@skrr-ai/cli 0.1.52 → 0.1.53

package/dist/commands/agents/chat.js

@@ -269,7 +269,8 @@ class AgentsChat extends base_command_1.BaseCommand {
                 'calls arrive as `tool.started` / `tool.completed`, once per `toolUseId`, on cloud ' +
                 'and local-harness runs alike. A `session.notice` with `notice: ' +
                 '"harness-session-reset"` means the local harness could not resume its previous ' +
-                'session and started a new one; `message` says why. A `permission.resolved` says ' +
+                'session and started a new one, which does not see earlier turns of the ' +
+                'conversation; `message` says why. A `permission.resolved` says ' +
                 'how a local harness permission request was decided: `decidedBy` in words, and ' +
                 '`basis` — `person` (with `surface`), `mode` (with `mode`), `policy` or ' +
                 '`session-grant` — beside the wire `by`.',

package/dist/commands/agents/create.js

@@ -252,19 +252,23 @@ class AgentsCreate extends base_command_1.BaseCommand {
             description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.REASONING_TOOL_ESCAPES],
             multiple: true,
-            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            deprecated: { message: (0, agent_config_1.retiredCommitmentPermissionFlagMessage)('reasoning-tool-escape') },
             hidden: true,
         }),
         'commitment-responsibility': core_1.Flags.string({
             description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
-            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            deprecated: {
+                message: (0, agent_config_1.retiredCommitmentPermissionFlagMessage)('commitment-responsibility'),
+            },
             hidden: true,
         }),
         'commitment-responsibility-ceiling': core_1.Flags.string({
             description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
-            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            deprecated: {
+                message: (0, agent_config_1.retiredCommitmentPermissionFlagMessage)('commitment-responsibility-ceiling'),
+            },
             hidden: true,
         }),
         'max-turns': core_1.Flags.integer({ description: 'Maximum turns in one agent run (1-500)' }),
@@ -393,7 +397,12 @@ class AgentsCreate extends base_command_1.BaseCommand {
         // relationshipLoops is an input-only provisioning control. The server
         // applies it by deciding which system commitments to seed, so it is not an
         // Agent document field and is intentionally absent from the response.
-        const unapplied = unappliedPayloadKeys(payload, created, ['relationshipLoops']);
+        const unapplied = unappliedPayloadKeys(payload, created, [
+            'relationshipLoops',
+            ...(0, agent_config_1.deprecatedFieldNames)(created),
+        ]);
+        for (const warning of (0, agent_config_1.deprecatedFieldsWarnings)(created))
+            this.warn(warning);
         if (unapplied.length > 0) {
             this.warn(unappliedPayloadKeysWarning(unapplied));
         }

package/dist/commands/agents/update.d.ts

@@ -18,6 +18,7 @@ export default class AgentsUpdate extends BaseCommand {
         'next-target': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'working-directory': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'default-permission-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'clear-default-permission-mode': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         tools: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'model-parameters': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'agent-ids': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
@@ -55,6 +56,27 @@ export default class AgentsUpdate extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * The warnings an `agents update` prints for what the server did with the
+ * PATCH, in order: one line per field the server reported as ignored, with the
+ * SERVER's reason (`deprecatedFields`, OSK-12068), then one line for keys that
+ * came back missing for no stated reason.
+ *
+ * That last check is the one `agents create` makes. Without it, a key the
+ * server does not model, a typo of one that it does (`max_turns` for
+ * `maxTurns`), or a field only the server sets was discarded with the same
+ * "Updated agent" line as a real change. It skips:
+ * - `removeProjectIds`, an instruction rather than a stored field;
+ * - every field the server already explained in `deprecatedFields`, so it is
+ *   not ALSO called "not an agent field" with the generic guess;
+ * - every key sent as `null`. `null` is a clear, and a cleared field coming
+ *   back absent (or `null`) is the clear working. `defaultPermissionMode: null`
+ *   through `--from-json` was reported as "not an agent field" after the server
+ *   had cleared it on purpose (OSK-12167).
+ *
+ * Exported for tests.
+ */
+export declare function agentUpdateWarnings(payload: Record<string, unknown>, updated: unknown): string[];
 /**
  * The per-Agent mutation fence's "another request holds this right now"
  * refusals. `updateAgent` takes a short lease on the Agent before it writes, so
@@ -78,6 +100,16 @@ export declare const AGENT_FENCE_RETRY_CODES: ReadonlySet<string>;
 export declare function retryOnceOnAgentFence<T>(operation: () => Promise<T>, { delayMs }?: {
     delayMs?: number;
 }): Promise<T>;
+/**
+ * The `defaultPermissionMode` a PATCH carries for these flags. `null` is the
+ * server's clear, the same spelling `harnesses update --clear-default-permission-mode`
+ * sends; before it, a mode once set could not be removed from the CLI at all —
+ * `""` fails the flag's options and `null` failed the server (OSK-12070).
+ */
+export declare function defaultPermissionModePatch(flags: {
+    'default-permission-mode'?: string;
+    'clear-default-permission-mode'?: boolean;
+}): string | null | undefined;
 /**
  * What changing the agent's default permission mode actually changed
  * (OSK-12124). It is the AGENT's default, so it governs every conversation,

