --port 1455',
         '<%= config.bin %> login --recovery-code "W7K2J-X9P3M-R6Y4Q-..."',
         'OVERSKY_REFRESH_TOKEN=... OVERSKY_CLI_ID=... <%= config.bin %> login',
@@ -244,7 +262,8 @@ class Login extends base_command_1.BaseCommand {
      *
      * `cliId` resolution priority:
      *   1. `OVERSKY_CLI_ID` env var — explicit, wins over everything.
-     *   2. `cliConfig.cliId` — set by a prior `skrr login` on this machine.
+     *   2. `resolveCliId(cliConfig)` — the id a prior `skrr login` of this
+     *      profile presents (its own, or the machine's).
      *      Honored so a same-machine restore "just works" without forcing
      *      the operator to re-export the cliId.
      *   3. error — without a cliId the refresh row binding can't be matched
@@ -252,8 +271,8 @@ class Login extends base_command_1.BaseCommand {
      *      pointing at `skrr whoami` on the original box.
      */
     async runRefreshTokenLogin(refreshToken) {
-        const envCliId = process.env.OVERSKY_CLI_ID;
-        const cliId = typeof envCliId === 'string' && envCliId.length > 0 ? envCliId : this.cliConfig.cliId;
+        // `resolveCliId` already puts OVERSKY_CLI_ID / SKRR_CLI_ID first.
+        const cliId = (0, cli_id_1.resolveCliId)(this.cliConfig);
         if (!cliId) {
             this.error('OVERSKY_REFRESH_TOKEN is set but no cliId is available. The refresh\n' +
                 'row is bound to the cliId it was issued for; without it the server\n' +

package/dist/commands/logout.js

@@ -244,6 +244,9 @@ class Logout extends base_command_1.BaseCommand {
         (0, config_1.saveConfig)({
             baseURL: cfg.baseURL,
             ...(cfg.cliId ? { cliId: cfg.cliId } : {}),
+            // A named profile's own identity outlives a session exactly as the
+            // machine's does, so its next login re-presents it (OSK-12156).
+            ...(cfg.profileCliId ? { profileCliId: cfg.profileCliId } : {}),
             ...(agentSetting.value ? { [first_party_harness_managed_1.AGENT_CONFIG_KEY]: agentSetting.value } : {}),
             ...(cfg.credentials ? { credentials: cfg.credentials } : {}),
             migrated: { ...(cfg.migrated ?? {}), authOutOfConfig: true },

package/dist/commands/machines/dedicated/show.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const daemon_installer_1 = require("../../../lib/daemon-installer");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
 const harnesses_1 = require("../../../lib/harnesses");
 class DedicatedMachinesShow extends dedicated_lease_command_1.DedicatedLeaseCommand {
@@ -40,6 +41,12 @@ class DedicatedMachinesShow extends dedicated_lease_command_1.DedicatedLeaseComm
         catch {
             harnesses = [];
         }
+        // The latest daemon RELEASE, from the same signed feed a daemon updates
+        // from. The lease says which daemon the approved image carries; only this
+        // says whether a newer release exists that no approved image carries yet —
+        // which is what `skrrd update --check` on the machine reports (OSK-12153).
+        // Best-effort: an unreachable feed is said, never read as "none newer".
+        const latestDaemonRelease = lease.health?.image ? await readLatestDaemonRelease() : null;
         if (flags.json) {
             const engines = (0, dedicated_machines_1.dedicatedLeaseHarnesses)(lease, harnesses).map((harness) => ({
                 harnessId: harness._id,
@@ -47,11 +54,27 @@ class DedicatedMachinesShow extends dedicated_lease_command_1.DedicatedLeaseComm
                 status: harness.status,
                 lastSeenAt: harness.lastSeenAt,
             }));
-            this.log(JSON.stringify({ ...response, harnesses: engines }, null, 2));
+            this.log(JSON.stringify({
+                ...response,
+                harnesses: engines,
+                ...(latestDaemonRelease ? { latestDaemonRelease } : {}),
+            }, null, 2));
             return;
         }
-        for (const line of (0, dedicated_machines_1.describeDedicatedLease)(lease, harnesses))
+        for (const line of (0, dedicated_machines_1.describeDedicatedLease)(lease, harnesses, { latestDaemonRelease })) {
             this.log(line);
+        }
     }
 }
 exports.default = DedicatedMachinesShow;
+async function readLatestDaemonRelease() {
+    try {
+        const result = await (0, daemon_installer_1.fetchVerifiedDaemonManifest)();
+        if (result.ok)
+            return { version: result.manifest.version };
+        return { error: result.code };
+    }
+    catch (err) {
+        return { error: err?.message || 'unreadable' };
+    }
+}

