@skrr-ai/cli 0.1.94 → 0.1.96

package/dist/lib/stewardship-output.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printStewardshipCoverage = printStewardshipCoverage;
+exports.printWorkspaceGrants = printWorkspaceGrants;
+exports.printWorkspaceStewardship = printWorkspaceStewardship;
+const format_1 = require("./format");
+function printStewardshipCoverage(report, log) {
+    if (report.coverage.complete) {
+        log('Coverage: complete within the bounded sources.');
+        return;
+    }
+    log('Coverage: incomplete. Unreadable sources do not confirm absence.');
+    for (const source of report.coverage.sources) {
+        if (source.status === 'unavailable')
+            log(`${source.name}: unavailable`);
+        else if (source.truncated)
+            log(`${source.name}: truncated at 200 rows`);
+    }
+}
+function printWorkspaceGrants(report, log) {
+    printStewardshipCoverage(report, log);
+    printGrantRows(report, log);
+}
+function printGrantRows(report, log) {
+    if (report.grants === null) {
+        log('Grants: unavailable.');
+        return;
+    }
+    if (!report.grants.length) {
+        log('No workspace Grants observed.');
+        return;
+    }
+    (0, format_1.renderTable)(report.grants.map((row) => ({
+        id: row.id,
+        label: row.label,
+        owner: row.ownerUserId,
+        active: row.active ? 'yes' : 'no',
+        expires: row.expiresAt ?? '',
+        envKeys: row.credential?.envKeys.join(', ') ?? '',
+        referencedBy: row.referencedBy === null
+            ? 'unavailable'
+            : `${row.referencedBy.join(', ')}${row.referencesTruncated ? ' (truncated)' : ''}`,
+    })), [
+        { key: 'id', header: 'ID' },
+        { key: 'label', header: 'LABEL' },
+        { key: 'owner', header: 'OWNER' },
+        { key: 'active', header: 'ACTIVE' },
+        { key: 'expires', header: 'EXPIRES' },
+        { key: 'envKeys', header: 'ENV NAMES' },
+        { key: 'referencedBy', header: 'REFERENCED BY' },
+    ], log);
+}
+function printWorkspaceStewardship(report, log) {
+    printStewardshipCoverage(report, log);
+    log(`Membership: ${report.membership.status}${report.membership.role ? ` (${report.membership.role})` : ''}`);
+    for (const [name, rows] of [
+        ['Commitments', report.commitments],
+        ['Approver seats', report.approverSeats],
+    ]) {
+        log(`${name}: ${rows === null ? 'unavailable' : rows.length}`);
+        if (rows?.length)
+            (0, format_1.renderTable)(rows.map((row) => ({
+                id: row.id,
+                title: row.title ?? '',
+                status: row.status ?? '',
+                agentId: row.agentId ?? '',
+            })), [
+                { key: 'id', header: 'ID' },
+                { key: 'title', header: 'TITLE' },
+                { key: 'status', header: 'STATUS' },
+                { key: 'agentId', header: 'EXECUTOR' },
+            ], log);
+    }
+    log(`Authored Agents: ${report.agents === null ? 'unavailable' : report.agents.length}`);
+    if (report.agents?.length)
+        (0, format_1.renderTable)(report.agents.map((row) => ({ id: row.id, name: row.name ?? '' })), [
+            { key: 'id', header: 'ID' },
+            { key: 'name', header: 'NAME' },
+        ], log);
+    log('Grants:');
+    printGrantRows(report, log);
+}

package/dist/lib/task-asset-upload.d.ts

@@ -1,4 +1,4 @@
-import type { WorkResourceKind } from '@skrr-ai/data-provider';
+import type { WorkResourceKind, TaskResourceWriteReceipt } from '@skrr-ai/data-provider';
 export type TaskAssetRole = 'input' | 'evidence' | 'deliverable';
 /**
  * What the bytes ARE in the work ledger, for an upload that is the archived
@@ -24,6 +24,8 @@ export interface TaskAssetLedgerResource {
     expectationIds?: string[];
 }
 export interface UploadedTaskAsset {
+    /** The canonical Task relationship and exact Resource version recorded by this upload. */
+    resourceReceipt?: TaskResourceWriteReceipt;
     id: string;
     /**
      * sha256 (hex) of the bytes the server STORED, as the server recorded them.