package/dist/commands/agents/update.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AGENT_FENCE_RETRY_CODES = void 0;
+exports.agentUpdateWarnings = agentUpdateWarnings;
 exports.retryOnceOnAgentFence = retryOnceOnAgentFence;
+exports.defaultPermissionModePatch = defaultPermissionModePatch;
 exports.defaultPermissionModeNote = defaultPermissionModeNote;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -58,6 +60,12 @@ class AgentsUpdate extends base_command_1.BaseCommand {
                 'One-shot harnesses (gemini, opencode, cursor, copilot, goose, pi, openclaw) can only run as ' +
                 'bypassPermissions; any other mode is refused for them.',
             options: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
+            exclusive: ['clear-default-permission-mode'],
+        }),
+        'clear-default-permission-mode': core_1.Flags.boolean({
+            description: "Remove this agent's permission-mode override, so its harness's default (then the daemon's) " +
+                'applies. Allowed on every harness, including one-shot ones.',
+            exclusive: ['default-permission-mode'],
         }),
         tools: core_1.Flags.string({
             description: 'Tools JSON array of plugin keys, e.g. \'["calculator"]\'. `skrr agents tools` lists the keys, ' +
@@ -107,19 +115,23 @@ class AgentsUpdate extends base_command_1.BaseCommand {
             description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.REASONING_TOOL_ESCAPES],
             multiple: true,
-            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            deprecated: { message: (0, agent_config_1.retiredCommitmentPermissionFlagMessage)('reasoning-tool-escape') },
             hidden: true,
         }),
         'commitment-responsibility': core_1.Flags.string({
             description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
-            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            deprecated: {
+                message: (0, agent_config_1.retiredCommitmentPermissionFlagMessage)('commitment-responsibility'),
+            },
             hidden: true,
         }),
         'commitment-responsibility-ceiling': core_1.Flags.string({
             description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
             options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
-            deprecated: { message: agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED },
+            deprecated: {
+                message: (0, agent_config_1.retiredCommitmentPermissionFlagMessage)('commitment-responsibility-ceiling'),
+            },
             hidden: true,
         }),
         'max-turns': core_1.Flags.integer({ description: 'Maximum turns in one agent run (1-500)' }),
@@ -177,7 +189,7 @@ class AgentsUpdate extends base_command_1.BaseCommand {
             category: flags.category,
             executionPolicy,
             workingDirectory: flags['working-directory'],
-            defaultPermissionMode: flags['default-permission-mode'],
+            defaultPermissionMode: defaultPermissionModePatch(flags),
         });
         // `mergeAgentConfigFlags` parses the typed flags (avatar, scene background,
         // working hours, every JSON flag). A parse failure is the caller's input, so
@@ -206,16 +218,8 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         catch (err) {
             this.handleApiError(err);
         }
-        // The same check `agents create` makes. Without it, a key the server does
-        // not model, a typo of one that it does (`max_turns` for `maxTurns`), or a
-        // field only the server sets was discarded with the same "Updated agent"
-        // line as a real change.
