@skrr-ai/cli 0.1.60 → 0.1.62

package/dist/commands/goals/key-results/create.js

@@ -39,8 +39,12 @@ class GoalsKeyResultsCreate extends base_command_1.BaseCommand {
             max: 100,
         }),
         'progress-mode': core_1.Flags.string({
-            description: 'How progress is tracked',
+            // Auto reads as "-" forever from the CLI — task↔key-result linking is a
+            // documented omission from this surface (see AUTO_MODE_NOTE below) — so
+            // the CLI default is the mode a CLI caller can actually move.
+            description: 'How progress is tracked (default: manual — see note below)',
             options: [...data_provider_1.KEY_RESULT_PROGRESS_MODES],
+            default: 'manual',
         }),
         status: core_1.Flags.string({
             description: 'Key result status',

package/dist/commands/harnesses/show.js

@@ -6,6 +6,7 @@ exports.resolveHarnessRef = resolveHarnessRef;
 exports.pickHarnessRef = pickHarnessRef;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
+const web_url_1 = require("../../lib/web-url");
 const harness_provider_input_1 = require("../../lib/harness-provider-input");
 const harnesses_1 = require("../../lib/harnesses");
 const harness_labels_1 = require("../../lib/harness-labels");
@@ -84,7 +85,13 @@ class HarnessesShow extends base_command_1.BaseCommand {
             // daemon, so a script read a signed-out Devin as "ok" (OSK-9263/OSK-9265
             // verifiers). `readiness` is the per-provider answer the text prints;
             // null when it was not asked (not a live local row) or not reported.
-            this.log(JSON.stringify({ ...harness, readiness: verdict ?? null }, null, 2));
+            this.log(JSON.stringify({
+                ...harness,
+                readiness: verdict ?? null,
+                url: this.cliConfig?.baseURL
+                    ? (0, web_url_1.webUrl)(this.cliConfig.baseURL, { kind: 'harness', harnessId: harness._id })
+                    : null,
+            }, null, 2));
             return;
         }
         // The same rule the list applies (OSK-9649): a no-engine placeholder's
@@ -92,6 +99,9 @@ class HarnessesShow extends base_command_1.BaseCommand {
         // provider name that is not one.
         this.log(`${harness.name ? (0, data_provider_1.canonicalizeHarnessLabel)(harness.name) : harness._id}`);
         this.log(`  id          ${harness._id}`);
+        this.log(`  url         ${this.cliConfig?.baseURL
+            ? ((0, web_url_1.webUrl)(this.cliConfig.baseURL, { kind: 'harness', harnessId: harness._id }) ?? '-')
+            : '-'}`);
         this.log(`  provider    ${(0, harness_labels_1.harnessProviderDescription)(harness.provider)}`);
         // `harnessLocation` is the difference between "your laptop" and "a cloud row",
         // and it decides which verbs apply: ping and claudeEngine are local-only.

