@skrr-ai/cli 0.1.8

package/dist/commands/tasks/complete.js

@@ -0,0 +1,457 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TaskCompletionMismatchError = void 0;
+exports.resolveCanonicalCompletionTaskId = resolveCanonicalCompletionTaskId;
+exports.isCompleteEndpointMissing = isCompleteEndpointMissing;
+exports.completeTaskDurably = completeTaskDurably;
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const task_extras_1 = require("../../lib/task-extras");
+const api_fetch_1 = require("../../lib/api-fetch");
+const outbox_1 = require("../../lib/outbox");
+const credential_resolver_1 = require("../../lib/credential-resolver");
+const delegated_cli_1 = require("../../lib/delegated-cli");
+const prompt_1 = require("../../lib/prompt");
+const task_report_1 = require("../../lib/task-report");
+const task_resolver_1 = require("../../lib/task-resolver");
+const task_instruction_offer_1 = require("../../lib/task-instruction-offer");
+const web_url_1 = require("../../lib/web-url");
+/**
+ * Mutation endpoints require the task's canonical UUID even though the CLI
+ * accepts human-readable refs and titles. Resolve the display reference before
+ * writing anything so a 404 from `POST /complete` cannot be mistaken for an
+ * old server and fall through to the legacy comment-first path.
+ */
+async function resolveCanonicalCompletionTaskId(taskRef, lookup) {
+    const task = (await lookup(taskRef));
+    const id = typeof task?.id === 'string' ? task.id.trim() : '';
+    if (!id) {
+        throw new Error(`Task ${taskRef} did not resolve to a canonical id.`);
+    }
+    return id;
+}
+/** A 404 from the /complete endpoint means an old server without the route. */
+function isCompleteEndpointMissing(err) {
+    return err instanceof api_fetch_1.ApiFetchError && err.status === 404;
+}
+/**
+ * The server finalized a different task than the one we were asked to finalize.
+ *
+ * The session-scoped completion endpoint derives its task from the run claim
+ * and deliberately ignores any client-supplied id — that is what stops a
+ * compromised agent process finishing a sibling task. The corollary is that the
+ * id resolved on this side is not necessarily the one that moved, so reporting
+ * ours would print a success line (and a `--json` `taskId`) for a task that is
+ * still open.
+ */
+class TaskCompletionMismatchError extends Error {
+    requestedTaskId;
+    completedTaskId;
+    constructor(requestedTaskId, completedTaskId) {
+        super(`Asked to complete ${requestedTaskId}, but the server finalized ${completedTaskId}. ` +
+            'In an autonomous session the server derives the task from the run claim and ignores ' +
+            `the id passed here, so ${requestedTaskId} has NOT been completed. Re-run without a ` +
+            "task id to finalize this session's own task.");
+        this.name = 'TaskCompletionMismatchError';
+        this.requestedTaskId = requestedTaskId;
+        this.completedTaskId = completedTaskId;
+    }
+}
+exports.TaskCompletionMismatchError = TaskCompletionMismatchError;
+/**
+ * Finalize a task durably (OSK-1969).
+ *
+ * Prefers the server's atomic POST /:taskId/complete (CAS move first, then
+ * the TASK_OUTPUT comment — no half-finished state if this process dies).
+ * Falls back to the legacy client-side two-step (comment, then move) when the
+ * server predates the endpoint (HTTP 404). `noMove` keeps the historical
+ * comment-only behavior and never touches the endpoint. All transport errors
+ * other than the endpoint-missing 404 are rethrown for the caller's uniform
+ * error handling.