package/dist/commands/tasks/approvals/list.d.ts

@@ -14,6 +14,28 @@ export declare function approvalRow(a: Record<string, unknown>): {
     approver: string;
     created: string;
 };
+/**
+ * OSK-12165 — the task's latest run, when it ended blocked on a permission
+ * nobody could grant.
+ *
+ * An unattended run (`tasks start`) cannot ask anyone: the permission bridge
+ * declines every ask at once, so no approval row is ever created, and this
+ * command used to answer "No approvals." in exactly the case `tasks start`
+ * sends people here for. The evidence lives on the run, not in the approvals
+ * collection: the leaf finalizer settles it with `error.code`
+ * `permission_blocked`, which `GET /tasks/:id/runs` projects as `failureCode`
+ * alongside the sentence (what was refused, and the fix) as `failureReason`.
+ *
+ * Only the LATEST run counts (the route sorts newest first): a permission block
+ * on an older run that a later run got past is history, not the current state.
+ */
+export declare function permissionBlockedRun(runs: Array<Record<string, unknown>>): Record<string, unknown> | null;
+/**
+ * What to print for such a run: why it is blocked, what needed approval (the
+ * run's own recorded sentence, which names the refused tool), that an
+ * unattended run cannot prompt, and the two ways forward with exact commands.
+ */
+export declare function permissionBlockLines(run: Record<string, unknown>, bin?: string, taskRef?: string): string[];
 export default class TasksApprovalsList extends BaseCommand {
     static description: string;
     static examples: string[];

