@skrr-ai/cli 0.1.93 → 0.1.95

package/dist/commands/login.js

@@ -6,9 +6,11 @@ const auth_core_1 = require("@skrr-ai/auth-core");
 const base_command_1 = require("../base-command");
 const daemonHandoff_1 = require("../lib/daemonHandoff");
 const daemon_setup_1 = require("../lib/daemon-setup");
+const managed_instruction_setup_1 = require("../lib/managed-instruction-setup");
 const config_1 = require("../lib/config");
 const cli_id_1 = require("../lib/cli-id");
 const keychain_1 = require("../lib/keychain");
+const profile_machine_identity_guard_1 = require("../lib/profile-machine-identity-guard");
 const login_1 = require("../lib/login");
 const device_code_1 = require("../lib/device-code");
 const api_fetch_1 = require("../lib/api-fetch");
@@ -29,14 +31,13 @@ const prompt_1 = require("../lib/prompt");
  * Refresh, rotation, family revoke, and the cross-process auth.lock are
  * all the same substrate the daemon uses (@skrr-ai/auth-core).
  *
- * CI. There is no long-lived token that `skrr` commands accept yet (OSK-13208).
- * `skrr create-token` mints an `osk_ci_*` token, and that token only
- * bootstraps a DAEMON (`OVERSKY_TOKEN=osk_ci_... skrrd start`): every `skrr`
- * command rejects it with 401 (see create-token.ts and base-command.ts). What
- * works today is a session minted for the machine with
+ * CI. `skrr tokens create` mints an expiring, revocable personal access token
+ * (`osk_pat_*`) for SKRR_TOKEN. It does not rotate and is distinct from a
+ * per-machine SESSION minted with
  * `skrr token mint --for <id>`, restored by the `OVERSKY_REFRESH_TOKEN` path
  * below — whose refresh token rotates on use — or `OVERSKY_AUTH_HELPER`.
- * docs/cli/SKRR_AUTH.md ("CI today") states the caveats.
+ * docs/cli/SKRR_AUTH.md states credential precedence and revocation scopes.
+ * Legacy `skrr create-token` credentials only bootstrap a daemon.
  *
  * L13 — non-interactive restore from a refresh token. When
  * `OVERSKY_REFRESH_TOKEN` is set in the environment, the browser /
@@ -60,15 +61,18 @@ class Login extends base_command_1.BaseCommand {
         'If the background service answers but refuses, skrr says why before moving on.\n\n' +
         'What it stores: a refresh session in this profile’s credential store (the macOS Keychain, ' +
         'or ~/.skrr/cli-auth.json elsewhere) that keeps renewing itself. Plain skrr commands on a ' +
-        'computer whose background service is signed in need no login at all: they borrow a ' +
-        'short-lived token from it for each run and store nothing (an older background service ' +
-        'mints them a stored session instead). On a Dedicated Runtime, where the service only ' +
+        'computer whose background service is signed in can adopt a durable CLI session automatically ' +
+        'unless this profile was explicitly signed out. On a Dedicated Runtime, where the service only ' +
         'lends short-lived tokens, nothing is stored.\n\n' +
         'Set OVERSKY_SKIP_DAEMON_BROKER=1 to skip step 1 (--device-code skips it too). After signing ' +
         'in, skrr also signs the background service in, and on an interactive first login on a ' +
         'computer without it, offers to install it. Set SKRR_SKIP_DAEMON_HANDOFF=1 to skip that ' +
-        'optional setup; it does not skip step 1.\n\n' +
-        'With no person to approve a sign-in (CI, a provisioning script): mint a session for that ' +
+        'optional setup; it does not skip step 1. On interactive sign-in, skrr checks managed ' +
+        'instruction setup for coding agents on the verified local daemon. You choose each ' +
+        'provider and its update policy; run `skrr instructions setup` to revisit this later. ' +
+        'Set OVERSKY_DISABLE_INSTRUCTION_OFFER=1 to skip these prompts.\n\n' +
+        'For CI, create an expiring personal access token with `skrr tokens create` and supply it as ' +
+        'SKRR_TOKEN in the secret store; no login is needed. For a persistent machine, mint a session for that ' +
         'machine with `skrr token mint --for <id>` and run this command there with ' +
         'OVERSKY_REFRESH_TOKEN and OVERSKY_CLI_ID set. The refresh token rotates when used, so one ' +
         'minted session serves one machine. Tokens from `skrr create-token` only bring up a ' +
@@ -116,6 +120,11 @@ class Login extends base_command_1.BaseCommand {
     };
     async run() {
         const { flags } = await this.parse(Login);
+        if ((0, profile_machine_identity_guard_1.legacyProfileSharesDefaultMachine)()) {
+            this.error(`Profile '${(0, keychain_1.getActiveProfile)()}' was created before profiles had separate machine identities. ` +
+                "Signing in could replace the default machine's device-key pin. " +
+                'Create a new profile name and sign in there; the existing profile was not changed.', { exit: 78 });
+        }
         if (flags['base-url'] && flags.server && flags['base-url'] !== flags.server) {
             this.error('--base-url and --server were both provided with different values.', { exit: 2 });
         }
@@ -289,6 +298,13 @@ class Login extends base_command_1.BaseCommand {
                     this.log(`The local daemon was not signed in (${handoff.detail}). ` +
                         `Run \`${this.config.bin} daemon login\` to finish.`);
                 }
+                // Authentication above is complete. The common onboarding helper verifies
+                // the daemon's live account/server/profile and handles failures nonfatally.
+                await (0, managed_instruction_setup_1.maybeOfferManagedInstructionSetup)({
+                    trigger: 'login',
+                    log: (line) => this.log(line),
+                    waitForLocalReady: handoff.status === 'delivered',
+                });
             }
             catch (err) {
                 // Ctrl-C while waiting for device-code approval: a person's decision,