-        // `removeProjectIds` is an instruction, not a stored field, so it never
-        // comes back and is not reported.
-        const unapplied = (0, create_1.unappliedPayloadKeys)(payload, updated, ['removeProjectIds']);
-        if (unapplied.length > 0) {
-            this.warn((0, create_1.unappliedPayloadKeysWarning)(unapplied));
-        }
+        for (const warning of agentUpdateWarnings(payload, updated))
+            this.warn(warning);
         await (0, runtime_tool_support_1.warnPluginsNotLoaded)(payload.tools, (message) => this.warn(message));
         if (flags.json) {
             this.log(JSON.stringify((0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, updated), null, 2));
@@ -227,9 +231,45 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         const modeNote = defaultPermissionModeNote(flags['default-permission-mode'], a);
         if (modeNote)
             this.log(modeNote);
+        if (flags['clear-default-permission-mode']) {
+            this.log("Permission: cleared — this agent now follows its harness's default permission mode " +
+                "(then the daemon's), starting with each conversation's next turn.");
+        }
     }
 }
 exports.default = AgentsUpdate;
+/**
+ * The warnings an `agents update` prints for what the server did with the
+ * PATCH, in order: one line per field the server reported as ignored, with the
+ * SERVER's reason (`deprecatedFields`, OSK-12068), then one line for keys that
+ * came back missing for no stated reason.
+ *
+ * That last check is the one `agents create` makes. Without it, a key the
+ * server does not model, a typo of one that it does (`max_turns` for
+ * `maxTurns`), or a field only the server sets was discarded with the same
+ * "Updated agent" line as a real change. It skips:
+ * - `removeProjectIds`, an instruction rather than a stored field;
+ * - every field the server already explained in `deprecatedFields`, so it is
+ *   not ALSO called "not an agent field" with the generic guess;
+ * - every key sent as `null`. `null` is a clear, and a cleared field coming
+ *   back absent (or `null`) is the clear working. `defaultPermissionMode: null`
+ *   through `--from-json` was reported as "not an agent field" after the server
+ *   had cleared it on purpose (OSK-12167).
+ *
+ * Exported for tests.
+ */
+function agentUpdateWarnings(payload, updated) {
+    const cleared = Object.keys(payload).filter((key) => payload[key] === null);
+    const unapplied = (0, create_1.unappliedPayloadKeys)(payload, updated, [
+        'removeProjectIds',
+        ...cleared,
+        ...(0, agent_config_1.deprecatedFieldNames)(updated),
+    ]);
+    return [
+        ...(0, agent_config_1.deprecatedFieldsWarnings)(updated),
+        ...(unapplied.length > 0 ? [(0, create_1.unappliedPayloadKeysWarning)(unapplied)] : []),
+    ];
+}
 /**
  * The per-Agent mutation fence's "another request holds this right now"
  * refusals. `updateAgent` takes a short lease on the Agent before it writes, so
@@ -267,6 +307,17 @@ async function retryOnceOnAgentFence(operation, { delayMs = 750 } = {}) {
         return operation();
     }
 }
+/**
+ * The `defaultPermissionMode` a PATCH carries for these flags. `null` is the
+ * server's clear, the same spelling `harnesses update --clear-default-permission-mode`
+ * sends; before it, a mode once set could not be removed from the CLI at all —
+ * `""` fails the flag's options and `null` failed the server (OSK-12070).
+ */
+function defaultPermissionModePatch(flags) {
+    if (flags['clear-default-permission-mode'])
+        return null;
+    return flags['default-permission-mode'];
+}
 /**
  * What changing the agent's default permission mode actually changed
  * (OSK-12124). It is the AGENT's default, so it governs every conversation,