package/dist/commands/tasks/approvals/list.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.approvalRow = approvalRow;
+exports.permissionBlockedRun = permissionBlockedRun;
+exports.permissionBlockLines = permissionBlockLines;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
@@ -22,6 +24,52 @@ function approvalRow(a) {
         created: a.createdAt ? (0, format_1.localTime)(a.createdAt) : '-',
     };
 }
+/**
+ * OSK-12165 — the task's latest run, when it ended blocked on a permission
+ * nobody could grant.
+ *
+ * An unattended run (`tasks start`) cannot ask anyone: the permission bridge
+ * declines every ask at once, so no approval row is ever created, and this
+ * command used to answer "No approvals." in exactly the case `tasks start`
+ * sends people here for. The evidence lives on the run, not in the approvals
+ * collection: the leaf finalizer settles it with `error.code`
+ * `permission_blocked`, which `GET /tasks/:id/runs` projects as `failureCode`
+ * alongside the sentence (what was refused, and the fix) as `failureReason`.
+ *
+ * Only the LATEST run counts (the route sorts newest first): a permission block
+ * on an older run that a later run got past is history, not the current state.
+ */
+function permissionBlockedRun(runs) {
+    const latest = runs[0];
+    if (!latest)
+        return null;
+    const code = latest.failureCode ?? latest.failureClass;
+    return code === data_provider_1.PERMISSION_BLOCKED_FAILURE_CODE ? latest : null;
+}
+/**
+ * What to print for such a run: why it is blocked, what needed approval (the
+ * run's own recorded sentence, which names the refused tool), that an
+ * unattended run cannot prompt, and the two ways forward with exact commands.
+ */
+function permissionBlockLines(run, bin = 'skrr', taskRef = '<task-id>') {
+    const runId = String(run.runId ?? run.id ?? '-');
+    const reason = typeof run.failureReason === 'string' ? run.failureReason.trim() : '';
+    const executor = run.executor;
+    const agent = executor && typeof executor.agentId === 'string' && executor.agentId
+        ? executor.agentId
+        : '<agent>';
+    return [
+        `The latest run (${runId}) is blocked on a permission, not on an approval request.`,
+        ...(reason ? [`  ${reason}`] : []),
+        'It ran unattended (`tasks start`), and an unattended run cannot prompt anyone to approve a',
+        'tool call, so the ask was refused on the spot and no approval request was recorded here.',
+        '',
+        'To continue, either:',
+        `  ${bin} agents chat ${agent} --approve-tools --prompt "..."   do the work interactively, approving each call`,
+        `  ${bin} agents update ${agent} --default-permission-mode bypassPermissions   let unattended runs use the tool`,
+        `  then: ${bin} tasks start ${taskRef}   (or pick an agent/harness whose mode allows it)`,
+    ];
+}
 class TasksApprovalsList extends base_command_1.BaseCommand {
     static description = 'List approvals for a task';
     static examples = [
@@ -44,14 +92,38 @@ class TasksApprovalsList extends base_command_1.BaseCommand {
         catch (err) {
             this.handleApiError(err);
         }
+        const r = response;
+        const items = r?.data ?? [];
+        // OSK-12165 — an unattended run blocked on a permission leaves no approval
+        // row, so the empty list alone would say "nothing to act on" about a task
+        // that is waiting on exactly that. Read the latest run, best-effort: the
+        // approvals list is still the answer if the runs read fails.
+        let blockedRun = null;
+        try {
+            const runs = (await data_provider_1.dataService.getTaskRuns(args.id));
+            blockedRun = permissionBlockedRun(runs?.data ?? []);
+        }
+        catch {
+            blockedRun = null;
+        }
+        const blockLines = blockedRun ? permissionBlockLines(blockedRun, this.config.bin, args.id) : [];
         if (flags.json) {
+            // The server payload stays byte-identical; the pointer goes to stderr so
+            // `--json` remains parseable and a script still learns the task is stuck.
+            if (blockedRun) {
+                this.warn(`The latest run is blocked on a permission an unattended run could not ask for; ` +
+                    `\`${this.config.bin} tasks approvals list ${args.id}\` (without --json) says what to do.`);
+            }
             this.log(JSON.stringify(response, null, 2));
             return;
         }
-        const r = response;
-        const items = r?.data ?? [];
         if (items.length === 0) {
-            this.log('No approvals.');
+            this.log('No approval requests.');
+            if (blockLines.length > 0) {
+                this.log('');
+                for (const line of blockLines)
+                    this.log(line);
+            }
             return;
         }
         const rows = items.map(approvalRow);
@@ -62,6 +134,11 @@ class TasksApprovalsList extends base_command_1.BaseCommand {
             { key: 'approver', header: 'APPROVER', maxWidth: 30 },
             { key: 'created', header: 'CREATED' },
         ], (line) => this.log(line));
+        if (blockLines.length > 0) {
+            this.log('');
+            for (const line of blockLines)
+                this.log(line);
+        }
     }
 }
 exports.default = TasksApprovalsList;

package/dist/commands/tasks/create.d.ts

@@ -25,6 +25,11 @@ import { type TaskRecord } from '../../lib/tasks';
  * Same shape as `warnDroppedDefaultAssignees` below, which does this for a
  * silently-dropped assignee (OSK-4857).
  */
+/**
+ * `tagLabelWarning` for a task: the task-label vocabulary of the ambient
+ * workspace. Shared by `tasks create` and `tasks update`.
+ */
+export declare function taskTagLabelWarning(tags: string[] | undefined, attachedLabelIds: string[] | undefined): Promise<string>;
 export declare function droppedEstimateWarning(requested: number | undefined, written: Record<string, unknown> | null | undefined, spaceId?: string | null): string | null;
 /** A create may have committed before any of these response failures surfaced. */
 export declare function taskCreateMayHaveCommitted(error: unknown): boolean;