package/dist/commands/logout.js

@@ -68,13 +68,13 @@ function shouldSkipLocalLogout(input) {
  * laptop scenario where the user wants every persistent daemon credential
  * gone immediately, regardless of which machine they're calling from.
  *
- * Architectural note: the L7 server-side has a bulk endpoint
- * (`POST /api/auth/sessions/revoke-all`) but it requires a user-scope JWT.
- * CLI sessions are minted with `scope: 'cli'` (interactive single-machine
- * use), so they cannot directly hit the bulk endpoint — that's by design,
- * preventing a leaked CLI credential from kicking the user out of every
- * other device. We instead iterate `DELETE /api/daemon-resources/:id`
- * which CLI scope CAN hit (per-resource ownership check, not scope check).
+ * This implementation iterates `DELETE /api/daemon-resources/:id` rather
+ * than the broader `POST /api/auth/sessions/revoke-all` endpoint. Its actual
+ * scope is registered daemons plus this CLI family; independent browser/CLI
+ * refresh families and PATs are not swept. The auth endpoint's current
+ * HUMAN_SCOPES includes CLI, so the historical explanation that CLI scope
+ * cannot call it is obsolete. Preserve the disclosed narrower behavior until
+ * a separately reviewed authority/UX migration changes it.
  * N round trips for N daemons; for typical fleet sizes (< 20) this is
  * sub-second. Each per-daemon DELETE produces its own audit row keyed by
  * `'user_initiated_per_device'`, which preserves forensic granularity.

