@skrr-ai/cli 0.1.83 → 0.1.84

package/dist/commands/store/reports/disposition.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const store_moderation_1 = require("../../../lib/store-moderation");
+/**
+ * Disposition one Store listing report as a `store_curation` curator
+ * (OSK-12597). warn / delist / ban are the same disposition the admin control
+ * plane's governed command applies: the listing changes and the publisher is
+ * told the outcome with per-reason counts, never who reported or what they
+ * wrote. The server refuses a curator conflicted on the listing.
+ */
+class StoreReportsDisposition extends base_command_1.BaseCommand {
+    static description = 'Disposition a Store listing report: dismiss, warn, delist or ban (store_curation curators only)';
+    static examples = [
+        '<%= config.bin %> store reports disposition 6abdd6fde81800ed380ad3b2 --action warn --note "Confirmed calendar spam"',
+        '<%= config.bin %> store reports disposition 6abdd6fde81800ed380ad3b2 --action dismiss --note "Not reproducible on 1.1"',
+    ];
+    static args = {
+        reportId: core_1.Args.string({
+            description: 'The report (from `store reports list`)',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        action: core_1.Flags.string({
+            description: store_moderation_1.STORE_REPORT_DISPOSITIONS.map((action) => `${action}: ${store_moderation_1.STORE_REPORT_DISPOSITION_EFFECTS[action]}`).join(' · '),
+            options: [...store_moderation_1.STORE_REPORT_DISPOSITIONS],
+            required: true,
+        }),
+        note: core_1.Flags.string({
+            description: 'Why (kept on the record; not shown to the publisher)',
+            required: true,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreReportsDisposition);
+        const action = flags.action;
+        let result;
+        try {
+            result = await (0, store_moderation_1.dispositionStoreReport)(args.reportId, { action, note: flags.note });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const d = result.disposition;
+        if (d.pendingConfirmation) {
+            // A ban is never applied by one curator. Say so plainly, so nobody reads
+            // "Recorded" as "banned".
+            this.log(`Ban requested on report ${d.reportId} (${d.agentId}). NOT applied yet: the listing is unchanged and the publisher was not told.`);
+            this.log(`A different Store curator must run \`store reports confirm-ban ${d.reportId} --note ...\`; \`store reports withdraw-ban ${d.reportId}\` cancels it.`);
+            return;
+        }
+        this.log(`${d.replayed ? 'Already recorded' : 'Recorded'}: report ${d.reportId} on ${d.agentId} -> ${d.action} (report ${d.reportStatus}${d.listingState ? `, listing ${d.listingState}` : ''}).`);
+        if (d.action === 'dismiss') {
+            this.log('The listing is unchanged and the publisher was not told.');
+        }
+        else if (d.replayed) {
+            this.log('Nothing new was sent to the publisher.');
+        }
+        else {
+            this.log(d.publisherNotified
+                ? 'The publisher was told the outcome (counts only, never who reported).'
+                : 'The listing change is in effect, but the publisher notice could not be confirmed.');
+        }
+    }
+}
+exports.default = StoreReportsDisposition;