package/dist/commands/tasks/create.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskTagLabelWarning = taskTagLabelWarning;
 exports.droppedEstimateWarning = droppedEstimateWarning;
 exports.taskCreateMayHaveCommitted = taskCreateMayHaveCommitted;
 exports.taskMatchesCreateIdentity = taskMatchesCreateIdentity;
@@ -36,6 +37,16 @@ const web_url_1 = require("../../lib/web-url");
  * Same shape as `warnDroppedDefaultAssignees` below, which does this for a
  * silently-dropped assignee (OSK-4857).
  */
+/**
+ * `tagLabelWarning` for a task: the task-label vocabulary of the ambient
+ * workspace. Shared by `tasks create` and `tasks update`.
+ */
+function taskTagLabelWarning(tags, attachedLabelIds) {
+    return (0, label_ref_1.tagLabelWarning)(tags, attachedLabelIds, {
+        applicableTo: 'task',
+        ...(process.env.OVERSKY_WORKSPACE_ID ? { workspaceId: process.env.OVERSKY_WORKSPACE_ID } : {}),
+    });
+}
 function droppedEstimateWarning(requested, written, spaceId) {
     if (requested === undefined || requested === null)
         return null;
@@ -137,7 +148,8 @@ class TasksCreate extends base_command_1.BaseCommand {
             description: 'Stable caller-supplied idempotency key for create/upsert workflows',
         }),
         'default-agent': core_1.Flags.string({
-            description: 'Override the automatic assignee with an Agent. Use "auto" to inherit the space lead ' +
+            description: 'Override the automatic assignee with an Agent (it becomes the assignee that runs the task; ' +
+                '--assignee-agent names one directly). Use "auto" to inherit the space lead ' +
                 'agent. Without this, a task falls to the agent this session is bound to ' +
                 '(OVERSKY_SESSION_AGENT_ID), to you when --execution-mode is human, or to nobody. ' +
                 'Cannot be combined with --execution-mode human.',
@@ -161,8 +173,9 @@ class TasksCreate extends base_command_1.BaseCommand {
             description: 'Commitment ID that owns this task. Use for work created directly from a commitment without a linked goal.',
         }),
         project: core_1.Flags.string({
-            description: 'Canonical Project ID — attach the task to a project. A task created with a project ' +
-                "but no --space resolves and inherits the project's space.",
+            description: 'Project to attach the task to: its `id` (uuid; a pasted `_id` is accepted and rewritten ' +
+                'to the `id`), or its ref (OSK-P-5) with --space. Without --space the task inherits ' +
+                "the project's space.",
         }),
         cycle: core_1.Flags.string({
             description: 'Cycle ID, or "current" / "next" within the task Space',
@@ -174,7 +187,8 @@ class TasksCreate extends base_command_1.BaseCommand {
             description: 'Source message ID (requires --source-conversation or daemon session context)',
         }),
         'assignee-agent': core_1.Flags.string({
-            description: 'Assignee agent — id or name, resolved within --space (repeatable)',
+            description: 'Assignee agent: the agent that DOES the work when the task starts (the first listed runs). ' +
+                'Id or name, resolved within --space (repeatable)',
             multiple: true,
         }),
         'assignee-user': core_1.Flags.string({
@@ -182,7 +196,8 @@ class TasksCreate extends base_command_1.BaseCommand {
             multiple: true,
         }),
         'dri-agent': core_1.Flags.string({
-            description: 'Explicit accountable agent DRI (separate from assignees)',
+            description: 'Accountable agent (DRI), separate from assignees. `tasks start` runs an assignee, ' +
+                'not the DRI — use --assignee-agent for the agent that does the work',
         }),
         'dri-user': core_1.Flags.string({
             description: 'Explicit accountable human DRI (separate from assignees)',
@@ -219,11 +234,12 @@ class TasksCreate extends base_command_1.BaseCommand {
                 'ancestor it inherits from); with none set, the server drops the value. Set one with ' +
                 '`spaces update <space> --estimate-scale <scale> --estimate-migration <clear|migrate>`.',
         }),
-        tag: core_1.Flags.string({ description: 'Tag (repeatable)', multiple: true }),
+        tag: core_1.Flags.string({ description: label_ref_1.TAG_FLAG_HELP, multiple: true }),
         'label-id': core_1.Flags.string({
             aliases: ['label'],
             description: 'Attach a task label (repeatable) — id, or a name from `skrr labels list --applicable-to task`. ' +
-                'An unknown name is refused, never created. Manage labels with `skrr labels`.',
+                'An unknown name is refused, never created. Also accepted as --label. ' +
+                'Manage labels with `skrr labels`.',
             multiple: true,
         }),
         'working-directory': core_1.Flags.string({
@@ -517,6 +533,11 @@ class TasksCreate extends base_command_1.BaseCommand {
         const estimateWarning = droppedEstimateWarning(flags.estimate, created, payload.spaceId);
         if (estimateWarning)
             this.warn(estimateWarning);
+        // A `--tag` spelled like a declared label is almost always a label someone
+        // meant to attach (OSK-12053). Say so; never convert it implicitly.
+        const tagWarning = await taskTagLabelWarning(flags.tag, resolvedLabelIds);
+        if (tagWarning)
+            this.warn(tagWarning);
         if (flags.json) {
             // The raw task row alone cannot tell a script the assignee it implicitly
             // asked for was dropped (`assigneeAgentIds: []`) from "nobody was ever