package/dist/commands/logout.js

@@ -35,6 +35,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.shouldSkipLocalLogout = shouldSkipLocalLogout;
 const core_1 = require("@oclif/core");
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
 const base_command_1 = require("../base-command");
 const config_1 = require("../lib/config");
 const first_party_harness_managed_1 = require("../lib/first-party-harness-managed");
@@ -109,6 +112,21 @@ function shouldSkipLocalLogout(input) {
 function platformManagedHandoff() {
     return (0, dedicated_service_1.runningOnDedicatedRuntimeGuest)() && Boolean((0, daemonBroker_1.findBrokeredHandoffDescriptor)());
 }
+/**
+ * Whether this computer has a configured skrr background service — the file
+ * `skrr daemon install` writes, which a logout deliberately does not remove
+ * (the service's OWN credential is what becomes unreadable; OSK-12483).
+ * The daemon's profile dir is `~/.skrr/profiles/<name>` for every profile,
+ * including `default`.
+ */
+function daemonConfigPresent(profile) {
+    try {
+        return fs.existsSync(path.join(os.homedir(), '.skrr', 'profiles', profile, 'daemon.json'));
+    }
+    catch {
+        return false;
+    }
+}
 const SIGN_IN_AGAIN = 'To sign in again, run `skrr login`.';
 class Logout extends base_command_1.BaseCommand {
     static description = 'Sign out and clear locally-stored tokens. ' +
@@ -282,6 +300,19 @@ class Logout extends base_command_1.BaseCommand {
         }
         else {
             this.log(SIGN_IN_AGAIN);
+            // OSK-12483 — the shared envelope wipe above also orphans THIS machine's
+            // daemon credential (it is sealed under the DEK just deleted). The
+            // running daemon keeps working on its in-memory copy, but its next start
+            // cannot read the stored one and needs `skrr daemon login` — a plain
+            // `skrr login` mints a cli-scope credential and does not re-enroll it.
+            // Say that now, while the person is still looking at a screen; otherwise
+            // the daemon simply never comes back and nothing anywhere names why.
+            // `daemon.json` is written when the service is installed/configured and
+            // survives this logout.
+            if (daemonConfigPresent(keychain.getActiveProfile())) {
+                this.log("This also signs out this computer's skrr background service — it will need " +
+                    '`skrr daemon login` before it runs again.');
+            }
         }
         if (sweptLegacy.length > 0) {
             this.log(`Also removed ${sweptLegacy.length} credential${sweptLegacy.length === 1 ? '' : 's'} left by the previous product identity:`);

package/dist/commands/machines/show.js

@@ -6,6 +6,7 @@ const format_1 = require("../../lib/format");
 const machines_1 = require("../../lib/machines");
 const cli_installers_1 = require("../../lib/cli-installers");
 const harness_labels_1 = require("../../lib/harness-labels");
+const web_url_1 = require("../../lib/web-url");
 /** One machine: its identity, its harnesses, and what you may do to it. */
 class MachinesShow extends base_command_1.BaseCommand {
     static description = 'Show one machine — its identity, harnesses, and available actions';
@@ -45,11 +46,19 @@ class MachinesShow extends base_command_1.BaseCommand {
             this.error('Machine not found.', { exit: 1 });
         }
         if (flags.json) {
-            this.log(JSON.stringify(machine, null, 2));
+            this.log(JSON.stringify({
+                ...machine,
+                url: this.cliConfig?.baseURL
+                    ? (0, web_url_1.webUrl)(this.cliConfig.baseURL, { kind: 'machine', machineId: machine.id })
+                    : null,
+            }, null, 2));
             return;
         }
         this.log(`${machine.preferences?.name || machine.name}`);
         this.log(`  id           ${machine.id}`);
+        this.log(`  url          ${this.cliConfig?.baseURL
+            ? ((0, web_url_1.webUrl)(this.cliConfig.baseURL, { kind: 'machine', machineId: machine.id }) ?? '-')
+            : '-'}`);
         this.log(`  identity     ${machine.identityKind}`);
         // The label the lists print. A paused lease read `paused` in both tables and
         // `offline` here, with the reason one line below (OSK-9996). `--json` keeps