package/dist/lib/task-asset-upload.js

@@ -148,6 +148,7 @@ async function uploadTaskAssetFile(opts) {
         filename,
         mimeType,
         deduplicated: result.deduplicated === true,
+        ...(result.resourceReceipt ? { resourceReceipt: result.resourceReceipt } : {}),
     };
 }
 /**

package/dist/lib/task-batch.d.ts

@@ -4,6 +4,7 @@ export type ApiFailure = {
     status?: number;
     code?: string;
     retryable: boolean;
+    requestId?: string;
 };
 /** Normalize a thrown API error (or a per-item batch error) into one shape. */
 export declare function describeApiFailure(err: unknown): ApiFailure;
@@ -39,8 +40,16 @@ export type BatchCreateFailure = {
     key: string;
     /** Not attempted because its parent was not created (or an earlier chunk failed). */
     skipped: boolean;
+    /** Unknown is submitted, not equivalent to not_attempted. */
+    outcome?: 'unknown' | 'not_attempted' | 'failed';
+    externalKey?: string;
     error: ApiFailure;
 };
+/** A lost response is not a lost write. Only READ here; never retry a write. */
+export declare function reconcileSubmittedNodes(nodes: BatchCreateNode[], mapping: Record<string, string>, error: ApiFailure, deadlineAt?: number): Promise<{
+    rows: BatchCreatedRow[];
+    failures: BatchCreateFailure[];
+}>;
 export type BatchCreateOutcome = {
     supported: false;
 } | {