package/dist/commands/tasks/start.d.ts

@@ -1,6 +1,7 @@
 import { BaseCommand } from '../../base-command';
 export default class TasksStart extends BaseCommand {
     static description: string;
+    static aliases: string[];
     static examples: string[];
     static args: {
         id: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
@@ -13,3 +14,16 @@ export default class TasksStart extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * What to run next, printed after a start (OSK-12128). A start used to print
+ * two ids and stop, and the way to watch it was found by accident. Every
+ * command named here exists; `tasks-start.follow-up.spec.ts` pins that.
+ *
+ * The last line announces the files a local run adds to its working directory:
+ * the daemon writes a per-run instruction file (AGENTS.md for Codex, CLAUDE.md
+ * for a worktree session, plus any server-sent context file) when nothing is
+ * at that name, and removes what it wrote afterwards unless it was changed
+ * (`daemon/src/session-context-file.ts`). Unannounced, those were the first two
+ * files in a directory the task said to leave alone.
+ */
+export declare function startFollowUpLines(bin: string, taskRef: string): string[];

package/dist/commands/tasks/start.js

@@ -1,12 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.startFollowUpLines = startFollowUpLines;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const task_resolver_1 = require("../../lib/task-resolver");
 const git_task_1 = require("../../lib/git-task");
 class TasksStart extends base_command_1.BaseCommand {
-    static description = 'Start execution of a task (spawns a conversation + session)';
+    static description = 'Start execution of a task: its assignee agent runs it in a new conversation + session. ' +
+        'Alias: tasks execute';
+    // `tasks execute` is the verb a first-time user reaches for, and it was
+    // "not a command" (OSK-12128). One command, two names.
+    static aliases = ['tasks:execute'];
     static examples = [
         '<%= config.bin %> tasks start <task-id>',
         '<%= config.bin %> tasks start',
@@ -109,6 +114,31 @@ class TasksStart extends base_command_1.BaseCommand {
             this.log(`${branch.created ? 'Created' : 'Checked out'} branch: ${branch.branch}`);
         this.log(`Conversation: ${result.conversationId}`);
         this.log(`Session:      ${result.sessionId}`);
+        for (const line of startFollowUpLines(this.config.bin, taskIdentity.id))
+            this.log(line);
     }
 }
 exports.default = TasksStart;
+/**
+ * What to run next, printed after a start (OSK-12128). A start used to print
+ * two ids and stop, and the way to watch it was found by accident. Every
+ * command named here exists; `tasks-start.follow-up.spec.ts` pins that.
+ *
+ * The last line announces the files a local run adds to its working directory:
+ * the daemon writes a per-run instruction file (AGENTS.md for Codex, CLAUDE.md
+ * for a worktree session, plus any server-sent context file) when nothing is
+ * at that name, and removes what it wrote afterwards unless it was changed
+ * (`daemon/src/session-context-file.ts`). Unannounced, those were the first two
+ * files in a directory the task said to leave alone.
+ */
+function startFollowUpLines(bin, taskRef) {
+    return [
+        '',
+        'Follow it:',
+        `  ${bin} tasks watch ${taskRef}            status until it finishes or fails`,
+        `  ${bin} tasks transcript ${taskRef}       what the agent has said so far`,
+        `  ${bin} tasks approvals list ${taskRef}   approvals waiting on you, or why a run is blocked on one`,
+        'On a local machine, the run may add its instruction file (AGENTS.md / CLAUDE.md) to the',
+        'working directory while it runs; files the run wrote are removed afterwards unless changed.',
+    ];
+}