package/dist/commands/managed-execution/show.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base-command';
+/** Show the agents configured to use the shared Agent Worker target. */
+export default class ManagedExecutionShow extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/managed-execution/show.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const format_1 = require("../../lib/format");
+const managed_execution_1 = require("../../lib/managed-execution");
+const web_url_1 = require("../../lib/web-url");
+/** Show the agents configured to use the shared Agent Worker target. */
+class ManagedExecutionShow extends base_command_1.BaseCommand {
+    static description = 'Show the shared Agent Worker target and the agents configured to use it';
+    static examples = [
+        '<%= config.bin %> managed-execution show',
+        '<%= config.bin %> managed-execution show --json',
+    ];
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(ManagedExecutionShow);
+        let response;
+        try {
+            response = await data_provider_1.dataService.listAgents({ requiredPermission: data_provider_1.PermissionBits.VIEW });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        const agents = (0, managed_execution_1.managedExecutionAgents)(response);
+        const payload = {
+            kind: 'managed-execution',
+            target: 'agent-worker',
+            url: this.cliConfig?.baseURL
+                ? (0, web_url_1.webUrl)(this.cliConfig.baseURL, { kind: 'managedExecution' })
+                : null,
+            configuredAgents: agents,
+        };
+        if (flags.json) {
+            this.log(JSON.stringify(payload, null, 2));
+            return;
+        }
+        this.log('Managed execution');
+        this.log('  target      Agent Worker (shared managed execution; not a Machine or Harness)');
+        this.log(`  url         ${payload.url ?? '-'}`);
+        this.log(`  agents      ${agents.length} configured`);
+        if (agents.length === 0)
+            return;
+        this.log('');
+        (0, format_1.renderTable)(agents.map((agent) => ({
+            position: String(agent.position),
+            id: (0, format_1.formatCell)(agent.id),
+            name: (0, format_1.formatCell)(agent.name),
+        })), [
+            { key: 'position', header: 'ORDER' },
+            { key: 'id', header: 'AGENT ID', verbatim: true },
+            { key: 'name', header: 'NAME', maxWidth: 48 },
+        ], (line) => this.log(`  ${line}`));
+    }
+}
+exports.default = ManagedExecutionShow;

package/dist/commands/spaces/show.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
+const space_template_source_1 = require("../../lib/space-template-source");
 const web_url_1 = require("../../lib/web-url");
 class SpacesShow extends base_command_1.BaseCommand {
     static description = 'Show details for a single space';
@@ -37,8 +38,31 @@ class SpacesShow extends base_command_1.BaseCommand {
         }
         const s = space;
         const url = (0, web_url_1.spaceUrlFrom)(this.cliConfig.baseURL, s);
+        // Only a Space a template install created has a source to check. The
+        // check is a second request, so a failure reports itself instead of
+        // failing the whole command — or being mistaken for "no update".
+        const templateSource = s.templateSource;
+        let templateCheck = null;
+        let templateCheckError;
+        if (templateSource?.templateId) {
+            try {
+                templateCheck = await data_provider_1.dataService.getSpaceTemplateSource(spaceId);
+            }
+            catch (err) {
+                templateCheckError = err instanceof Error ? err.message : String(err);
+            }
+        }
         if (flags.json) {
-            this.log(JSON.stringify({ ...s, url }, null, 2));
+            this.log(JSON.stringify({
+                ...s,
+                url,
+                ...(templateSource?.templateId
+                    ? {
+                        templateUpdate: templateCheck,
+                        ...(templateCheckError ? { templateUpdateError: templateCheckError } : {}),
+                    }
+                    : {}),
+            }, null, 2));
             return;
         }
         const ancestors = Array.isArray(s.ancestorSpaceIds) ? s.ancestorSpaceIds : [];
@@ -67,6 +91,16 @@ class SpacesShow extends base_command_1.BaseCommand {
         this.log(`Depth:       ${s.depth ?? 0}`);
         this.log(`Ancestors:   ${ancestors.length > 0 ? ancestors.join(' › ') : '-'}`);
         this.log(`Inherits ACL: ${s.inheritAccess === false ? 'no (private subspace)' : 'yes'}`);
+        if (templateSource?.templateId) {
+            for (const line of (0, space_template_source_1.templateSourceLines)({
+                source: templateSource,
+                check: templateCheck,
+                checkError: templateCheckError,
+                baseURL: this.cliConfig.baseURL,
+            })) {
+                this.log(line);
+            }
+        }
         if (s.description) {
             this.log('');
             this.log('Description:');