package/dist/lib/task-batch.js

@@ -4,6 +4,7 @@ exports.describeApiFailure = describeApiFailure;
 exports.isBatchRouteMissing = isBatchRouteMissing;
 exports.chunkItems = chunkItems;
 exports.batchIdempotencyKey = batchIdempotencyKey;
+exports.reconcileSubmittedNodes = reconcileSubmittedNodes;
 exports.createNodesViaBatch = createNodesViaBatch;
 exports.patchTasksViaBatch = patchTasksViaBatch;
 /**
@@ -17,9 +18,10 @@ exports.patchTasksViaBatch = patchTasksViaBatch;
  */
 const node_crypto_1 = require("node:crypto");
 const data_provider_1 = require("@skrr-ai/data-provider");
+const tasks_1 = require("./tasks");
 /** Normalize a thrown API error (or a per-item batch error) into one shape. */
 function describeApiFailure(err) {
-    const e = err;
+    const e = (err ?? {});
     let code = e.code;
     let message = e.message ?? String(err);
     if (e.body) {
@@ -37,7 +39,8 @@ function describeApiFailure(err) {
         message,
         ...(status ? { status } : {}),
         ...(code ? { code } : {}),
-        retryable: status === 408 || status === 425 || status === 429 || (status ?? 0) >= 500,
+        ...(e.requestId ? { requestId: e.requestId } : {}),
+        retryable: !status || status === 408 || status === 425 || status === 429 || (status ?? 0) >= 500,
     };
 }
 /**
@@ -66,6 +69,52 @@ function batchIdempotencyKey(kind, items) {
     const digest = (0, node_crypto_1.createHash)('sha256').update((0, data_provider_1.stableJson)(items)).digest('hex').slice(0, 40);
     return `cli-${kind}-batch:${digest}`;
 }
+/** A lost response is not a lost write. Only READ here; never retry a write. */
+async function reconcileSubmittedNodes(nodes, mapping, error, deadlineAt = Date.now() + 5000) {
+    const rows = [];
+    const failures = [];
+    // Limit simultaneous reads: a 100-item batch must not become 100 connections.
+    for (const group of chunkItems(nodes, 4)) {
+        await Promise.all(group.map(async (node) => {
+            const externalKey = typeof node.payload.externalKey === 'string' ? node.payload.externalKey : undefined;
+            if (externalKey && Date.now() < deadlineAt) {
+                let timer;
+                try {
+                    const read = (0, tasks_1.findTaskByExternalKey)({
+                        externalKey, spaceId: node.payload.spaceId, goalId: node.payload.goalId,
+                    });
+                    const existing = await Promise.race([read, new Promise((resolve) => {
+                            timer = setTimeout(() => resolve(null), Math.max(1, deadlineAt - Date.now()));
+                        })]);
+                    if (existing?.task?.externalKey === externalKey && (0, tasks_1.taskId)(existing.task)) {
+                        const id = (0, tasks_1.taskId)(existing.task);
+                        mapping[node.key] = id;
+                        rows.push({ key: node.key, id, status: 'exists', externalKey,
+                            ...(typeof existing.task.identifier === 'string' ? { identifier: existing.task.identifier } : {}),
+                        });
+                        return;
+                    }
+                }
+                catch { /* A failed read does not prove the write failed. */ }
+                finally {
+                    clearTimeout(timer);
+                }
+            }
+            failures.push({ key: node.key, skipped: false, outcome: 'unknown',
+                ...(externalKey ? { externalKey } : {}),
+                error: { ...error, code: 'BATCH_OUTCOME_UNKNOWN', retryable: Boolean(externalKey),
+                    message: `The result for "${node.key}" is unknown. ` +
+                        (externalKey ? `No committed task was confirmed by external key "${externalKey}"; the original write may still finish. Re-run the same keyed tree to reconcile and resume.` :
+                            'This node has no stable external key. Inspect the Space before another write; do not re-run --fresh blindly.'),
+                },
+            });
+        }));
+    }
+    const position = new Map(nodes.map((n, i) => [n.key, i]));
+    rows.sort((a, b) => position.get(a.key) - position.get(b.key));
+    failures.sort((a, b) => position.get(a.key) - position.get(b.key));
+    return { rows, failures };
+}
 /**
  * Create `nodes` (parents before children) in chunks. `mapping` holds key -> id
  * for nodes that already exist and is extended in place. Stops after the first
@@ -117,25 +166,45 @@ async function createNodesViaBatch(nodes, mapping) {
         catch (err) {
             if (chunkIndex === 0 && isBatchRouteMissing(err))