package/dist/commands/tasks/update.js

@@ -9,6 +9,7 @@ const tasks_1 = require("../../lib/tasks");
 const task_resolver_1 = require("../../lib/task-resolver");
 const tasks_2 = require("../../lib/tasks");
 const create_1 = require("./create");
+const label_ref_1 = require("../../lib/label-ref");
 class TasksUpdate extends base_command_1.BaseCommand {
     static description = 'Update an existing task (partial patch). Status and PROJECT changes go through ' +
         '`tasks move` — see `--goal` / `--space` below.';
@@ -156,10 +157,14 @@ class TasksUpdate extends base_command_1.BaseCommand {
             description: 'Remove a task from the list this one blocks (repeatable)',
             multiple: true,
         }),
-        tag: core_1.Flags.string({ description: 'Replace tags (repeatable)', multiple: true }),
+        tag: core_1.Flags.string({
+            description: `Replace tags (repeatable, whole-list). ${label_ref_1.TAG_FLAG_HELP}`,
+            multiple: true,
+        }),
         'label-id': core_1.Flags.string({
             aliases: ['label'],
-            description: 'Replace the task labels with these ids (repeatable, whole-list). ' +
+            description: 'Replace the task labels (repeatable, whole-list) — id, or a name from ' +
+                '`skrr labels list --applicable-to task`. Also accepted as --label. ' +
                 'Use `skrr tasks labels attach/detach` for incremental changes.',
             multiple: true,
         }),
@@ -318,6 +323,25 @@ class TasksUpdate extends base_command_1.BaseCommand {
                 }
             }
         }
+        // Same resolution as `tasks create`: the `--tag` warning below suggests
+        // `--label-id <name>`, so this flag has to accept the name it suggests
+        // (OSK-12166). Ids pass through untouched.
+        let resolvedLabelIds;
+        if (flags['label-id'] !== undefined) {
+            try {
+                resolvedLabelIds = await (0, label_ref_1.resolveLabelRefs)(flags['label-id'], {
+                    applicableTo: 'task',
+                    ...(process.env.OVERSKY_WORKSPACE_ID
+                        ? { workspaceId: process.env.OVERSKY_WORKSPACE_ID }
+                        : {}),
+                });
+            }
+            catch (err) {
+                if (err instanceof label_ref_1.LabelRefError)
+                    this.error(err.message, { exit: 1 });
+                this.handleApiError(err);
+            }
+        }
         const payload = (0, prompt_1.mergeDefined)((0, task_resolver_1.stripTaskIdentityFields)(body), {
             title: flags.title,
             expectations: expectationsPatch === null ? [] : (expectationsPatch ?? undefined),
@@ -349,7 +373,7 @@ class TasksUpdate extends base_command_1.BaseCommand {
             addBlocksIds: flags['add-blocks'],
             removeBlocksIds: flags['remove-blocks'],
             tags: flags.tag,
-            labelIds: flags['label-id'],
+            labelIds: resolvedLabelIds,
             // Worktree isolation override. --worktree ⇒ 'ephemeral', --no-worktree ⇒
             // 'shared', omitted ⇒ unchanged. (Clear-to-inherit via --from-json.)
             executionIsolation: (0, tasks_2.executionIsolationFromWorktreeFlag)(flags.worktree),
@@ -444,6 +468,9 @@ class TasksUpdate extends base_command_1.BaseCommand {
         const estimateWarning = (0, create_1.droppedEstimateWarning)(flags.estimate, updated, updated?.spaceId);
         if (estimateWarning)
             this.warn(estimateWarning);
+        const tagWarning = await (0, create_1.taskTagLabelWarning)(flags.tag, resolvedLabelIds);
+        if (tagWarning)
+            this.warn(tagWarning);
         if (flags.json) {
             this.log(JSON.stringify((0, web_url_1.withTaskUrl)(this.cliConfig.baseURL, updated), null, 2));
             return;