package/dist/commands/step-up.d.ts

@@ -0,0 +1,23 @@
+import { BaseCommand } from '../base-command';
+/**
+ * `skrr step-up` — confirm it is you before publishing to the Store
+ * (OSK-12275).
+ *
+ * Making a release public, rolling the public listing back, or publishing a
+ * governed release all reach buyers, so the server refuses them from a login
+ * that has not recently proved a second factor. This command proves one — the
+ * code from the account's authenticator app, or an unused backup code — and
+ * the verification is bound to THIS login only, for a few minutes. A token
+ * stolen from another device, or a browser session, is not covered by it.
+ */
+export default class StepUp extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        otp: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'backup-code': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        status: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/step-up.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../base-command");
+const prompt_1 = require("../lib/prompt");
+const step_up_1 = require("../lib/step-up");
+/**
+ * `skrr step-up` — confirm it is you before publishing to the Store
+ * (OSK-12275).
+ *
+ * Making a release public, rolling the public listing back, or publishing a
+ * governed release all reach buyers, so the server refuses them from a login
+ * that has not recently proved a second factor. This command proves one — the
+ * code from the account's authenticator app, or an unused backup code — and
+ * the verification is bound to THIS login only, for a few minutes. A token
+ * stolen from another device, or a browser session, is not covered by it.
+ */
+class StepUp extends base_command_1.BaseCommand {
+    static description = 'Confirm it is you with an authenticator code before publishing to the Store';
+    static examples = [
+        '<%= config.bin %> step-up',
+        '<%= config.bin %> step-up --otp 123456',
+        '<%= config.bin %> step-up --backup-code 1a2b3c4d',
+        '<%= config.bin %> step-up --status --json',
+    ];
+    static flags = {
+        otp: core_1.Flags.string({
+            description: 'The current 6-digit code from your authenticator app',
+            exclusive: ['backup-code', 'status'],
+        }),
+        'backup-code': core_1.Flags.string({
+            description: 'One of your unused backup codes (it is spent)',
+            exclusive: ['otp', 'status'],
+        }),
+        status: core_1.Flags.boolean({
+            description: 'Show whether this login is verified for publishing, without verifying',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StepUp);
+        const bin = this.config.bin;
+        let status;
+        try {
+            status = await data_provider_1.dataService.getStepUpStatus(data_provider_1.STORE_PUBLISH_STEP_UP_PURPOSE);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        const hasCode = Boolean(flags.otp || flags['backup-code']);
+        if (flags.status || (status.active && !hasCode)) {
+            if (flags.json) {
+                this.log(JSON.stringify(status, null, 2));
+                return;
+            }
+            this.log(status.active
+                ? `Verified for publishing from this login until ${(0, step_up_1.formatStepUpExpiry)(status.expiresAt)}.`
+                : `Not verified for publishing from this login. Run \`${bin} step-up\` to verify.`);
+            return;
+        }
+        if (!status.sessionBound) {
+            this.error(`This credential is not tied to a sign-in session, so it cannot be verified for publishing. Run \`${bin} login\`, then \`${bin} step-up\`.`, { code: 'STEP_UP_SESSION_UNBOUND', exit: 2 });
+        }
+        if (status.methods.length === 0) {
+            this.error('Publishing to the Store needs two-factor authentication, and this account has none. ' +
+                `Turn it on in the web app (Settings → Account → Two-factor authentication), then run \`${bin} step-up\`.`, { code: 'STEP_UP_TWO_FACTOR_REQUIRED', exit: 2 });
+        }
+        let token = flags.otp?.trim();
+        const backupCode = flags['backup-code']?.trim();
+        if (!token && !backupCode) {
+            if (!process.stdin.isTTY) {
+                this.error('Refusing to prompt for a code — stdin is not a terminal. Pass --otp <code> or --backup-code <code>.', { code: 'STEP_UP_PROOF_REQUIRED', exit: 2 });
+            }
+            token = await (0, prompt_1.prompt)('Code from your authenticator app: ');
+        }
+        let result;
+        try {
+            result = await data_provider_1.dataService.verifyStepUp({
+                purpose: data_provider_1.STORE_PUBLISH_STEP_UP_PURPOSE,
+                ...(token ? { token } : { backupCode }),
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const via = result.method === 'backup_code' ? 'a backup code' : 'your authenticator app';
+        this.log(`Verified with ${via}. Store publishing from this login is allowed until ${(0, step_up_1.formatStepUpExpiry)(result.expiresAt)}.`);
+    }
+}
+exports.default = StepUp;