package/dist/commands/store/reports/list.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * The Store report moderation queue (OSK-12597) — every report still waiting
+ * on a disposition, for a `store_curation` curator. `skrr store reports` (no
+ * subcommand) is something else: the reports YOU filed.
+ */
+export default class StoreReportsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        agent: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        skip: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/reports/list.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const format_1 = require("../../../lib/format");
+const store_moderation_1 = require("../../../lib/store-moderation");
+/**
+ * The Store report moderation queue (OSK-12597) — every report still waiting
+ * on a disposition, for a `store_curation` curator. `skrr store reports` (no
+ * subcommand) is something else: the reports YOU filed.
+ */
+class StoreReportsList extends base_command_1.BaseCommand {
+    static description = 'List Store listing reports awaiting a disposition (store_curation curators only). For the reports you filed, run `store reports`.';
+    static examples = [
+        '<%= config.bin %> store reports list',
+        '<%= config.bin %> store reports list --agent agent_abc --json',
+    ];
+    static flags = {
+        agent: core_1.Flags.string({ description: 'Only reports on this listing' }),
+        limit: core_1.Flags.integer({ description: 'At most this many (1-100)', default: 50 }),
+        skip: core_1.Flags.integer({ description: 'Skip this many (paging)', default: 0 }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreReportsList);
+        let queue;
+        try {
+            queue = await (0, store_moderation_1.listCuratorStoreReports)({
+                agentId: flags.agent,
+                limit: flags.limit,
+                skip: flags.skip,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(queue, null, 2));
+            return;
+        }
+        const reports = queue?.reports ?? [];
+        if (reports.length === 0) {
+            this.log('No Store reports are waiting for a disposition.');
+            return;
+        }
+        (0, format_1.renderTable)(reports.map((report) => ({
+            report: report.reportId,
+            agent: report.agentId,
+            reason: (0, data_provider_1.storeReportReasonLabel)(report.reason),
+            version: report.versionLabel ?? '-',
+            filed: report.createdAt ? String(report.createdAt).slice(0, 10) : '-',
+            // A conflicted curator is told why they cannot act, not the report text.
+            detail: [
+                report.banRequest
+                    ? `BAN WAITING for a second curator (requested by ${report.banRequest.requestedBy})`
+                    : null,
+                report.conflict
+                    ? `conflicted (${report.conflict}) - another curator must decide`
+                    : (report.description ?? '-'),
+            ]
+                .filter(Boolean)
+                .join(' | '),
+        })), [
+            { key: 'report', header: 'REPORT', verbatim: true },
+            { key: 'agent', header: 'LISTING', verbatim: true },
+            { key: 'reason', header: 'REASON' },
+            { key: 'version', header: 'VERSION' },
+            { key: 'filed', header: 'FILED' },
+            { key: 'detail', header: 'DETAIL', maxWidth: 60 },
+        ], (line) => this.log(line));
+        if (queue && queue.total > queue.skip + reports.length) {
+            this.log(`${queue.total - queue.skip - reports.length} more; page with --skip ${queue.skip + reports.length}.`);
+        }
+    }
+}
+exports.default = StoreReportsList;

package/dist/commands/store/reports/withdraw-ban.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Withdraw a Store report ban that is still waiting for a second curator
+ * (OSK-12597). The listing was never touched, and the report goes back to
+ * waiting for a disposition.
+ */
+export default class StoreReportsWithdrawBan extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        reportId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        note: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/reports/withdraw-ban.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const store_moderation_1 = require("../../../lib/store-moderation");
+/**
+ * Withdraw a Store report ban that is still waiting for a second curator
+ * (OSK-12597). The listing was never touched, and the report goes back to
+ * waiting for a disposition.
+ */
+class StoreReportsWithdrawBan extends base_command_1.BaseCommand {
+    static description = 'Withdraw a Store report ban still waiting for a second curator (store_curation curators only)';
+    static examples = [
+        '<%= config.bin %> store reports withdraw-ban 6abdd6fde81800ed380ad3b2 --note "Requested on the wrong listing"',
+    ];
+    static args = {
+        reportId: core_1.Args.string({
+            description: 'The report whose ban is waiting',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        note: core_1.Flags.string({ description: 'Why (kept on the record)' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreReportsWithdrawBan);
+        let result;
+        try {
+            result = await (0, store_moderation_1.withdrawStoreReportBan)(args.reportId, flags.note ? { note: flags.note } : {});
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const w = result.withdrawal;
+        this.log(w.withdrawn
+            ? `Withdrawn: the ban on report ${w.reportId} (requested by ${w.withdrawnRequest?.requestedBy ?? '-'}) will not be applied. The report is waiting for a disposition again.`
+            : `No ban was waiting on report ${w.reportId}; nothing changed.`);
+    }
+}
+exports.default = StoreReportsWithdrawBan;

package/dist/commands/store/updates.js

@@ -60,11 +60,15 @@ class StoreUpdates extends base_command_1.BaseCommand {
                     waiting: update.versionLabel ?? '-',
                     detail: pending?.reason === 'conflict'
                         ? `you both changed ${(pending.conflicts ?? []).join(', ') || 'a field'}`
-                        : pending?.reason === 'capability_widened'
-                            ? `adds capabilities: ${(pending.capabilities ?? [])
-                                .map((row) => `${row.field} (${row.added.join(', ')})`)
-                                .join('; ') || 'new powers'}`
-                            : 'the version your copy came from is unknown',
+                        : pending?.reason === 'dependency_unresolved'
+                            ? `requires a Skill you have not installed: ${(pending.missingDependencies ?? [])
+                                .map((dep) => dep.name || dep.entityId)
+                                .join(', ') || 'a required Skill'}`
+                            : pending?.reason === 'capability_widened'
+                                ? `adds capabilities: ${(pending.capabilities ?? [])
+                                    .map((row) => `${row.field} (${row.added.join(', ')})`)
+                                    .join('; ') || 'new powers'}`
+                                : 'the version your copy came from is unknown',
                 });
             }
             if (update?.state === 'buy') {