package/dist/commands/security/overview.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../base-command';
+/** A single read of the three owner-only Security Center surfaces. */
+export default class SecurityOverview extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/security/overview.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const api_fetch_1 = require("../../lib/api-fetch");
+function rows(value, name) {
+    if (!Array.isArray(value))
+        throw new Error(`Security overview: invalid ${name} response`);
+    if (value.some((row) => row === null || typeof row !== 'object' || Array.isArray(row))) {
+        throw new Error(`Security overview: invalid ${name} row`);
+    }
+    return value;
+}
+function hasMore(value, name) {
+    if (typeof value !== 'boolean') {
+        throw new Error(`Security overview: invalid ${name} pagination`);
+    }
+    return value;
+}
+function activeTokens(value) {
+    const tokens = rows(value, 'access tokens');
+    // A missing or unfamiliar state must not turn an active credential into a
+    // reassuring "None". Validate the whole list before filtering it.
+    if (tokens.some((row) => typeof row.state !== 'string' || !['active', 'expired', 'revoked'].includes(row.state))) {
+        throw new Error('Security overview: invalid access token state');
+    }
+    return tokens.filter((row) => row.state === 'active');
+}
+function string(value) {
+    return typeof value === 'string' ? value : null;
+}
+/** Explicit allow-lists: the sessions API also returns a full IP address. */
+function safeSession(row) {
+    return {
+        id: string(row.id) ?? '',
+        kind: string(row.kind) ?? 'unknown',
+        device: string(row.device) ?? 'Unknown device',
+        label: string(row.label),
+        daemonId: string(row.daemonId),
+        network: string(row.network),
+        country: string(row.country),
+        createdAt: string(row.createdAt),
+        lastActiveAt: string(row.lastActiveAt),
+        current: row.current === true,
+    };
+}
+function safeActivity(row) {
+    const device = row.device && typeof row.device === 'object' && !Array.isArray(row.device)
+        ? row.device
+        : {};
+    const session = row.session && typeof row.session === 'object' && !Array.isArray(row.session)
+        ? row.session
+        : {};
+    return {
+        id: string(row.id) ?? '',
+        action: string(row.action) ?? 'unknown',
+        outcome: string(row.outcome) ?? 'unknown',
+        method: string(row.method),
+        device: string(device.label),
+        network: string(row.network),
+        country: string(row.country),
+        newDevice: row.newDevice === true,
+        reportedNotMe: row.reportedNotMe === true,
+        createdAt: string(row.createdAt) ?? '',
+        sessionId: string(session.id),
+    };
+}
+function safeToken(row) {
+    return {
+        id: string(row.id) ?? '',
+        name: string(row.name) ?? '',
+        lastFour: string(row.lastFour) ?? '',
+        scopes: Array.isArray(row.scopes)
+            ? row.scopes.filter((v) => typeof v === 'string')
+            : [],
+        expiresAt: string(row.expiresAt),
+        lastUsedAt: string(row.lastUsedAt),
+    };
+}
+/** A single read of the three owner-only Security Center surfaces. */
+class SecurityOverview extends base_command_1.BaseCommand {
+    static description = 'Review active sessions, recent security activity, and access tokens';
+    static examples = [
+        '<%= config.bin %> security overview',
+        '<%= config.bin %> security overview --limit 50 --json',
+    ];
+    static flags = {
+        limit: core_1.Flags.integer({
+            description: 'Sessions and events to show (default 25, maximum 100)',
+            min: 1,
+            max: 100,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(SecurityOverview);
+        const limit = flags.limit ?? 25;
+        let sessionPage;
+        let activityPage;
+        let tokenPage;
+        try {
+            // All three reads must succeed. A partial response could claim an
+            // account has no sessions or tokens when a Security Center read failed.
+            [sessionPage, activityPage, tokenPage] = await Promise.all([
+                (0, api_fetch_1.apiFetch)(`/api/auth/sessions/refresh?limit=${limit}`, {
+                    credential: this.resolvedCredential,
+                }),
+                (0, api_fetch_1.apiFetch)(`/api/user/security-activity?limit=${limit}`, {
+                    credential: this.resolvedCredential,
+                }),
+                (0, api_fetch_1.apiFetch)('/api/user/access-tokens', {
+                    credential: this.resolvedCredential,
+                }),
+            ]);
+            const sessions = rows(sessionPage?.sessions, 'sessions').map(safeSession);
+            const activity = rows(activityPage?.events, 'activity').map(safeActivity);
+            const accessTokens = activeTokens(tokenPage?.accessTokens).map(safeToken);
+            const overview = {
+                sessions,
+                sessionsHaveMore: hasMore(sessionPage?.hasMore, 'sessions'),
+                activity,
+                activityHasMore: hasMore(activityPage?.hasMore, 'activity'),
+                accessTokens,
+            };
+            if (flags.json) {
+                this.log(JSON.stringify(overview, null, 2));
+                return;
+            }
+            this.log(`Active sessions (${sessions.length}${overview.sessionsHaveMore ? '+' : ''}):`);
+            for (const s of sessions) {
+                this.log(`  ${s.id}  ${s.current ? '[this session] ' : ''}${s.label || s.device}  ${s.kind}  ${s.country || s.network || 'unknown location'}  last active ${s.lastActiveAt || 'unknown'}`);
+            }
+            if (!sessions.length)
+                this.log('  None.');
+            this.log(`Recent security activity (${activity.length}${overview.activityHasMore ? '+' : ''}):`);
+            for (const event of activity) {
+                this.log(`  ${event.createdAt}  ${event.action} (${event.outcome})  ${event.device || 'unknown device'}  ${event.country || event.network || 'unknown location'}${event.newDevice ? '  NEW DEVICE' : ''}${event.reportedNotMe ? '  REPORTED' : ''}  ${event.id}`);
+            }
+            if (!activity.length)
+                this.log('  None.');
+            this.log(`Active access tokens (${accessTokens.length}):`);
+            for (const token of accessTokens) {
+                this.log(`  ${token.id}  ${token.name}  …${token.lastFour}  expires ${token.expiresAt || 'unknown'}`);
+            }
+            if (!accessTokens.length)
+                this.log('  None.');
+            if (overview.sessionsHaveMore || overview.activityHasMore) {
+                this.log('More sessions or events are available in Account settings; increase --limit to see up to 100 here.');
+            }
+            this.log('To review an unfamiliar sign-in and secure your account, open Account settings > Security activity.');
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = SecurityOverview;