package/dist/commands/tasks/approvals/list.d.ts

@@ -14,6 +14,28 @@ export declare function approvalRow(a: Record<string, unknown>): {
     approver: string;
     created: string;
 };
+/**
+ * OSK-12165 — the task's latest run, when it ended blocked on a permission
+ * nobody could grant.
+ *
+ * An unattended run (`tasks start`) cannot ask anyone: the permission bridge
+ * declines every ask at once, so no approval row is ever created, and this
+ * command used to answer "No approvals." in exactly the case `tasks start`
+ * sends people here for. The evidence lives on the run, not in the approvals
+ * collection: the leaf finalizer settles it with `error.code`
+ * `permission_blocked`, which `GET /tasks/:id/runs` projects as `failureCode`
+ * alongside the sentence (what was refused, and the fix) as `failureReason`.
+ *
+ * Only the LATEST run counts (the route sorts newest first): a permission block
+ * on an older run that a later run got past is history, not the current state.
+ */
+export declare function permissionBlockedRun(runs: Array<Record<string, unknown>>): Record<string, unknown> | null;
+/**
+ * What to print for such a run: why it is blocked, what needed approval (the
+ * run's own recorded sentence, which names the refused tool), that an
+ * unattended run cannot prompt, and the two ways forward with exact commands.
+ */
+export declare function permissionBlockLines(run: Record<string, unknown>, bin?: string, taskRef?: string): string[];
 export default class TasksApprovalsList extends BaseCommand {
     static description: string;
     static examples: string[];

package/dist/commands/tasks/approvals/list.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.approvalRow = approvalRow;
+exports.permissionBlockedRun = permissionBlockedRun;
+exports.permissionBlockLines = permissionBlockLines;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
@@ -22,6 +24,52 @@ function approvalRow(a) {
         created: a.createdAt ? (0, format_1.localTime)(a.createdAt) : '-',
     };
 }
+/**
+ * OSK-12165 — the task's latest run, when it ended blocked on a permission
+ * nobody could grant.
+ *
+ * An unattended run (`tasks start`) cannot ask anyone: the permission bridge
+ * declines every ask at once, so no approval row is ever created, and this
+ * command used to answer "No approvals." in exactly the case `tasks start`
+ * sends people here for. The evidence lives on the run, not in the approvals
+ * collection: the leaf finalizer settles it with `error.code`
+ * `permission_blocked`, which `GET /tasks/:id/runs` projects as `failureCode`
+ * alongside the sentence (what was refused, and the fix) as `failureReason`.
+ *
+ * Only the LATEST run counts (the route sorts newest first): a permission block
+ * on an older run that a later run got past is history, not the current state.
+ */
+function permissionBlockedRun(runs) {
+    const latest = runs[0];
+    if (!latest)
+        return null;
+    const code = latest.failureCode ?? latest.failureClass;
+    return code === data_provider_1.PERMISSION_BLOCKED_FAILURE_CODE ? latest : null;
+}
+/**
+ * What to print for such a run: why it is blocked, what needed approval (the
+ * run's own recorded sentence, which names the refused tool), that an
+ * unattended run cannot prompt, and the two ways forward with exact commands.
+ */
+function permissionBlockLines(run, bin = 'skrr', taskRef = '<task-id>') {
+    const runId = String(run.runId ?? run.id ?? '-');
+    const reason = typeof run.failureReason === 'string' ? run.failureReason.trim() : '';
+    const executor = run.executor;
+    const agent = executor && typeof executor.agentId === 'string' && executor.agentId
+        ? executor.agentId
+        : '<agent>';
+    return [
+        `The latest run (${runId}) is blocked on a permission, not on an approval request.`,
+        ...(reason ? [`  ${reason}`] : []),
+        'It ran unattended (`tasks start`), and an unattended run cannot prompt anyone to approve a',
+        'tool call, so the ask was refused on the spot and no approval request was recorded here.',
+        '',
+        'To continue, either:',
+        `  ${bin} agents chat ${agent} --approve-tools --prompt "..."   do the work interactively, approving each call`,
+        `  ${bin} agents update ${agent} --default-permission-mode bypassPermissions   let unattended runs use the tool`,
+        `  then: ${bin} tasks start ${taskRef}   (or pick an agent/harness whose mode allows it)`,
+    ];
+}
 class TasksApprovalsList extends base_command_1.BaseCommand {
     static description = 'List approvals for a task';
     static examples = [
@@ -44,14 +92,38 @@ class TasksApprovalsList extends base_command_1.BaseCommand {
         catch (err) {
             this.handleApiError(err);
         }
+        const r = response;
+        const items = r?.data ?? [];
+        // OSK-12165 — an unattended run blocked on a permission leaves no approval
+        // row, so the empty list alone would say "nothing to act on" about a task
+        // that is waiting on exactly that. Read the latest run, best-effort: the
+        // approvals list is still the answer if the runs read fails.
+        let blockedRun = null;
+        try {
+            const runs = (await data_provider_1.dataService.getTaskRuns(args.id));
+            blockedRun = permissionBlockedRun(runs?.data ?? []);
+        }
+        catch {
+            blockedRun = null;
+        }
+        const blockLines = blockedRun ? permissionBlockLines(blockedRun, this.config.bin, args.id) : [];
         if (flags.json) {
+            // The server payload stays byte-identical; the pointer goes to stderr so
+            // `--json` remains parseable and a script still learns the task is stuck.
+            if (blockedRun) {
+                this.warn(`The latest run is blocked on a permission an unattended run could not ask for; ` +
+                    `\`${this.config.bin} tasks approvals list ${args.id}\` (without --json) says what to do.`);
+            }
             this.log(JSON.stringify(response, null, 2));
             return;
         }
-        const r = response;
-        const items = r?.data ?? [];
         if (items.length === 0) {
-            this.log('No approvals.');
+            this.log('No approval requests.');
+            if (blockLines.length > 0) {
+                this.log('');
+                for (const line of blockLines)
+                    this.log(line);
+            }
             return;
         }
         const rows = items.map(approvalRow);
@@ -62,6 +134,11 @@ class TasksApprovalsList extends base_command_1.BaseCommand {
             { key: 'approver', header: 'APPROVER', maxWidth: 30 },
             { key: 'created', header: 'CREATED' },
         ], (line) => this.log(line));
+        if (blockLines.length > 0) {
+            this.log('');
+            for (const line of blockLines)
+                this.log(line);
+        }
     }
 }
 exports.default = TasksApprovalsList;