+ */
+async function completeTaskDurably(opts) {
+    const { taskId, status, body, summary, artifacts, verdict, report, noMove, transport } = opts;
+    if (noMove) {
+        const comment = await transport.addComment(taskId, body);
+        return {
+            comment,
+            movedTask: null,
+            moved: false,
+            commentFailed: false,
+            usedAtomicEndpoint: false,
+        };
+    }
+    try {
+        const response = await transport.postComplete(taskId, {
+            status,
+            summary,
+            artifacts,
+            verdict,
+            ...(report ? { report } : {}),
+        });
+        // Reconcile before reporting. On the session-scoped path the server owns
+        // the task selection, so a divergence here means the task we were asked to
+        // finish is still open — a silent success would hide that from the agent
+        // and from anything parsing `--json`.
+        const finalizedTaskId = response.task?.id;
+        if (finalizedTaskId && finalizedTaskId !== taskId) {
+            throw new TaskCompletionMismatchError(taskId, finalizedTaskId);
+        }
+        return {
+            comment: response.comment ?? null,
+            movedTask: response.task ?? null,
+            moved: true,
+            commentFailed: response.commentFailed === true,
+            usedAtomicEndpoint: true,
+        };
+    }
+    catch (err) {
+        if (err instanceof TaskCompletionMismatchError)
+            throw err;
+        if (!isCompleteEndpointMissing(err) || transport.allowLegacyFallback === false) {
+            throw err;
+        }
+    }
+    // Old server — legacy non-atomic two-step, byte-identical to the historical
+    // behavior (comment first, then move).
+    const comment = await transport.addComment(taskId, body);
+    const movedTask = await transport.moveTask(taskId, status === 'completed' ? 'done' : 'failed');
+    return { comment, movedTask, moved: true, commentFailed: false, usedAtomicEndpoint: false };
+}
+class TasksComplete extends base_command_1.BaseCommand {
+    static description = 'Post a canonical TASK_OUTPUT comment and finish a task';
+    static examples = [
+        '<%= config.bin %> tasks complete <task-id> --summary "Shipped the fix." --verdict approved',
+        '<%= config.bin %> tasks complete --summary "Shipped the fix." --verdict approved',
+        '<%= config.bin %> tasks complete --task <task-id> --summary "Shipped the fix." --json',
+        '<%= config.bin %> tasks complete <task-id> --status failed --summary "Could not deploy." --verdict blocked',
+        '<%= config.bin %> tasks complete <task-id> --from-json task-output.json --json',
+        '<%= config.bin %> tasks complete <task-id> --summary "Comment only" --no-move',
+    ];
+    static args = {
+        id: core_1.Args.string({
+            description: 'Task ID or identifier; defaults to OVERSKY_SESSION_TASK_ID in task runtimes',
+            required: false,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        task: core_1.Flags.string({
+            description: 'Task ID or identifier; overrides daemon runtime context',
+        }),
+        'from-json': core_1.Flags.string({
+            description: 'Path to JSON with taskId, status, summary, artifacts, and verdict; "-" for stdin',
+        }),
+        status: core_1.Flags.string({
+            description: 'TASK_OUTPUT status',
+            options: ['completed', 'failed'],
+            default: 'completed',
+        }),
+        summary: core_1.Flags.string({ description: 'Completion summary' }),
+        artifacts: core_1.Flags.string({
+            description: 'Artifacts produced, or "none". Repeat --artifact for a list. The whole ' +
+                `TASK_OUTPUT block (status + summary + artifacts + verdict) must fit in ${data_provider_1.TASK_OUTPUT_BODY_MAX} ` +
+                'characters — link to commits, PRs, or file paths rather than pasting content.',
+            default: 'none',
+        }),
+        artifact: core_1.Flags.string({
+            description: 'A single artifact reference (repeatable); joined with commas. Prefer this ' +
+                'over pre-joining into --artifacts.',
+            multiple: true,
+        }),
+        verdict: core_1.Flags.string({ description: 'Final verdict', default: 'approved' }),
+        outcome: core_1.Flags.string({
+            description: 'Reader-facing conclusion for the durable task report',
+        }),
+        finding: core_1.Flags.string({
+            description: 'Concrete finding for the durable task report (repeatable)',
+            multiple: true,
+        }),
+        evidence: core_1.Flags.string({
+            description: 'Supporting rationale or evidence for the durable task report (repeatable)',
+            multiple: true,
+        }),
+        next: core_1.Flags.string({
+            description: 'Follow-up or next action for the durable task report (repeatable)',
+            multiple: true,
+        }),
+        'no-move': core_1.Flags.boolean({
+            description: 'Only post the TASK_OUTPUT comment; do not move task status',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksComplete);
+        let jsonBody = {};
+        if (flags['from-json']) {
+            try {
+                jsonBody = await (0, prompt_1.readJsonBody)(flags['from-json']);
+            }
+            catch (err) {
+                this.failWithCliError({
+                    message: err.message,
+                    code: 'INVALID_JSON_INPUT',
+                    exit: 1,
+                    retryable: false,
+                });
+            }
+        }
+        const input = (0, prompt_1.mergeDefined)(jsonBody, {
+            status: flags.status,
+            summary: flags.summary,
+            // Repeated --artifact wins over the single --artifacts string; both
+            // normalize to the same one-line form the server stores.