package/dist/commands/workspaces/audit.d.ts

@@ -0,0 +1,30 @@
+import { BaseCommand } from '../../base-command';
+import { type WorkspaceAgentAuditEvent } from '../../lib/workspaces';
+/**
+ * `skrr workspaces audit <workspace-id>` — the workspace's third-party (Store)
+ * agent audit trail: installs, updates and rollbacks, uninstalls, licenses that
+ * lapsed or were restored, and members' decisions on purchases an agent asked
+ * for (OSK-12588).
+ *
+ * Owner/admin only, and it needs no audit export configured: it reads the same
+ * enterprise audit rows the S3 export would ship.
+ */
+export default class WorkspacesAudit extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspaceId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        kind: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        since: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        until: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        cursor: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        all: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+export declare function describeAuditKind(event: WorkspaceAgentAuditEvent): string;
+export declare function describeAuditActor(event: WorkspaceAgentAuditEvent): string;

package/dist/commands/workspaces/audit.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeAuditKind = describeAuditKind;
+exports.describeAuditActor = describeAuditActor;
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const format_1 = require("../../lib/format");
+const workspaces_1 = require("../../lib/workspaces");
+/** `--all` follows cursors, but never without bound. */
+const MAX_PAGES = 50;
+/**
+ * `skrr workspaces audit <workspace-id>` — the workspace's third-party (Store)
+ * agent audit trail: installs, updates and rollbacks, uninstalls, licenses that
+ * lapsed or were restored, and members' decisions on purchases an agent asked
+ * for (OSK-12588).
+ *
+ * Owner/admin only, and it needs no audit export configured: it reads the same
+ * enterprise audit rows the S3 export would ship.
+ */
+class WorkspacesAudit extends base_command_1.BaseCommand {
+    static description = "List a workspace's third-party agent audit events (install, update/rollback, uninstall, lapse/restore, purchase approvals). Owner or admin only.";
+    static examples = [
+        '<%= config.bin %> workspaces audit <workspace-id>',
+        '<%= config.bin %> workspaces audit <workspace-id> --kind installed --kind updated',
+        '<%= config.bin %> workspaces audit <workspace-id> --since 2026-09-01T00:00:00Z --all --json',
+    ];
+    static args = {
+        workspaceId: core_1.Args.string({ description: 'Workspace ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        kind: core_1.Flags.string({
+            description: 'Only these kinds (repeatable or comma-separated): installed, updated, uninstalled, lapsed, restored, acquisition_decided',
+            multiple: true,
+        }),
+        since: core_1.Flags.string({ description: 'Events at or after this ISO-8601 time' }),
+        until: core_1.Flags.string({ description: 'Events before this ISO-8601 time' }),
+        limit: core_1.Flags.integer({ description: 'Events per page (1-200, default 50)' }),
+        cursor: core_1.Flags.string({ description: 'Continue from a previous page (nextCursor)' }),
+        all: core_1.Flags.boolean({ description: `Follow every page (up to ${MAX_PAGES})` }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(WorkspacesAudit);
+        const kinds = (flags.kind ?? [])
+            .flatMap((value) => value.split(','))
+            .map((value) => value.trim())
+            .filter(Boolean);
+        const events = [];
+        let last;
+        let cursor = flags.cursor;
+        try {
+            for (let page = 0; page < (flags.all ? MAX_PAGES : 1); page += 1) {
+                last = await (0, workspaces_1.listWorkspaceAgentAudit)(args.workspaceId, {
+                    kinds,
+                    since: flags.since,
+                    until: flags.until,
+                    limit: flags.limit,
+                    cursor,
+                });
+                events.push(...last.events);
+                if (!last.hasMore || !last.nextCursor || last.nextCursor === cursor)
+                    break;
+                cursor = last.nextCursor;
+            }
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        const nextCursor = last?.hasMore ? (last.nextCursor ?? null) : null;
+        if (flags.json) {
+            this.log(JSON.stringify({
+                workspaceId: args.workspaceId,
+                events,
+                hasMore: Boolean(last?.hasMore),
+                nextCursor,
+                coverage: last?.coverage ?? null,
+            }, null, 2));
+            return;
+        }
+        if (events.length === 0) {
+            this.log('No third-party agent audit events match.');
+        }
+        else {
+            (0, format_1.renderTable)(events.map(toRow), [
+                { key: 'at', header: 'AT' },
+                { key: 'kind', header: 'KIND' },
+                { key: 'actor', header: 'ACTOR' },
+                { key: 'member', header: 'MEMBER' },
+                { key: 'listing', header: 'LISTING' },
+                { key: 'copy', header: 'COPY' },
+                { key: 'release', header: 'RELEASE' },
+            ], (line) => this.log(line));
+        }
+        // Say what the trail does not record, so silence is not read as "nothing happened".
+        const notRecorded = last?.coverage?.notRecorded ?? [];
+        if (notRecorded.length) {
+            this.log('');
+            this.log(`Not recorded in this trail: ${notRecorded.join(', ')}.`);
+        }
+        if (nextCursor) {
+            this.log(`More events: --cursor ${nextCursor}`);
+        }
+    }
+}
+exports.default = WorkspacesAudit;
+function describeAuditKind(event) {
+    if (event.kind === 'updated' && event.release?.direction === 'rollback')
+        return 'rolled back';
+    if (event.kind === 'acquisition_decided') {
+        const decision = event.outcome?.decision;
+        return typeof decision === 'string' ? `purchase ${decision}` : 'purchase decided';
+    }
+    return event.kind;
+}
+function describeAuditActor(event) {
+    const { actor } = event;
+    let who;
+    if (actor.kind === 'user')
+        who = `user ${actor.userId ?? '?'}`;
+    else if (actor.kind === 'agent')
+        who = `agent ${actor.agentId ?? '?'}`;
+    else
+        who = `system ${actor.process ?? ''}`.trim();
+    if (actor.confirmedBy?.userId)
+        who += `, confirmed by user ${actor.confirmedBy.userId}`;
+    return who;
+}
+function toRow(event) {
+    const subject = event.subject;
+    const release = event.release;
+    const version = release?.fromVersionLabel && release.versionLabel
+        ? `${release.fromVersionLabel} -> ${release.versionLabel}`
+        : (release?.versionLabel ?? '');
+    return {
+        at: event.at,
+        kind: describeAuditKind(event),
+        actor: describeAuditActor(event),
+        member: subject.memberUserId ?? '',
+        listing: subject.listingName ?? subject.listingId ?? subject.teamOrderId ?? '',
+        copy: subject.installedAgentName ?? subject.installedAgentId ?? '',
+        release: version,
+    };
+}