package/dist/commands/tasks/create.js

@@ -238,7 +238,8 @@ class TasksCreate extends base_command_1.BaseCommand {
         'label-id': core_1.Flags.string({
             aliases: ['label'],
             description: 'Attach a task label (repeatable) — id, or a name from `skrr labels list --applicable-to task`. ' +
-                'An unknown name is refused, never created. Manage labels with `skrr labels`.',
+                'An unknown name is refused, never created. Also accepted as --label. ' +
+                'Manage labels with `skrr labels`.',
             multiple: true,
         }),
         'working-directory': core_1.Flags.string({

package/dist/commands/tasks/start.js

@@ -137,7 +137,7 @@ function startFollowUpLines(bin, taskRef) {
         'Follow it:',
         `  ${bin} tasks watch ${taskRef}            status until it finishes or fails`,
         `  ${bin} tasks transcript ${taskRef}       what the agent has said so far`,
-        `  ${bin} tasks approvals list ${taskRef}   approval requests waiting on you`,
+        `  ${bin} tasks approvals list ${taskRef}   approvals waiting on you, or why a run is blocked on one`,
         'On a local machine, the run may add its instruction file (AGENTS.md / CLAUDE.md) to the',
         'working directory while it runs; files the run wrote are removed afterwards unless changed.',
     ];