+            artifacts: flags.artifact?.length
+                ? (0, data_provider_1.normalizeTaskOutputArtifacts)(flags.artifact)
+                : flags.artifacts,
+            verdict: flags.verdict,
+        });
+        let taskIdentity;
+        try {
+            taskIdentity = (0, task_resolver_1.resolveTaskIdentity)({
+                positionalId: args.id,
+                flagTask: flags.task,
+                jsonBody,
+                jsonKeys: ['taskId', 'task', 'id'],
+            });
+        }
+        catch (err) {
+            const failure = (0, task_resolver_1.taskResolutionFailure)(err);
+            this.failWithCliError({
+                message: failure.message,
+                code: failure.code,
+                exit: 2,
+                retryable: false,
+                details: { suggestion: failure.suggestion, context: failure.details },
+            });
+        }
+        let status;
+        let summary;
+        let artifacts;
+        let verdict;
+        let report;
+        try {
+            status = normalizeStatus(input.status);
+            summary = requireOutputField(input.summary, 'summary');
+            artifacts =
+                optionalOutputField((0, data_provider_1.normalizeTaskOutputArtifacts)(input.artifacts)) || 'none';
+            verdict =
+                optionalOutputField(input.verdict) || (status === 'completed' ? 'approved' : 'failed');
+            const jsonReport = input.report && typeof input.report === 'object'
+                ? input.report
+                : undefined;
+            const reportInput = {
+                outcome: flags.outcome ?? jsonReport?.outcome,
+                findings: flags.finding?.length ? flags.finding : jsonReport?.findings,
+                evidence: flags.evidence?.length ? flags.evidence : jsonReport?.evidence,
+                nextActions: flags.next?.length
+                    ? flags.next
+                    : (jsonReport?.nextActions ?? jsonReport?.next),
+            };
+            if ((0, task_report_1.hasTaskReportInput)(reportInput)) {
+                // Summary remains the compact completion acknowledgement. A report's
+                // outcome is the readable conclusion in the task detail, so default it
+                // to summary when a caller supplied findings but no duplicate outcome.
+                report = (0, task_report_1.buildTaskReport)({ ...reportInput, outcome: reportInput.outcome ?? summary });
+            }
+        }
+        catch (err) {
+            this.failWithCliError({
+                message: err.message,
+                code: 'INVALID_TASK_OUTPUT',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        if (report && flags['no-move']) {
+            this.failWithCliError({
+                message: '--no-move cannot persist a completion report atomically. Run `skrr tasks report` first, or complete the task without --no-move.',
+                code: 'TASK_REPORT_REQUIRES_COMPLETION',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        // OSK-2941 — refuse locally, before the work of a round trip, using the SAME
+        // budget the server enforces. Discovering an undocumented cap by HTTP 400
+        // after a run has already finished is the failure being fixed; a caller must
+        // be able to see the limit without provoking it.