package/dist/commands/spaces/claim.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base-command';
+export default class SpacesClaim extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/spaces/claim.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const web_url_1 = require("../../lib/web-url");
+class SpacesClaim extends base_command_1.BaseCommand {
+    static description = 'Claim an ownerless space when you are eligible';
+    static examples = [
+        '<%= config.bin %> spaces claim <space-id>',
+        '<%= config.bin %> spaces claim "Team workspace" --json',
+    ];
+    static args = {
+        id: core_1.Args.string({
+            description: 'Space ID, identifier, or title',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the claim result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(SpacesClaim);
+        const spaceId = await this.resolveSpaceReference(args.id);
+        let result;
+        try {
+            result = await data_provider_1.dataService.claimSpaceOwnership(spaceId);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        const url = (0, web_url_1.spaceUrlFrom)(this.cliConfig.baseURL, { id: result.spaceId });
+        if (flags.json) {
+            this.log(JSON.stringify({ ...result, ...(url ? { url } : {}) }, null, 2));
+            return;
+        }
+        this.log(`Claimed ownership of space ${result.spaceId}${url ? `: ${url}` : ''}`);
+    }
+}
+exports.default = SpacesClaim;

package/dist/commands/spaces/ownership.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base-command';
+export default class SpacesOwnership extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/spaces/ownership.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+class SpacesOwnership extends base_command_1.BaseCommand {
+    static description = 'Show whether a space is ownerless and whether you may claim it';
+    static examples = [
+        '<%= config.bin %> spaces ownership <space-id>',
+        '<%= config.bin %> spaces ownership OSK-S-12 --json',
+    ];
+    static args = {
+        id: core_1.Args.string({
+            description: 'Space ID, identifier, or title',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the ownership state as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(SpacesOwnership);
+        const spaceId = await this.resolveSpaceReference(args.id);
+        let ownership;
+        try {
+            ownership = await data_provider_1.dataService.getSpaceOwnership(spaceId);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(ownership, null, 2));
+            return;
+        }
+        if (!ownership.ownerless) {
+            this.log('This space has an owner.');
+            return;
+        }
+        this.log(ownership.canClaim
+            ? `This space is ownerless. You may claim it with skrr spaces claim ${spaceId}.`
+            : `This space is ownerless. You cannot claim it yet (${ownership.reason}).`);
+    }
+}
+exports.default = SpacesOwnership;

package/dist/commands/tasks/cancel-cascade.js

@@ -5,7 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const prompt_1 = require("../../lib/prompt");
 class TasksCancelCascade extends base_command_1.BaseCommand {
-    static description = 'Cancel an active cascade pipeline for a task';
+    static description = 'Cancel running and queued work in the active cascade; future schedules stay enabled';
     static examples = [
         '<%= config.bin %> tasks cancel-cascade <task-id>',
         '<%= config.bin %> tasks cancel-cascade <task-id> --yes',