                 return { supported: false };
-            failures.push({ key: sent[0].key, skipped: false, error: describeApiFailure(err) });
-            for (const node of sent.slice(1)) {
-                failures.push({
-                    key: node.key,
-                    skipped: true,
-                    error: {
-                        message: `Not attempted: the batch request containing "${sent[0].key}" failed`,
-                        code: 'BATCH_NOT_ATTEMPTED',
-                        retryable: true,
-                    },
-                });
+            const error = describeApiFailure(err);
+            const uncertain = !error.status || error.status === 408 || error.status >= 500 || error.code === 'IDEMPOTENCY_IN_PROGRESS';
+            if (uncertain) {
+                const recovered = await reconcileSubmittedNodes(sent, mapping, error);
+                rows.push(...recovered.rows);
+                failures.push(...recovered.failures);
+                // Even a fully reconciled chunk stops here: no extra write follows a
+                // lost response during this run. Later chunks are explicitly unstarted.
+                const remaining = nodes.slice((chunkIndex + 1) * (data_provider_1.TASK_BATCH_MAX_ITEMS ?? 100));
+                for (const node of remaining)
+                    failures.push({ key: node.key, skipped: true,
+                        outcome: 'not_attempted', externalKey: node.payload.externalKey,
+                        error: { message: 'Not started after a batch transport failure; resume the same keyed tree.', code: 'BATCH_NOT_ATTEMPTED', retryable: true }, });
+            }
+            else {
+                for (const node of sent)
+                    failures.push({ key: node.key, skipped: false, outcome: 'failed', error });
+                for (const node of nodes.slice((chunkIndex + 1) * (data_provider_1.TASK_BATCH_MAX_ITEMS ?? 100))) {
+                    failures.push({ key: node.key, skipped: true, outcome: 'not_attempted',
+                        error: { message: 'Not started after a batch refusal.', code: 'BATCH_NOT_ATTEMPTED', retryable: true } });
+                }
             }
             break;
         }
         let failed = false;
-        for (const [i, result] of response.results.entries()) {
-            const node = sent[i];
-            if (!node)
+        const reconciliationDeadlineAt = Date.now() + 5000;
+        for (const [i, node] of sent.entries()) {
+            const result = response.results?.find((r) => r.index === i);
+            if (!result || result.status === 'pending' || (result.ok && !result.id) || (result.error?.status ?? 0) >= 500) {
+                const recovered = await reconcileSubmittedNodes([{ ...node, payload: {
+                            ...node.payload, ...(result?.externalKey ? { externalKey: result.externalKey } : {}),
+                        } }], mapping, {
+                    message: 'Batch did not confirm this submitted write', code: 'BATCH_OUTCOME_UNKNOWN', retryable: true,
+                }, reconciliationDeadlineAt);
+                rows.push(...recovered.rows);
+                failures.push(...recovered.failures);
+                failed = true;
                 continue;
+            }
             if (result.ok && result.id) {
                 mapping[node.key] = result.id;
                 rows.push({
@@ -151,6 +220,8 @@ async function createNodesViaBatch(nodes, mapping) {
                 failures.push({
                     key: node.key,
                     skipped: result.status === 'skipped',
+                    outcome: result.status === 'skipped' ? 'not_attempted' : 'failed',
+                    ...(result.externalKey ? { externalKey: result.externalKey } : {}),
                     error: result.error
                         ? {
                             message: result.error.message,
@@ -162,8 +233,14 @@ async function createNodesViaBatch(nodes, mapping) {
                 });
             }
         }
-        if (failed)
+        if (failed) {
+            for (const node of nodes.slice((chunkIndex + 1) * (data_provider_1.TASK_BATCH_MAX_ITEMS ?? 100))) {
+                failures.push({ key: node.key, skipped: true, outcome: 'not_attempted',
+                    externalKey: node.payload.externalKey,
+                    error: { message: 'Not started after an incomplete batch; resume the same keyed tree.', code: 'BATCH_NOT_ATTEMPTED', retryable: true }, });
+            }
             break;
+        }
     }
     return { supported: true, rows, failures };
 }