+        const budget = (0, data_provider_1.measureTaskOutputBudget)({ status, summary, artifacts, verdict });
+        if (!budget.fits) {
+            this.failWithCliError({
+                message: (0, data_provider_1.describeTaskOutputOverflow)(budget),
+                code: 'TASK_OUTPUT_TOO_LONG',
+                exit: 1,
+                retryable: false,
+                details: {
+                    limit: budget.limit,
+                    length: budget.length,
+                    overBy: budget.overBy,
+                    fieldLengths: budget.fieldLengths,
+                },
+            });
+        }
+        const body = formatTaskOutput({ status, summary, artifacts, verdict });
+        // Computed once, OUTSIDE the try, so the original attempt and the queued
+        // replay carry the same key. Must match the payload the outbox stores.
+        const completionPayload = {
+            summary,
+            artifacts,
+            verdict,
+            ...(report ? { report } : {}),
+            noMove: !!flags['no-move'],
+        };
+        const completionIdempotencyKey = (0, outbox_1.idempotencyKeyFor)('task-complete', taskIdentity.id, JSON.stringify(completionPayload));
+        let result;
+        try {
+            const sessionCompletionPath = autonomousSessionCompletionPath();
+            // The session endpoint derives its task from the trusted run claim and
+            // does not need (or permit) a broad task lookup. The normal user and
+            // delegated-daemon path does: task routes read OSK refs, while mutation
+            // services key on UUIDs. Passing the ref straight through caused the
+            // atomic endpoint's task-level 404 to look like "endpoint missing";
+            // legacy fallback then posted TASK_OUTPUT before its move 404'd.
+            const completionTaskId = sessionCompletionPath
+                ? taskIdentity.id
+                : await resolveCanonicalCompletionTaskId(await this.resolveTaskReference(taskIdentity.id), (taskRef) => data_provider_1.dataService.getTask(taskRef, { enrich: false }));
+            result = await completeTaskDurably({
+                taskId: completionTaskId,
+                status,
+                body,
+                summary,
+                artifacts,
+                verdict,
+                report,
+                noMove: !!flags['no-move'],
+                transport: {
+                    postComplete: (taskId, payload) => (0, api_fetch_1.apiFetch)(
+                    // A managed session supplies its own completion path; otherwise the
+                    // lib owns the URL so the endpoint stays visible to the parity check.
+                    sessionCompletionPath ?? (0, task_extras_1.taskCompletePath)(taskId), {
+                        method: 'POST',
+                        body: payload,
+                        // Same key the outbox will replay with — see `spaces create`.
+                        // Without it on THIS attempt, a completion that lands and loses
+                        // its response would be applied twice on replay.
+                        headers: { 'X-Idempotency-Key': completionIdempotencyKey },
+                    }),
+                    addComment: (taskId, commentBody) => data_provider_1.dataService.addTaskComment({ taskId, data: { body: commentBody } }),
+                    moveTask: (taskId, taskStatus) => data_provider_1.dataService.moveTask({ taskId, status: taskStatus }),
+                    allowLegacyFallback: sessionCompletionPath ? false : undefined,
+                },
+            });
+        }
+        catch (err) {
+            // The completion summary/artifacts/verdict are authored content — the
+            // record of what the agent actually did. Losing that to a 503 costs the
+            // reasoning, not just a retry, so an OUTAGE queues it durably (OSK-2806)
+            // while every 4xx still fails immediately through handleApiError.
+            //
+            // The key is derived from (taskId, payload) so replaying THIS completion
+            // collapses onto the original server-side rather than double-completing;
+            // `requestIdempotency` on POST /api/tasks/:taskId/complete is what makes
+            // that hold.
+            this.queueWriteOrFail(err, {
+                command: 'tasks complete',
+                summary: `completion of task ${taskIdentity.id}`,
+                method: 'post',
+                url: `/api/tasks/${encodeURIComponent(taskIdentity.id)}/complete`,
+                body: completionPayload,
+                idempotencyKey: completionIdempotencyKey,
+            });
+        }
+        const { comment, movedTask } = result;
+        // Report the task the SERVER finalized, not the one resolved locally.