package/dist/lib/agent-endpoints.d.ts

@@ -0,0 +1,62 @@
+/**
+ * agent-endpoints.ts — request client for `/api/agent-endpoints` (OSK-12611).
+ *
+ * An agent's hosted endpoint is `/v1/agents/:id/mcp`: an MCP server (Streamable
+ * HTTP) that runs YOUR agent — one you published to the Managed Agents API, or a
+ * Store agent you installed — in skrr's cloud, as you. These routes are the
+ * owner's control surface for it; the endpoint itself is called with an `osk_*`
+ * key carrying the `agents:invoke` scope.
+ *
+ * Paths are inline literals on purpose: `domain-api-parity` resolves a command
+ * to an endpoint by reading these strings.
+ */
+/** The API's own snake_case projection (`routes/agentEndpoints.js`). */
+export interface AgentEndpoint {
+    agent_id: string;
+    agent_name: string | null;
+    /** `self_authored` | `store_instance` | `not_eligible` */
+    kind: string;
+    url: string | null;
+    transport: string;
+    scope: string;
+    enabled: boolean;
+    enabled_at?: string | null;
+    switchable: boolean;
+    ready: boolean;
+    /** The gate that would refuse a turn right now (see docs/cli/SKRR_AGENT_ENDPOINTS.md). */
+    blocked_by: {
+        code: string;
+        message: string;
+    } | null;
+    release?: {
+        id: string;
+        version_label: string | null;
+        number?: number;
+    } | null;
+    payer?: {
+        label: string;
+        payerKind: string;
+        summary: string;
+    } | null;
+    capabilities?: {
+        status: string;
+        [key: string]: unknown;
+    };
+    workspace_id?: string | null;
+}
+export declare function getAgentEndpoint(agentId: string): Promise<AgentEndpoint>;
+/** Turn a Store instance's endpoint on or off. Owner only, enforced server-side. */
+export declare function setAgentEndpointEnabled(agentId: string, enabled: boolean): Promise<AgentEndpoint>;
+/** The scope a key needs to call an endpoint — and the only thing it grants. */
+export declare const AGENT_ENDPOINT_SCOPE = "agents:invoke";
+/**
+ * What to tell an MCP client. Claude Code takes a remote HTTP server with a
+ * header; any other client needs the same two facts (URL, bearer key).
+ */
+export declare function mcpClientCommand(endpoint: AgentEndpoint, secret: string): string;
+/** One human line for the state an endpoint is in. */
+export declare function describeEndpointState(endpoint: AgentEndpoint): string;
+/** The human rendering every `agents endpoint` command prints. */
+export declare function printAgentEndpoint(cmd: {
+    log: (line: string) => void;
+}, endpoint: AgentEndpoint): void;