package/dist/lib/task-economics.d.ts

@@ -0,0 +1,16 @@
+export declare function economicsFromFlags(flags: {
+    savings?: string;
+    per?: string;
+    effort?: string;
+    risk?: string;
+}, existing?: unknown): {
+    savings?: {
+        amount: number;
+        currency: "USD";
+        per: "month" | "year" | "once";
+    } | undefined;
+    effortHours?: number | undefined;
+    risk?: "low" | "medium" | "high" | undefined;
+    confidence?: "low" | "medium" | "high" | undefined;
+    rationale?: string | undefined;
+} | undefined;

package/dist/lib/task-economics.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.economicsFromFlags = economicsFromFlags;
+const data_provider_1 = require("@skrr-ai/data-provider");
+function economicsFromFlags(flags, existing) {
+    if ([flags.savings, flags.per, flags.effort, flags.risk].every((value) => value === undefined))
+        return undefined;
+    if ((flags.savings === undefined) !== (flags.per === undefined))
+        throw new Error('--savings and --per must be supplied together (USD/month, year or once).');
+    for (const value of [flags.savings, flags.effort])
+        if (value !== undefined && value.trim() === '')
+            throw new Error('Economic amounts must be explicit nonnegative numbers.');
+    const content = existing && typeof existing === 'object' ? existing : {};
+    return data_provider_1.ProposalEconomicsInputSchema.parse({
+        ...content,
+        ...(flags.savings !== undefined
+            ? { savings: { amount: Number(flags.savings), currency: 'USD', per: flags.per } }
+            : {}),
+        ...(flags.effort !== undefined ? { effortHours: Number(flags.effort) } : {}),
+        ...(flags.risk !== undefined ? { risk: flags.risk } : {}),
+    });
+}