package/dist/commands/tasks/update.js

@@ -163,7 +163,8 @@ class TasksUpdate extends base_command_1.BaseCommand {
         }),
         'label-id': core_1.Flags.string({
             aliases: ['label'],
-            description: 'Replace the task labels with these ids (repeatable, whole-list). ' +
+            description: 'Replace the task labels (repeatable, whole-list) — id, or a name from ' +
+                '`skrr labels list --applicable-to task`. Also accepted as --label. ' +
                 'Use `skrr tasks labels attach/detach` for incremental changes.',
             multiple: true,
         }),
@@ -322,6 +323,25 @@ class TasksUpdate extends base_command_1.BaseCommand {
                 }
             }
         }
+        // Same resolution as `tasks create`: the `--tag` warning below suggests
+        // `--label-id <name>`, so this flag has to accept the name it suggests
+        // (OSK-12166). Ids pass through untouched.
+        let resolvedLabelIds;
+        if (flags['label-id'] !== undefined) {
+            try {
+                resolvedLabelIds = await (0, label_ref_1.resolveLabelRefs)(flags['label-id'], {
+                    applicableTo: 'task',
+                    ...(process.env.OVERSKY_WORKSPACE_ID
+                        ? { workspaceId: process.env.OVERSKY_WORKSPACE_ID }
+                        : {}),
+                });
+            }
+            catch (err) {
+                if (err instanceof label_ref_1.LabelRefError)
+                    this.error(err.message, { exit: 1 });
+                this.handleApiError(err);
+            }
+        }
         const payload = (0, prompt_1.mergeDefined)((0, task_resolver_1.stripTaskIdentityFields)(body), {
             title: flags.title,
             expectations: expectationsPatch === null ? [] : (expectationsPatch ?? undefined),
@@ -353,7 +373,7 @@ class TasksUpdate extends base_command_1.BaseCommand {
             addBlocksIds: flags['add-blocks'],
             removeBlocksIds: flags['remove-blocks'],
             tags: flags.tag,
-            labelIds: flags['label-id'],
+            labelIds: resolvedLabelIds,
             // Worktree isolation override. --worktree ⇒ 'ephemeral', --no-worktree ⇒
             // 'shared', omitted ⇒ unchanged. (Clear-to-inherit via --from-json.)
             executionIsolation: (0, tasks_2.executionIsolationFromWorktreeFlag)(flags.worktree),
@@ -448,7 +468,7 @@ class TasksUpdate extends base_command_1.BaseCommand {
         const estimateWarning = (0, create_1.droppedEstimateWarning)(flags.estimate, updated, updated?.spaceId);
         if (estimateWarning)
             this.warn(estimateWarning);
-        const tagWarning = await (0, create_1.taskTagLabelWarning)(flags.tag, flags['label-id']);
+        const tagWarning = await (0, create_1.taskTagLabelWarning)(flags.tag, resolvedLabelIds);
         if (tagWarning)
             this.warn(tagWarning);
         if (flags.json) {

package/dist/lib/agent-config.d.ts

@@ -4,6 +4,19 @@ export declare const REASONING_TOOL_ESCAPES: readonly ["bash", "browser"];
 export declare const COMMITMENT_PERMISSION_FLAG_RETIRED = "This setting no longer has any effect: Commitment runs use the agent's own permissions.";
 /** The three retired flags themselves: accepted at parse, warned on, never sent. */
 export declare const RETIRED_COMMITMENT_PERMISSION_FLAGS: readonly ["reasoning-tool-escape", "commitment-responsibility", "commitment-responsibility-ceiling"];
+/**
+ * The deprecation warning ONE retired flag prints. oclif prints a
+ * `deprecated.message` verbatim, so a shared message printed the same line
+ * once per flag with nothing saying which flag each one was about (OSK-12068).
+ */
+export declare function retiredCommitmentPermissionFlagMessage(flag: (typeof RETIRED_COMMITMENT_PERMISSION_FLAGS)[number]): string;
+/**
+ * The fields the server ignored and why, from a write's `deprecatedFields`
+ * notice, one line each. Empty when the response carries none.
+ */
+export declare function deprecatedFieldsWarnings(response: unknown): string[];
+/** The payload keys the server reported as ignored, so they are not also called "not kept". */
+export declare function deprecatedFieldNames(response: unknown): string[];
 export declare const RELEASE_INSTALL_CHANNELS: readonly ["latest", "manual"];
 /**
  * `09:00-18:00` or `09:00-18:00@America/Los_Angeles`, or a JSON object.