package/dist/lib/agent-endpoints.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_ENDPOINT_SCOPE = void 0;
+exports.getAgentEndpoint = getAgentEndpoint;
+exports.setAgentEndpointEnabled = setAgentEndpointEnabled;
+exports.mcpClientCommand = mcpClientCommand;
+exports.describeEndpointState = describeEndpointState;
+exports.printAgentEndpoint = printAgentEndpoint;
+const api_fetch_1 = require("./api-fetch");
+async function getAgentEndpoint(agentId) {
+    return (0, api_fetch_1.apiFetch)(`/api/agent-endpoints/${encodeURIComponent(agentId)}`);
+}
+/** Turn a Store instance's endpoint on or off. Owner only, enforced server-side. */
+async function setAgentEndpointEnabled(agentId, enabled) {
+    return (0, api_fetch_1.apiFetch)(`/api/agent-endpoints/${encodeURIComponent(agentId)}`, {
+        method: 'PUT',
+        body: { enabled },
+    });
+}
+/** The scope a key needs to call an endpoint — and the only thing it grants. */
+exports.AGENT_ENDPOINT_SCOPE = 'agents:invoke';
+/**
+ * What to tell an MCP client. Claude Code takes a remote HTTP server with a
+ * header; any other client needs the same two facts (URL, bearer key).
+ */
+function mcpClientCommand(endpoint, secret) {
+    const name = `skrr-${endpoint.agent_id}`.replace(/[^A-Za-z0-9_-]/g, '-');
+    return `claude mcp add --transport http ${name} ${endpoint.url} --header "Authorization: Bearer ${secret}"`;
+}
+/** One human line for the state an endpoint is in. */
+function describeEndpointState(endpoint) {
+    if (endpoint.kind === 'not_eligible') {
+        return endpoint.blocked_by?.message || 'This agent has no hosted endpoint.';
+    }
+    if (!endpoint.enabled) {
+        return 'off — turn it on with `skrr agents endpoint enable`';
+    }
+    if (endpoint.blocked_by) {
+        return `on, but turns are refused: ${endpoint.blocked_by.code} — ${endpoint.blocked_by.message}`;
+    }
+    return 'on';
+}
+/** The human rendering every `agents endpoint` command prints. */
+function printAgentEndpoint(cmd, endpoint) {
+    cmd.log(`Agent     ${endpoint.agent_id}${endpoint.agent_name ? ` (${endpoint.agent_name})` : ''}`);
+    cmd.log(`Kind      ${endpoint.kind.replace(/_/g, ' ')}`);
+    cmd.log(`Endpoint  ${describeEndpointState(endpoint)}`);
+    if (endpoint.url) {
+        cmd.log(`URL       ${endpoint.url}  (MCP, ${endpoint.transport})`);
+        cmd.log(`Key scope ${endpoint.scope}`);
+    }
+    if (endpoint.release) {
+        cmd.log(`Release   ${endpoint.release.version_label || 'unlabelled'} (${endpoint.release.id})`);
+    }
+    if (endpoint.payer) {
+        cmd.log(`Who pays  ${endpoint.payer.summary}`);
+    }
+    else if (endpoint.kind !== 'not_eligible') {
+        cmd.log('Who pays  unknown right now (the billing resolver could not be read)');
+    }
+    if (endpoint.capabilities) {
+        cmd.log(`Manifest  ${endpoint.capabilities.status}`);
+    }
+}

package/dist/lib/auth-storage.d.ts

@@ -22,7 +22,7 @@ export interface AuthBundle {
  * How a stored refresh family came to exist.
  *
  * - `user_login`: a person signed in on purpose (`skrr login` in any of its
- *   flows, `skrr pair`). On a Dedicated guest this is the one stored family
+ *   flows). On a Dedicated guest this is the one stored family
  *   the broker-mode retirement must never touch: the person asked for it.
  * - `daemon_broker`: the local daemon minted it through its hand-off.
  *