package/dist/commands/tasks/create-tree.d.ts

@@ -52,9 +52,13 @@ export declare function partialFailureResult(args: {
     failedAt: TreeFailure;
     total: number;
     prefix?: string;
+    keyed?: boolean;
     warnings: Array<Record<string, unknown>>;
+    failures?: Array<Record<string, unknown>>;
 }): {
     warnings?: Record<string, unknown>[] | undefined;
+    rerun: string;
+    failures?: Record<string, unknown>[] | undefined;
     object: string;
     ok: boolean;
     count: number;
@@ -69,7 +73,6 @@ export declare function partialFailureResult(args: {
     }[];
     mapping: Record<string, string>;
     failedAt: TreeFailure;
-    rerun: string;
 };
 export default class TasksCreateTree extends BaseCommand {
     static description: string;
@@ -80,6 +83,7 @@ export default class TasksCreateTree extends BaseCommand {
         'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'external-key-prefix': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         fresh: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        resume: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'default-agent': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         goal: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/tasks/create-tree.js

@@ -78,8 +78,9 @@ function partialFailureResult(args) {
         })),
         mapping,
         failedAt,
-        rerun: prefix
-            ? 'Safe to re-run the same command: nodes with an externalKey are updated, not duplicated.'
+        ...(args.failures ? { failures: args.failures } : {}),
+        rerun: prefix || args.keyed
+            ? 'Re-run the same keyed file with --resume to confirm existing IDs and create only missing nodes. A submitted write may still finish; stable keys prevent duplicates.'
             : 'Re-running creates un-keyed nodes again. Use mapping to continue by hand, or re-run with --external-key-prefix.',
         ...(warnings.length > 0 ? { warnings } : {}),
     };
@@ -105,6 +106,10 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         fresh: core_1.Flags.boolean({
             description: 'Do not derive a key prefix from the file: create a new copy even if this exact file was applied before',
         }),
+        resume: core_1.Flags.boolean({
+            description: 'Confirm existing stable-key nodes without patching them, then create only missing nodes. Use the unchanged keyed file after an incomplete result.',
+            exclusive: ['fresh'],
+        }),
         'default-agent': core_1.Flags.string({
             description: 'Override the automatic assignee for nodes with no assignee. Use "auto" to inherit the space lead agent; children inherit parent assignees first.',
         }),
@@ -212,6 +217,8 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         }
         const errors = [
             ...defaultAgentErrors,
+            ...(flags.resume && unkeyedNodes(planned).length
+                ? ['--resume requires an externalKey for every node; supply --external-key-prefix and do not use --fresh'] : []),
             ...planned.flatMap(({ key, payload }) => (0, tasks_1.validateTaskCreatePayload)(payload).map((error) => `${key}: ${error}`)),
         ];
         if (errors.length > 0) {
@@ -267,15 +274,17 @@ class TasksCreateTree extends base_command_1.BaseCommand {
         const mapping = {};
         const results = [];
         // A half-applied tree reports the ids it did create; the only way back.
-        const reportPartial = (item, failure, err) => {
-            if (results.length === 0)
+        const reportPartial = (item, failure, err, failures) => {
+            if (results.length === 0 && !failures)
                 this.handleApiError(err);
             const partial = partialFailureResult({
                 results,
                 mapping,
                 total: planned.length,
                 prefix: keyPrefix,
+                keyed: unkeyedNodes(planned).length === 0,
                 warnings,
+                failures,
                 failedAt: {
                     tempId: item.key,
                     ...(item.parentKey ? { parentTempId: item.parentKey } : {}),
@@ -288,10 +297,18 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                 process.exitCode = partial.failedAt.error.retryable ? 5 : 1;
                 this.exit(partial.failedAt.error.retryable ? 5 : 1);
             }
-            this.log(`Created ${results.length} of ${planned.length} task(s) before "${item.key}" failed:`);
+            this.log(`Confirmed ${results.length} of ${planned.length} task(s); stopped at "${item.key}":`);
             for (const [tempId, id] of Object.entries(mapping))
                 this.log(`- ${tempId} -> ${id}`);
             this.log(partial.rerun);
+            if (failures) {
+                for (const row of failures) {
+                    const detail = row.error;
+                    this.log(`- ${String(row.tempId)}: ${String(row.outcome)} — ${detail.message}`);
+                }
+                this.exit(failure.retryable ? 5 : 1);
+                return;
+            }
             this.handleApiError(err);
         };
         // The serial path: one request per node. Used for updates of existing keyed
@@ -381,7 +398,11 @@ class TasksCreateTree extends base_command_1.BaseCommand {
                             ...(failure.error.status ? { status: failure.error.status } : {}),
                             ...(failure.error.code ? { code: failure.error.code } : {}),
                         });
-                        reportPartial(node, failure.error, err);
+                        reportPartial(node, failure.error, err, outcome.failures.map((f) => ({
+                            tempId: f.key, outcome: f.outcome ?? (f.skipped ? 'not_attempted' : 'failed'),
+                            externalKey: f.externalKey ?? byKey.get(f.key)?.payload.externalKey,
+                            error: f.error,
+                        })));
                     }
                     return;
                 }
@@ -395,7 +416,14 @@ class TasksCreateTree extends base_command_1.BaseCommand {
             if (existingTask) {
                 // An update must see its parent's id, and a later create its own parent's.
                 await flushPending();
-                await applySerial(item);
+                if (flags.resume) {
+                    const id = (0, tasks_1.taskId)(existingTask);
+                    mapping[item.key] = id;
+                    results.push({ tempId: item.key, parentTempId: item.parentKey, id, action: 'existing',
+                        externalKey: item.payload.externalKey, title: existingTask.title ?? item.payload.title, task: existingTask });
+                }
+                else
+                    await applySerial(item);
             }
             else {
                 pending.push(item);