package/dist/lib/task-instruction-offer.d.ts

@@ -1,5 +1,2 @@
-/**
- * Best-effort contextual activation after a human successfully uses a task
- * command. It must never change the task command's exit status.
- */
+/** Task creation and login share the same machine-bound, provider-scoped offer. */
 export declare function maybeOfferTaskManagementInstructions(log: (message: string) => void): Promise<void>;

package/dist/lib/task-instruction-offer.js

@@ -1,134 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.maybeOfferTaskManagementInstructions = maybeOfferTaskManagementInstructions;
-const auth_core_1 = require("@skrr-ai/auth-core");
-const data_provider_1 = require("@skrr-ai/data-provider");
-const config_1 = require("./config");
-const daemon_target_1 = require("./daemon-target");
-const prompt_1 = require("./prompt");
-const TEMPLATE_KEY = 'oversky-task-management';
-function capabilitiesOf(daemon) {
-    if (Array.isArray(daemon.capabilities))
-        return daemon.capabilities.map(String);
-    if (typeof daemon.capabilities !== 'string')
-        return [];
-    try {
-        const parsed = JSON.parse(daemon.capabilities);
-        if (Array.isArray(parsed))
-            return parsed.map(String);
-    }
-    catch {
-        // Older daemon rows used comma-separated capabilities.
-    }
-    return daemon.capabilities
-        .split(',')
-        .map((capability) => capability.trim())
-        .filter(Boolean);
-}
-function detectedProviders(daemon) {
-    const capabilities = capabilitiesOf(daemon);
-    const providers = [];
-    if (capabilities.includes('claude_session'))
-        providers.push('claude');
-    if (capabilities.includes('codex_session'))
-        providers.push('codex');
-    // A daemon advertises the first-party harness under whichever spelling its
-    // version speaks; any of them means the harness is there, and the offer names
-    // it canonically, which is what the server stores.
-    if (capabilities.some(auth_core_1.isFirstPartyHarnessCapability))
-        providers.push(auth_core_1.FIRST_PARTY_HARNESS_PROVIDER);
-    return providers;
-}
-function providerLabel(provider) {
-    if (provider === 'claude')
-        return 'Claude Code';
-    if (provider === 'codex')
-        return 'Codex';
-    return auth_core_1.FIRST_PARTY_HARNESS.displayName;
-}
-function providerPath(provider) {
-    if (provider === 'claude')
-        return '~/.claude/CLAUDE.md';
-    if (provider === 'codex')
-        return '~/.codex/AGENTS.md';
-    // The engine home follows the ENGINE's namespace, not the provider slug — the
-    // engine reads its managed `AGENTS.md` from there (contract §5).
-    return `~/.skrr/${(0, auth_core_1.firstPartyHarnessHomeDirname)()}/AGENTS.md`;
-}
-function shouldSkipOffer() {
-    return Boolean(!process.stdin.isTTY ||
-        !process.stdout.isTTY ||
-        process.env.CI ||
-        process.env.OVERSKY_HEADLESS ||
-        process.env.OVERSKY_SESSION_TASK_ID ||
-        process.env.OVERSKY_SESSION_AGENT_ID ||
-        process.env.OVERSKY_DISABLE_INSTRUCTION_OFFER === '1');
-}
-/**
- * Best-effort contextual activation after a human successfully uses a task
- * command. It must never change the task command's exit status.
- */
+const managed_instruction_setup_1 = require("./managed-instruction-setup");
+/** Task creation and login share the same machine-bound, provider-scoped offer. */
 async function maybeOfferTaskManagementInstructions(log) {
-    if (shouldSkipOffer())
-        return;
-    try {
-        // The offer speaks of "this machine", so on a Dedicated Runtime guest only the
-        // guest's own daemon may be the candidate — never the first eligible row of the
-        // account, which is the owner's laptop (OSK-8759). A guest whose daemon has
-        // published no id gets no candidate. Off a guest nothing is read here and the
-        // search below is unchanged.
-        const local = (0, daemon_target_1.localMachine)({ baseURL: (0, config_1.loadConfig)().baseURL });
-        if (local.dedicatedRuntime && !local.daemonId)
-            return;
-        const [daemons, offerResponse] = await Promise.all([
-            data_provider_1.dataService.getDaemons(),
-            data_provider_1.dataService.getManagedInstructionOffer(TEMPLATE_KEY),
-        ]);
-        const candidate = daemons.active.find((daemon) => {
-            if (local.dedicatedRuntime && daemon.daemonId !== local.daemonId)
-                return false;
-            if (!detectedProviders(daemon).length)
-                return false;
-            return offerResponse.offers.find((offer) => offer.daemonId === daemon.daemonId)?.eligible;
-        });
-        if (!candidate)
-            return;
-        const providers = detectedProviders(candidate);
-        const labels = providers.map(providerLabel).join(' and ');
-        log('');
-        log(`Let ${labels} manage skrr tasks automatically?`);
-        log('skrr will add a removable managed block to the user-level agent files on this machine.');
-        log('Type v to review the exact instruction, y to install and keep it updated, or press Enter for not now.');
-        const answer = (await (0, prompt_1.prompt)('Install task-management instructions? [y/N/v] ')).toLowerCase();
-        let accepted = answer === 'y' || answer === 'yes';
-        if (answer === 'v' || answer === 'view') {
-            log('');
-            log('--- exact managed instruction ---');
-            log(offerResponse.preset.body);
-            log('--- end instruction ---');
-            log('');
-            log('Targets:');
-            for (const provider of providers) {
-                log(`- ${providerLabel(provider)}: ${providerPath(provider)}`);
-            }
-            accepted = await (0, prompt_1.confirm)('Install this instruction and keep it updated?', true);
-        }
-        if (!accepted) {
-            await data_provider_1.dataService.respondManagedInstructionOffer(TEMPLATE_KEY, {
-                daemonId: candidate.daemonId,
-                action: 'snooze',
-            });
-            log('Not now. skrr will not ask again for 14 days.');
-            return;
-        }
-        await data_provider_1.dataService.acceptManagedInstructionOffer(TEMPLATE_KEY, {
-            daemonId: candidate.daemonId,
-            providers,
-        });
-        log(`Installation queued for ${labels}; check Settings for confirmed file status.`);
-    }
-    catch {
-        // A discovery nudge must never turn a successful task operation into a
-        // failed command. Settings remains the durable recovery/control surface.
-    }
+    await (0, managed_instruction_setup_1.maybeOfferManagedInstructionSetup)({ log, trigger: 'task' });
 }