package/dist/lib/auth-storage.js

@@ -779,7 +779,7 @@ function writeToBackend(bundle, options = {}) {
         persistedBundle = { ...bundle, serverOrigin: normalized };
     }
     // Always stamp THIS config as the owner — a bundle read back and re-written
-    // (e.g. `pair`) must not carry a record forward from wherever it came from.
+    // must not carry a record forward from wherever it came from.
     persistedBundle = { ...persistedBundle, owner: ownerFor(persistedBundle) };
     // Provenance: an explicit one wins (a login or a broker mint creates a new
     // family); otherwise this is a rotation of the stored family and keeps what

package/dist/lib/daemonBroker.d.ts

@@ -405,7 +405,7 @@ export declare function findBrokeredHandoffDescriptor(profile?: string): LocalBo
  *   2. `~/.skrr/cli-auth.json` reads cleanly and carries a refresh token,
  *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`,
  *   4. it is not marked `provenance: 'user_login'`. Since OSK-12293 every
- *      explicit sign-in (`skrr login`, `skrr pair`) records that marker in
+ *      explicit sign-in (`skrr login`, in any of its flows) records that marker in
  *      the file, so a login the person made seconds ago is kept and used;
  *      an unmarked file was written by a CLI that predates the marker.
  *

package/dist/lib/daemonBroker.js

@@ -1024,7 +1024,7 @@ function findBrokeredHandoffDescriptor(profile = 'default') {
  *   2. `~/.skrr/cli-auth.json` reads cleanly and carries a refresh token,
  *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`,
  *   4. it is not marked `provenance: 'user_login'`. Since OSK-12293 every
- *      explicit sign-in (`skrr login`, `skrr pair`) records that marker in
+ *      explicit sign-in (`skrr login`, in any of its flows) records that marker in
  *      the file, so a login the person made seconds ago is kept and used;
  *      an unmarked file was written by a CLI that predates the marker.
  *
@@ -1070,7 +1070,7 @@ function retirableCliAuthFamily(descriptorServerUrl) {
     if (!stored?.refreshToken)
         return null;
     // A family a person signed in for on purpose is never a pre-broker
-    // leftover: `skrr login` / `skrr pair` stamp it, and a refresh carries the
+    // leftover: `skrr login` stamps it, and a refresh carries the
     // stamp forward. Retiring it undid an explicit guest login on the very next
     // command (OSK-12293). Only an UNMARKED file — written by a CLI that
     // predates the marker — or a daemon-minted one is retired.
@@ -1223,7 +1223,7 @@ async function attemptDaemonBrokerLoginAndPersist(opts) {
 // ---------------------------------------------------------------------
 /**
  * Commands that manage their own auth lifecycle. The auto-broker MUST
- * NOT fire for these — `login` and `pair` run their own minting flows
+ * NOT fire for these — `login` runs its own minting flows
  * (auto-brokering first would burn a needless server round-trip and
  * mint a token that `cliLogin()` would immediately supersede), and
  * `logout` is about CLEARING auth (auto-brokering first would mint a
@@ -1237,7 +1237,6 @@ async function attemptDaemonBrokerLoginAndPersist(opts) {
 const AUTH_SELF_MANAGED_COMMANDS = new Set([
     'login',
     'logout',
-    'pair',
     'generate-recovery-code',
 ]);
 /**

package/dist/lib/harness-context.js

@@ -48,8 +48,4 @@ class HarnessCredentialPersistRefused extends Error {
 }
 exports.HarnessCredentialPersistRefused = HarnessCredentialPersistRefused;
 /** The commands a harness-context process may not run (they own the stored session). */
-exports.HARNESS_REFUSED_AUTH_COMMANDS = new Set([
-    'login',
-    'logout',
-    'pair',
-]);
+exports.HARNESS_REFUSED_AUTH_COMMANDS = new Set(['login', 'logout']);

package/dist/lib/store-acquisition.d.ts

@@ -9,3 +9,5 @@ import type { StoreAcquisitionRequest } from '@skrr-ai/data-provider';
  * terminal and the card cannot describe one request two ways.
  */
 export declare function describeAcquisitionRequestLines(request: StoreAcquisitionRequest): string[];
+/** One request as one line, for `skrr store acquisitions list`. */
+export declare function describeAcquisitionRequestRow(request: StoreAcquisitionRequest): string;