package/dist/lib/agent-config.js

@@ -1,6 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RELEASE_INSTALL_CHANNELS = exports.RETIRED_COMMITMENT_PERMISSION_FLAGS = exports.COMMITMENT_PERMISSION_FLAG_RETIRED = exports.REASONING_TOOL_ESCAPES = exports.COMMITMENT_RESPONSIBILITY_LEVELS = void 0;
+exports.retiredCommitmentPermissionFlagMessage = retiredCommitmentPermissionFlagMessage;
+exports.deprecatedFieldsWarnings = deprecatedFieldsWarnings;
+exports.deprecatedFieldNames = deprecatedFieldNames;
 exports.parseWorkingHoursFlag = parseWorkingHoursFlag;
 exports.mergeAgentConfigFlags = mergeAgentConfigFlags;
 const prompt_1 = require("./prompt");
@@ -15,6 +18,35 @@ exports.RETIRED_COMMITMENT_PERMISSION_FLAGS = [
     'commitment-responsibility',
     'commitment-responsibility-ceiling',
 ];
+/**
+ * The deprecation warning ONE retired flag prints. oclif prints a
+ * `deprecated.message` verbatim, so a shared message printed the same line
+ * once per flag with nothing saying which flag each one was about (OSK-12068).
+ */
+function retiredCommitmentPermissionFlagMessage(flag) {
+    return `--${flag} is retired and was not sent. ${exports.COMMITMENT_PERMISSION_FLAG_RETIRED}`;
+}
+/**
+ * The fields the server ignored and why, from a write's `deprecatedFields`
+ * notice, one line each. Empty when the response carries none.
+ */
+function deprecatedFieldsWarnings(response) {
+    const entries = response?.deprecatedFields;
+    if (!Array.isArray(entries))
+        return [];
+    return entries
+        .filter((entry) => Boolean(entry) && typeof entry.field === 'string')
+        .map((entry) => `${entry.field}: ${entry.reason || 'ignored by the server'}`);
+}
+/** The payload keys the server reported as ignored, so they are not also called "not kept". */
+function deprecatedFieldNames(response) {
+    const entries = response?.deprecatedFields;
+    return Array.isArray(entries)
+        ? entries
+            .map((entry) => entry?.field)
+            .filter((field) => typeof field === 'string')
+        : [];
+}
 exports.RELEASE_INSTALL_CHANNELS = ['latest', 'manual'];
 /**
  * `09:00-18:00` or `09:00-18:00@America/Los_Angeles`, or a JSON object.

package/dist/lib/agentic-stream.d.ts

@@ -299,7 +299,7 @@ export type SeqGap = {
  * `service` envelopes that carry a `notice` — words for the person, not
  * diagnostics — projected as `session.notice` events. Today the only notice is
  * `harness-session-reset`: the local harness could not resume its previous
- * session and began a new one, so its local working context is gone.
+ * session and began a new one, which does not see earlier turns (OSK-12155).
  */
 export declare function projectSessionNotices(envelopes: unknown[]): AgenticStreamEvent[];
 export declare function detectSeqGap(highestApplied: number, incoming: number): SeqGap | null;

package/dist/lib/agentic-stream.js

@@ -426,7 +426,7 @@ function jitteredRetryDelay(retryAfterMs, random = Math.random) {
  * `service` envelopes that carry a `notice` — words for the person, not
  * diagnostics — projected as `session.notice` events. Today the only notice is
  * `harness-session-reset`: the local harness could not resume its previous
- * session and began a new one, so its local working context is gone.
+ * session and began a new one, which does not see earlier turns (OSK-12155).
  */
 function projectSessionNotices(envelopes) {
     const out = [];

package/dist/lib/auth-storage.js

@@ -288,7 +288,12 @@ function readFileAt(p, upgradeInPlace) {
     // L12 — route the secret string fields through the envelope. Mixed
     // bundles (e.g., legacy plaintext token + freshly-rotated wrapped
     // refresh) decrypt independently so partial migrations stay safe.
-    const tokenResult = (0, cred_envelope_1.maybeDecryptOnRead)(parsed.token);
+    // Read the (plaintext) owner first, so a value another config root sealed
+    // under its own key fails with a sentence that says so (OSK-12135).
+    const owner = parseOwner(parsed.owner);
+    const ownerRoot = owner?.configRoot ? path.resolve(owner.configRoot) : undefined;
+    const decryptOptions = ownerRoot && ownerRoot !== path.resolve((0, config_1.configRoot)()) ? { foreignOwnerRoot: ownerRoot } : {};
+    const tokenResult = (0, cred_envelope_1.maybeDecryptOnRead)(parsed.token, decryptOptions);
     if (tokenResult.plaintext === null) {
         // Envelope on disk but no DEK to unwrap → treat as missing so the
         // caller falls through to a clean `skrr login`.
@@ -300,7 +305,7 @@ function readFileAt(p, upgradeInPlace) {
         bundle.expiresAt = parsed.expiresAt;
     }
     if (typeof parsed.refreshToken === 'string' && parsed.refreshToken.length > 0) {
-        const refreshResult = (0, cred_envelope_1.maybeDecryptOnRead)(parsed.refreshToken);
+        const refreshResult = (0, cred_envelope_1.maybeDecryptOnRead)(parsed.refreshToken, decryptOptions);
         if (refreshResult.plaintext !== null) {
             bundle.refreshToken = refreshResult.plaintext;
             if (refreshResult.needsMigration)
@@ -316,7 +321,6 @@ function readFileAt(p, upgradeInPlace) {
     if (typeof parsed.serverOrigin === 'string' && parsed.serverOrigin.length > 0) {
         bundle.serverOrigin = parsed.serverOrigin;
     }
-    const owner = parseOwner(parsed.owner);
     if (owner)
         bundle.owner = owner;
     // Best-effort upgrade: re-write the bundle so legacy plaintext fields