package/dist/commands/tasks/interrupt.js

@@ -10,7 +10,7 @@ const base_command_1 = require("../../base-command");
  * activity log shows who pulled the plug and why.
  */
 class TasksInterrupt extends base_command_1.BaseCommand {
-    static description = 'Interrupt a running task (posts an interrupt-flagged comment that the agent runtime honors)';
+    static description = 'Request an interrupt for the current run; child runs, queued work and future schedules are unchanged';
     static examples = [
         '<%= config.bin %> tasks interrupt <task-id>',
         '<%= config.bin %> tasks interrupt <task-id> --reason "wrong file"',
@@ -45,7 +45,7 @@ class TasksInterrupt extends base_command_1.BaseCommand {
             return;
         }
         const c = result;
-        this.log(`Interrupt sent to task ${taskRef} (comment ${c.id ?? c._id ?? '?'})`);
+        this.log(`Stop requested for task ${taskRef} (comment ${c.id ?? c._id ?? '?'}). Child runs and schedules are unchanged; inspect run state to confirm it stopped.`);
     }
 }
 exports.default = TasksInterrupt;

package/dist/commands/tasks/pause-schedule.js

@@ -5,7 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const web_url_1 = require("../../lib/web-url");
 class TasksPauseSchedule extends base_command_1.BaseCommand {
-    static description = 'Pause a recurring task — keeps the recurrence definition but stops future fires';
+    static description = 'Pause future recurring runs; current runs and already queued work are unchanged';
     static examples = [
         '<%= config.bin %> tasks pause-schedule <task-id>',
         '<%= config.bin %> tasks pause-schedule <task-id> --json',

package/dist/commands/token/list.d.ts

@@ -12,11 +12,9 @@ import { BaseCommand } from '../../base-command';
  * `GET /api/auth/sessions/refresh` has served exactly this list all along; it
  * was simply not reachable from the CLI.
  *
- * The server returns at most `--limit` rows and says whether it left any out.
- * It used to stop at 100 without saying so, and the session somebody went
- * looking for — an old daemon's, still holding the login a purge refusal named
- * — was exactly the one past the cut (OSK-9980). So a partial list says it is
- * partial, and `--kind daemon` is the short way to the row that matters.
+ * The server returns at most 500 rows per page; this command follows cursors
+ * until its total `--limit` is reached. The default stays at 100. Older servers
+ * without cursors can only return their first page, which is disclosed.
  */
 export default class TokenList extends BaseCommand {
     static description: string;