package/dist/commands/store/acquisitions/approve.d.ts

@@ -0,0 +1,30 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Approve a purchase an agent asked to make (OSK-12240).
+ *
+ * The terminal counterpart of the web approval card, for a request the card
+ * cannot reach: a Slack or scheduled run, or a Task run nobody has opened. It
+ * prints the server's stored request (never anything the agent wrote), asks
+ * for an explicit yes, and sends only the decision and the terms acceptance —
+ * the price and offer are whatever the stored request says.
+ *
+ * Approving does not buy anything. It lets the agent complete THIS purchase at
+ * THIS price; a listing whose offer moves in the meantime supersedes it.
+ *
+ * Like `skrr store install`, this acts with your full authority: an agent that
+ * holds your CLI login can run it too. That is the product statement in
+ * docs/architecture/agent-initiated-paid-acquisition-2026-09-27.md, not a
+ * boundary this command could enforce.
+ */
+export default class StoreAcquisitionsApprove extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        requestId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/acquisitions/approve.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const prompt_1 = require("../../../lib/prompt");
+const store_acquisition_1 = require("../../../lib/store-acquisition");
+/**
+ * Approve a purchase an agent asked to make (OSK-12240).
+ *
+ * The terminal counterpart of the web approval card, for a request the card
+ * cannot reach: a Slack or scheduled run, or a Task run nobody has opened. It
+ * prints the server's stored request (never anything the agent wrote), asks
+ * for an explicit yes, and sends only the decision and the terms acceptance —
+ * the price and offer are whatever the stored request says.
+ *
+ * Approving does not buy anything. It lets the agent complete THIS purchase at
+ * THIS price; a listing whose offer moves in the meantime supersedes it.
+ *
+ * Like `skrr store install`, this acts with your full authority: an agent that
+ * holds your CLI login can run it too. That is the product statement in
+ * docs/architecture/agent-initiated-paid-acquisition-2026-09-27.md, not a
+ * boundary this command could enforce.
+ */
+class StoreAcquisitionsApprove extends base_command_1.BaseCommand {
+    static description = 'Approve a purchase an agent asked to make, after showing its price and terms. The agent then completes it at that price only';
+    static examples = [
+        '<%= config.bin %> store acquisitions approve acqr_0123456789abcdef01234567',
+        '<%= config.bin %> store acquisitions approve acqr_0123456789abcdef01234567 --yes --json',
+    ];
+    static args = {
+        requestId: core_1.Args.string({
+            description: 'The acquisition request id (acqr_…) the agent was given',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        yes: core_1.Flags.boolean({
+            char: 'y',
+            description: 'Approve without prompting and accept the buyer terms. The price and terms are still printed.',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreAcquisitionsApprove);
+        let request;
+        try {
+            request = await data_provider_1.dataService.getStoreAcquisitionRequest(args.requestId);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (!request) {
+            this.error('The purchase request could not be read, so nothing was approved.', { exit: 1 });
+        }
+        // Printed before any prompt and even with --yes, so a scripted approval
+        // still leaves the terms it agreed to in its own output.
+        for (const line of (0, store_acquisition_1.describeAcquisitionRequestLines)(request)) {
+            this.logToStderr(line);
+        }
+        if (request.status !== 'pending') {
+            const status = (0, data_provider_1.describeStoreAcquisitionStatus)(request.status);
+            this.error(`This request is ${status.label.toLowerCase()}, so there is nothing to approve.`, {
+                exit: 1,
+            });
+        }
+        if (!request.buyerTerms) {
+            this.error('Buyer terms are not configured, so this purchase cannot be approved.', {
+                exit: 1,
+            });
+        }
+        const name = request.listingName || request.entityId;
+        const price = (0, data_provider_1.formatStoreAcquisitionPrice)(request.price);
+        const confirmed = await (0, prompt_1.confirmDestructive)(`Approve buying ${name} for ${price} and accept the buyer terms (${request.buyerTerms.termsVersion})?`, flags.yes).catch((err) => this.error(err.message, { exit: err.exit ?? 1 }));
+        if (!confirmed) {
+            this.log('Cancelled. Nothing was approved.');
+            return;
+        }
+        let decided;
+        try {
+            decided = await data_provider_1.dataService.decideStoreAcquisitionRequest({
+                requestId: request.id,
+                decision: 'approve',
+                acceptTerms: true,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(decided, null, 2));
+            return;
+        }
+        const status = (0, data_provider_1.describeStoreAcquisitionStatus)(decided?.status);
+        this.log(`${status.label}. ${status.detail}`.trim());
+    }
+}
+exports.default = StoreAcquisitionsApprove;