package/dist/lib/triggers.d.ts

@@ -1,4 +1,4 @@
-import { type EmbeddedActionRef, type TriggerPreflightReport } from '@skrr-ai/data-provider';
+import { type EmbeddedActionRef, type TriggerPreflightReport, type TriggerSensorConfig } from '@skrr-ai/data-provider';
 export declare const TRIGGER_KINDS: readonly ["schedule", "once", "event", "stochastic", "self_scheduled", "on_demand", "form", "chat_message"];
 export declare const TRIGGER_SCOPE_KINDS: readonly ["agent", "group_chat_subscriber", "space_oracle", "space_subscriber", "key_result_watcher", "task_watcher", "goal_watcher", "entity_reminder"];
 /**
@@ -18,7 +18,7 @@ export declare const TRIGGER_SCOPE_KINDS: readonly ["agent", "group_chat_subscri
  * capability was live and unreachable. `watch_until` and `sensor_poll` had been
  * in that state for longer.
  */
-export declare const TRIGGER_EXECUTOR_MODES: readonly ["send_message", "run_only", "enqueue_group_chat_agent_turn", "enqueue_assistant_turn", "enqueue_space_assistant_turn", "proactive_orchestrator_check", "auto_dream_orchestrator", "task_schedule_fire", "goal_planner_tick", "morning_briefing", "builtin_action", "task_execute", "watch_until", "sensor_poll", "external_work_task", "notify_user", "space_cycle_rollover"];
+export declare const TRIGGER_EXECUTOR_MODES: readonly ["send_message", "run_only", "enqueue_group_chat_agent_turn", "enqueue_assistant_turn", "enqueue_space_assistant_turn", "proactive_orchestrator_check", "auto_dream_orchestrator", "task_schedule_fire", "goal_planner_tick", "morning_briefing", "builtin_action", "task_execute", "watch_until", "sensor_poll", "external_work_task", "notify_user", "space_cycle_rollover", "workflow_signal"];
 export declare const TRIGGER_EVENT_FILTER_MODES: readonly ["equals", "contains", "in_set"];
 export declare const TRIGGER_CONCURRENCY_POLICIES: readonly ["coalesce_if_active", "allow_parallel"];
 export declare const TRIGGER_FORM_RESPONSE_MODES: readonly ["thank_you_page", "redirect_url", "run_complete"];
@@ -85,7 +85,9 @@ export interface TriggerDefinition {
         kind?: string;
         refs?: Record<string, unknown>;
     };
-    execution?: Record<string, unknown>;
+    execution?: Record<string, unknown> & {
+        sensor?: TriggerSensorConfig;
+    };
     schedule?: Record<string, unknown>;
     once?: Record<string, unknown>;
     event?: Record<string, unknown>;
@@ -341,6 +343,12 @@ export declare function nextRunLabel(trigger: TriggerDefinition): string;
  *     (OSK-7711).
  */
 export declare function armedLabel(trigger: TriggerDefinition): string;
+/**
+ * A keyed sensor that is still ENABLED but degraded (an item has failed for
+ * dozens of polls) reads `yes` in ARMED, which is true and not the whole story.
+ * Marked here so the list says it, not only `triggers show`.
+ */
+export declare function degradedMarker(trigger: TriggerDefinition): string;
 export declare function renderTriggerList(triggers: TriggerDefinition[], log: (line: string) => void): void;
 /**
  * The `duplicate_subscription` warning a create response may carry, as the