package/dist/lib/cred-envelope.d.ts

@@ -8,7 +8,18 @@
  * and file backends and avoids a detect-then-read TOCTOU race.
  */
 import { type ReadTransformResult } from '@skrr-ai/auth-core';
-export declare function maybeDecryptOnRead(stored: string): ReadTransformResult;
+/**
+ * The `decrypt_failed` hint for a value whose owner record names ANOTHER
+ * config root. Each root seals under its own key, so that value is unreadable
+ * here by construction: "signing in again rebuilds it" would send someone to
+ * re-login over a credential that is not broken and not theirs (OSK-12135).
+ */
+export declare function foreignCredentialHint(ownerConfigRoot: string): string;
+export interface CliDecryptOnReadOptions {
+    /** The config root the stored value's owner record names, when not ours. */
+    foreignOwnerRoot?: string;
+}
+export declare function maybeDecryptOnRead(stored: string, options?: CliDecryptOnReadOptions): ReadTransformResult;
 /** Consume and clear the per-process blocked-read observation. */
 export declare function consumeEncryptedCredentialReadWhileInactive(): boolean;
 /** Consume any unreadable envelope observation, including tamper/decrypt failure. */

package/dist/lib/cred-envelope.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.__wrappedDekFilePathForTest = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = void 0;
+exports.foreignCredentialHint = foreignCredentialHint;
 exports.maybeDecryptOnRead = maybeDecryptOnRead;
 exports.consumeEncryptedCredentialReadWhileInactive = consumeEncryptedCredentialReadWhileInactive;
 exports.consumeUnreadableEncryptedCredentialRead = consumeUnreadableEncryptedCredentialRead;
@@ -16,10 +17,26 @@ exports.consumeUnreadableEncryptedCredentialRead = consumeUnreadableEncryptedCre
 const auth_core_1 = require("@skrr-ai/auth-core");
 let encryptedReadWhileInactive = false;
 let unreadableEncryptedRead = false;
-function maybeDecryptOnRead(stored) {
-    const result = (0, auth_core_1.maybeDecryptOnRead)(stored);
+/**
+ * The `decrypt_failed` hint for a value whose owner record names ANOTHER
+ * config root. Each root seals under its own key, so that value is unreadable
+ * here by construction: "signing in again rebuilds it" would send someone to
+ * re-login over a credential that is not broken and not theirs (OSK-12135).
+ */
+function foreignCredentialHint(ownerConfigRoot) {
+    return (`stored credential belongs to another skrr config (config root ${ownerConfigRoot}) and is ` +
+        "sealed under that config's key, so this config cannot read it. Nothing is wrong with " +
+        'either credential and it was left untouched; signing in here does not change it');
+}
+function maybeDecryptOnRead(stored, options = {}) {
+    const result = (0, auth_core_1.maybeDecryptOnRead)(stored, options.foreignOwnerRoot
+        ? { unreadableHint: foreignCredentialHint(options.foreignOwnerRoot) }
+        : {});
     if (result.plaintext === null && (0, auth_core_1.isCredEnvelopeString)(stored)) {
-        unreadableEncryptedRead = true;
+        // Another config's value is not an unreadable credential of OURS, so it
+        // must not tell `logout` there is local encrypted state to erase.
+        if (!options.foreignOwnerRoot)
+            unreadableEncryptedRead = true;
         if ((0, auth_core_1.describeCredEnvelopeState)().kind !== 'active') {
             encryptedReadWhileInactive = true;
         }