package/dist/commands/store/acquisitions/decline.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Decline a purchase an agent asked to make (OSK-12240). Declining charges
+ * nothing and cannot spend money, so it asks no question; a declined request
+ * can never be used for a purchase.
+ */
+export default class StoreAcquisitionsDecline extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        requestId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/acquisitions/decline.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+/**
+ * Decline a purchase an agent asked to make (OSK-12240). Declining charges
+ * nothing and cannot spend money, so it asks no question; a declined request
+ * can never be used for a purchase.
+ */
+class StoreAcquisitionsDecline extends base_command_1.BaseCommand {
+    static description = 'Decline a purchase an agent asked to make. Nothing is charged, and the request cannot be used again';
+    static examples = [
+        '<%= config.bin %> store acquisitions decline acqr_0123456789abcdef01234567',
+    ];
+    static args = {
+        requestId: core_1.Args.string({
+            description: 'The acquisition request id (acqr_…) the agent was given',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreAcquisitionsDecline);
+        let decided;
+        try {
+            decided = await data_provider_1.dataService.decideStoreAcquisitionRequest({
+                requestId: args.requestId,
+                decision: 'decline',
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(decided, null, 2));
+            return;
+        }
+        const status = (0, data_provider_1.describeStoreAcquisitionStatus)(decided?.status);
+        this.log(`${status.label}. ${status.detail}`.trim());
+    }
+}
+exports.default = StoreAcquisitionsDecline;

package/dist/commands/store/acquisitions/show.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * A purchase an agent asked to make, read from the server's stored request
+ * (OSK-12240) — the same data the web approval card shows.
+ */
+export default class StoreAcquisitionsShow extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        requestId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/acquisitions/show.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const store_acquisition_1 = require("../../../lib/store-acquisition");
+/**
+ * A purchase an agent asked to make, read from the server's stored request
+ * (OSK-12240) — the same data the web approval card shows.
+ */
+class StoreAcquisitionsShow extends base_command_1.BaseCommand {
+    static description = 'Show a purchase an agent asked to make: its price, refund and buyer terms, and what it can do';
+    static examples = [
+        '<%= config.bin %> store acquisitions show acqr_0123456789abcdef01234567',
+        '<%= config.bin %> store acquisitions show acqr_0123456789abcdef01234567 --json',
+    ];
+    static args = {
+        requestId: core_1.Args.string({
+            description: 'The acquisition request id (acqr_…) the agent was given',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreAcquisitionsShow);
+        let request;
+        try {
+            request = await data_provider_1.dataService.getStoreAcquisitionRequest(args.requestId);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (!request) {
+            this.error('The purchase request could not be read.', { exit: 1 });
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(request, null, 2));
+            return;
+        }
+        for (const line of (0, store_acquisition_1.describeAcquisitionRequestLines)(request)) {
+            this.log(line);
+        }
+    }
+}
+exports.default = StoreAcquisitionsShow;