package/dist/lib/triggers.js

@@ -29,6 +29,7 @@ exports.fetchAgentScopedTrigger = fetchAgentScopedTrigger;
 exports.scopeLabel = scopeLabel;
 exports.nextRunLabel = nextRunLabel;
 exports.armedLabel = armedLabel;
+exports.degradedMarker = degradedMarker;
 exports.renderTriggerList = renderTriggerList;
 exports.formatDuplicateSubscriptionWarning = formatDuplicateSubscriptionWarning;
 exports.armedStateLabel = armedStateLabel;
@@ -99,6 +100,9 @@ exports.TRIGGER_EXECUTOR_MODES = [
     'external_work_task',
     'notify_user',
     'space_cycle_rollover',
+    // Resolve a workflow step an agent parked with `workflow_await`, when this
+    // trigger's event arrives. Needs `--workflow-event-key`.
+    'workflow_signal',
 ];
 exports.TRIGGER_EVENT_FILTER_MODES = ['equals', 'contains', 'in_set'];
 exports.TRIGGER_CONCURRENCY_POLICIES = ['coalesce_if_active', 'allow_parallel'];
@@ -748,6 +752,15 @@ function armedLabel(trigger) {
     }
     return 'yes';
 }
+/**
+ * A keyed sensor that is still ENABLED but degraded (an item has failed for
+ * dozens of polls) reads `yes` in ARMED, which is true and not the whole story.
+ * Marked here so the list says it, not only `triggers show`.
+ */
+function degradedMarker(trigger) {
+    const reason = trigger.execution?.sensor?.state?.degradedReason;
+    return reason ? ' (degraded)' : '';
+}
 function renderTriggerList(triggers, log) {
     if (triggers.length === 0) {
         log('No triggers.');
@@ -756,7 +769,7 @@ function renderTriggerList(triggers, log) {
     (0, format_1.renderTable)(triggers.map((trigger) => ({
         id: trigger.id ?? '-',
         kind: trigger.kind ?? '-',
-        enabled: armedLabel(trigger),
+        enabled: `${armedLabel(trigger)}${degradedMarker(trigger)}`,
         scope: scopeLabel(trigger),
         next: nextRunLabel(trigger),
         label: trigger.label ?? '',
@@ -768,6 +781,12 @@ function renderTriggerList(triggers, log) {
         { key: 'next', header: 'NEXT/LAST', maxWidth: 24 },
         { key: 'label', header: 'LABEL', maxWidth: 32 },
     ], log);
+    const degraded = triggers.filter((t) => degradedMarker(t));
+    if (degraded.length > 0) {
+        log('');
+        log(`${degraded.length} trigger(s) are enabled but degraded — ` +
+            'see `Degraded:` in `triggers show <id>`.');
+    }
     const unsynced = triggers.filter((t) => armedLabel(t).startsWith('!'));
     if (unsynced.length > 0) {
         log('');
@@ -872,6 +891,44 @@ function renderTriggerSummary(trigger, log, options = {}) {
         log(`Label:    ${trigger.label}`);
     if (trigger.execution?.mode)
         log(`Mode:     ${String(trigger.execution.mode)}`);
+    const sensor = trigger.execution?.mode === 'sensor_poll' ? trigger.execution.sensor : undefined;
+    if (sensor?.measureSink) {
+        log(`Measure:  ${sensor.measureSink.measureId} — platform fetched, unconfirmed`);
+        if (sensor.state?.lastSinkError)
+            log(`Sink:     ${sensor.state.lastSinkError}`);
+        else if (sensor.state?.lastSinkAt)
+            log(`Sink:     last reading ${sensor.state.lastSinkValue ?? '-'} at ${sensor.state.lastSinkAt}`);
+        else
+            log('Sink:     awaiting a numeric reading');
+    }
+    // A keyed sensor can be quietly blind (items held back, unreadable, failing).
+    // Each count is printed, and zero is printed too: "0" and "absent" must read
+    // differently from a sensor that has never been counted.
+    if (sensor?.cursor?.mode === 'keyed' && sensor.state) {
+        const st = sensor.state;
+        const n = (v) => v ?? 0;
+        log(`Keyed:    deferred ${n(st.deferredCount)}, unreadable ${n(st.unreadableCount)}, failed ${n(st.failedItemCount)}, quarantined ${n(st.quarantinedCount)}, duplicates ${n(st.duplicateCount)}, unsubjected ${n(st.unsubjectedCount)} (cumulative)`);
+    }
+    if (sensor?.cursor?.mode === 'keyed' && sensor.state) {
+        const st = sensor.state;
+        // A reseed publishes nothing by design, so it is the one change nothing
+        // else records: say when it happened, why, and how often.
+        if (st.reseededAt) {
+            const why = st.reseededReason
+                ? (data_provider_1.KEYED_RESEED_COPY[st.reseededReason] ?? st.reseededReason)
+                : 'reason not recorded';
+            log(`Reseeded: ${st.reseededAt} (${st.reseededReason ?? 'unknown'}: ${why}); ${st.reseedCount ?? 1} time(s); nothing was published for it`);
+        }
+        if (st.itemFailurePolls)
+            log(`Items:    failing for ${st.itemFailurePolls} poll(s) in a row`);
+    }
+    // The sensor is degraded, not just carrying a line of text: say it first.
+    if (sensor?.state?.degradedReason)
+        log(`Degraded: ${sensor.state.degradedReason}`);
+    if (sensor?.state?.consecutiveErrors)
+        log(`Errors:   ${sensor.state.consecutiveErrors} feed failure(s) in a row (the sensor disables itself if the feed keeps failing)`);
+    if (sensor?.state?.lastError)
+        log(`Problem:  ${sensor.state.lastError}`);
     // An `external_work_task` writes into someone else's system, and which
     // contract governs that write — and whether it posts by itself — was readable
     // only by pulling `execution.effectPolicy` out of raw JSON. A trigger that can