package/dist/commands/whoami.js

@@ -10,6 +10,7 @@ const auth_storage_1 = require("../lib/auth-storage");
 const keychain_1 = require("../lib/keychain");
 const cred_envelope_1 = require("../lib/cred-envelope");
 const config_1 = require("../lib/config");
+const cli_id_1 = require("../lib/cli-id");
 /**
  * `skrr whoami`
  *
@@ -101,7 +102,7 @@ class Whoami extends base_command_1.BaseCommand {
             daemonId,
             server: this.cliConfig.baseURL,
             profile: (0, keychain_1.getActiveProfile)(),
-            cliId: this.cliConfig.cliId ?? null,
+            cliId: (0, cli_id_1.resolveCliId)(this.cliConfig) ?? null,
             token: {
                 source: this.credentialSourceLabel(),
                 kind: this.resolvedCredential.kind,
@@ -135,8 +136,9 @@ class Whoami extends base_command_1.BaseCommand {
         // where the login message sends you to find out where you are (OSK-301).
         this.log(`Server:         ${(0, config_1.describeDeployment)(this.cliConfig.baseURL)}`);
         this.log(`Profile:        ${(0, keychain_1.getActiveProfile)()}`);
-        if (this.cliConfig.cliId) {
-            this.log(`CLI ID:         ${this.cliConfig.cliId}`);
+        const cliId = (0, cli_id_1.resolveCliId)(this.cliConfig);
+        if (cliId) {
+            this.log(`CLI ID:         ${cliId}`);
         }
         this.log(`Token source:   ${this.credentialSourceLabel() ?? '(none)'}`);
         this.log(`Token kind:     ${this.resolvedCredential.kind}`);

package/dist/lib/agent-config.d.ts

@@ -2,6 +2,21 @@ export declare const COMMITMENT_RESPONSIBILITY_LEVELS: readonly ["reasoning_only
 export declare const REASONING_TOOL_ESCAPES: readonly ["bash", "browser"];
 /** Warning printed by the three retired Commitment permission flags (OSK-11975). */
 export declare const COMMITMENT_PERMISSION_FLAG_RETIRED = "This setting no longer has any effect: Commitment runs use the agent's own permissions.";
+/** The three retired flags themselves: accepted at parse, warned on, never sent. */
+export declare const RETIRED_COMMITMENT_PERMISSION_FLAGS: readonly ["reasoning-tool-escape", "commitment-responsibility", "commitment-responsibility-ceiling"];
+/**
+ * The deprecation warning ONE retired flag prints. oclif prints a
+ * `deprecated.message` verbatim, so a shared message printed the same line
+ * once per flag with nothing saying which flag each one was about (OSK-12068).
+ */
+export declare function retiredCommitmentPermissionFlagMessage(flag: (typeof RETIRED_COMMITMENT_PERMISSION_FLAGS)[number]): string;
+/**
+ * The fields the server ignored and why, from a write's `deprecatedFields`
+ * notice, one line each. Empty when the response carries none.
+ */
+export declare function deprecatedFieldsWarnings(response: unknown): string[];
+/** The payload keys the server reported as ignored, so they are not also called "not kept". */
+export declare function deprecatedFieldNames(response: unknown): string[];
 export declare const RELEASE_INSTALL_CHANNELS: readonly ["latest", "manual"];
 /**
  * `09:00-18:00` or `09:00-18:00@America/Los_Angeles`, or a JSON object.