+        // `completeTaskDurably` already refuses a divergence, so these agree by the
+        // time we get here — preferring the server's id keeps that true even if a
+        // future path stops throwing.
+        const completedTaskId = movedTask?.id ?? taskIdentity.id;
+        const payload = {
+            success: true,
+            taskId: completedTaskId,
+            task: taskIdentity,
+            moved: !flags['no-move'],
+            moveStatus: movedTask?.status ?? null,
+            comment,
+            movedTask,
+            taskOutput: {
+                status,
+                summary,
+                artifacts,
+                verdict,
+                ...(report ? { report } : {}),
+                body,
+            },
+        };
+        if (flags.json) {
+            const url = movedTask
+                ? (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, movedTask)
+                : (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, { id: completedTaskId });
+            this.log(JSON.stringify({ ...payload, url: report && url ? `${url}#task-outcome` : url }, null, 2));
+            return;
+        }
+        const commentId = comment
+            ? (comment.id ?? comment._id)
+            : undefined;
+        this.log(`Posted TASK_OUTPUT comment ${commentId ?? '?'} on task ${completedTaskId}`);
+        if (movedTask) {
+            this.log(`Moved task ${completedTaskId} to ${movedTask.status}`);
+        }
+        if (report) {
+            const url = (0, web_url_1.taskUrlFrom)(this.cliConfig.baseURL, movedTask ?? { id: completedTaskId });
+            if (url)
+                this.log(`Outcome: ${url}#task-outcome`);
+        }
+        await (0, task_instruction_offer_1.maybeOfferTaskManagementInstructions)((message) => this.log(message));
+    }
+}
+exports.default = TasksComplete;
+function autonomousSessionCompletionPath() {
+    // A daemon-delegated CLI credential has the regular user command surface;
+    // use the normal atomic endpoint so completion, comments, and moves all
+    // share the same full-permission principal.
+    if ((0, delegated_cli_1.isDelegatedCliSession)())
+        return null;
+    if (!(0, credential_resolver_1.resolveTrustedAutonomousCredential)())
+        return null;
+    const sessionId = (process.env.OVERSKY_SESSION_ID || '').trim();
+    if (!sessionId) {
+        throw new Error('Autonomous task completion requires OVERSKY_SESSION_ID.');
+    }
+    return `/api/agentic/sessions/${encodeURIComponent(sessionId)}/task-completion`;
+}
+function normalizeStatus(value) {
+    const normalized = optionalString(value) || 'completed';
+    if (normalized === 'completed' || normalized === 'failed') {
+        return normalized;
+    }
+    throw new Error('status must be "completed" or "failed".');
+}
+function requireOutputField(value, field) {
+    const normalized = optionalOutputField(value);
+    if (!normalized) {
+        throw new Error(`${field} is required.`);
+    }
+    return normalized;
+}
+function optionalOutputField(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    const normalized = String(value)
+        .replace(/---TASK_OUTPUT---/gi, 'TASK_OUTPUT')
+        .replace(/---END_OUTPUT---/gi, 'END_OUTPUT')
+        .replace(/[\r\n]+/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+    return normalized || undefined;
+}
+function optionalString(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    const normalized = String(value).trim();
+    return normalized || undefined;
+}
+// Rendering is shared with the API (`@skrr-ai/data-provider`), so the string
+// measured by the local preflight is byte-identical to the one the server stores.
+const formatTaskOutput = data_provider_1.renderTaskOutputBody;

package/dist/commands/tasks/continue-ready.d.ts

@@ -0,0 +1,20 @@
+import { BaseCommand } from '../../base-command';
+export default class TasksContinueReady extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        descendants: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'respect-deps': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'max-starts': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'ignore-capacity': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'retry-recovered': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        skill: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}