@skrr-ai/cli 0.1.94 → 0.1.96

package/dist/commands/agents/egress.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+class AgentsEgress extends base_command_1.BaseCommand {
+    static description = 'Show or declare the exact hosts and repositories a hosted agent may use on its next start';
+    static args = { id: core_1.Args.string({ required: true, ignoreStdin: true }) };
+    static flags = {
+        allow: core_1.Flags.string({ multiple: true, exclusive: ['clear'] }),
+        remove: core_1.Flags.string({ multiple: true, exclusive: ['clear'] }),
+        repo: core_1.Flags.string({
+            multiple: true,
+            exclusive: ['clear'],
+            description: 'Allow a repository (owner/name) for Hosted Jobs',
+        }),
+        'remove-repo': core_1.Flags.string({ multiple: true, exclusive: ['clear'] }),
+        reason: core_1.Flags.string({ exclusive: ['clear'] }),
+        clear: core_1.Flags.boolean({
+            exclusive: ['allow', 'remove', 'repo', 'remove-repo', 'reason'],
+            description: 'Delete the whole declaration: hosts and repositories',
+        }),
+        json: core_1.Flags.boolean(),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsEgress);
+        try {
+            let result = await data_provider_1.dataService.getAgentEgress(args.id);
+            if (flags.clear)
+                result = await data_provider_1.dataService.clearAgentEgress(args.id);
+            else if (flags.allow ||
+                flags.remove ||
+                flags.repo ||
+                flags['remove-repo'] ||
+                flags.reason !== undefined) {
+                const remove = new Set((0, data_provider_1.normalizeAgentEgressHosts)(flags.remove || []));
+                const hosts = (0, data_provider_1.normalizeAgentEgressHosts)([
+                    ...(result.declaration?.hosts || []),
+                    ...(flags.allow || []),
+                ]).filter((host) => !remove.has(host));
+                // Repositories are sent only when this call changes them, so a hosts-only
+                // edit can never rewrite a list another surface set.
+                const touchesRepositories = Boolean(flags.repo || flags['remove-repo']);
+                const removeRepos = new Set((0, data_provider_1.normalizeAgentRepositories)(flags['remove-repo'] || []));
+                const repositories = touchesRepositories
+                    ? (0, data_provider_1.normalizeAgentRepositories)([
+                        ...(result.declaration?.repositories || []),
+                        ...(flags.repo || []),
+                    ]).filter((repository) => !removeRepos.has(repository))
+                    : undefined;
+                result = await data_provider_1.dataService.setAgentEgress(args.id, {
+                    hosts,
+                    ...(repositories ? { repositories } : {}),
+                    ...(flags.reason !== undefined ? { reason: flags.reason } : {}),
+                });
+            }
+            if (flags.json) {
+                this.log(JSON.stringify(result, null, 2));
+                return;
+            }
+            const repositories = result.declaration?.repositories;
+            this.log(repositories?.length
+                ? `Repositories: ${repositories.join(', ')} (Hosted Jobs and Commitment deliveries may use only these; git_commit push is not enabled in production turns and, when enabled, is bounded by them too; raw git in a shell is not limited by it)`
+                : 'Repositories: none declared (no restriction)');
+            if (!('policy' in result.effective)) {
+                this.log('Effective network unavailable: the workspace policy could not be read.');
+                this.log(data_provider_1.AGENT_EGRESS_EXPLANATION);
+                return;
+            }
+            this.log(`Network: ${result.effective.policy} (${result.effective.source}; ${result.effective.hosts.length} hosts)`);
+            this.log(result.effective.hosts.join(', '));
+            if (result.effective.droppedHosts.length)
+                this.log(`Workspace policy dropped: ${result.effective.droppedHosts.join(', ')}`);
+            if (result.effective.unreadable)
+                this.log('Declaration or ceiling unreadable: baseline only.');
+            this.log(data_provider_1.AGENT_EGRESS_EXPLANATION);
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+}
+exports.default = AgentsEgress;

package/dist/commands/agents/mailbox/messages.d.ts

@@ -0,0 +1,14 @@
+import { MailboxHumanCommand } from '../../../lib/mailbox-human-command';
+export default class AgentsMailboxMessages extends MailboxHumanCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        cursor: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/mailbox/messages.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const mailbox_human_command_1 = require("../../../lib/mailbox-human-command");
+const agent_mailbox_1 = require("../../../lib/agent-mailbox");
+class AgentsMailboxMessages extends mailbox_human_command_1.MailboxHumanCommand {
+    static description = 'List received mailbox message metadata (human operator only; view content in agent settings)';
+    static examples = [
+        '<%= config.bin %> agents mailbox messages <agent-id> --json',
+        '<%= config.bin %> agents mailbox messages <agent-id> --limit 25 --cursor <cursor>',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Agent ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output message metadata and nextCursor as JSON' }),
+        limit: core_1.Flags.integer({
+            description: 'Messages per page (1–100)',
+            default: 25,
+            min: 1,
+            max: 100,
+        }),
+        cursor: core_1.Flags.string({ description: 'Opaque nextCursor from a previous page' }),
+    };
+    async run() {
+        this.requireHumanMailboxAuth();
+        const { args, flags } = await this.parse(AgentsMailboxMessages);
+        let result;
+        try {
+            result = await (0, agent_mailbox_1.getAgentMailboxMessageMetadata)(args.id, {
+                limit: flags.limit,
+                cursor: flags.cursor,
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        if (result.data.length === 0)
+            this.log('No received messages on this page.');
+        for (const message of result.data) {
+            this.log(`${message.id}  ${message.receivedAt}  ${message.classification}  ${message.status}`);
+        }
+        if (result.nextCursor)
+            this.log(`Next cursor: ${result.nextCursor}`);
+        this.log('Read mail content in the mailbox tab in agent settings.');
+    }
+}
+exports.default = AgentsMailboxMessages;

package/dist/commands/agents/mailbox/show.d.ts

@@ -0,0 +1,13 @@
+import { MailboxHumanCommand } from '../../../lib/mailbox-human-command';
+export default class AgentsMailboxShow extends MailboxHumanCommand {
+    static description: string;
+    static aliases: string[];
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/mailbox/show.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const mailbox_human_command_1 = require("../../../lib/mailbox-human-command");
+const agent_mailbox_1 = require("../../../lib/agent-mailbox");
+class AgentsMailboxShow extends mailbox_human_command_1.MailboxHumanCommand {
+    static description = "Show an agent's mailbox status and address (human operator only)";
+    static aliases = ['agents:mailbox:status'];
+    static examples = [
+        '<%= config.bin %> agents mailbox show <agent-id>',
+        '<%= config.bin %> agents mailbox status <agent-id> --json',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Agent ID', required: true, ignoreStdin: true }),
+    };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output metadata as JSON' }) };
+    async run() {
+        this.requireHumanMailboxAuth();
+        const { args, flags } = await this.parse(AgentsMailboxShow);
+        let result;
+        try {
+            result = await (0, agent_mailbox_1.getAgentMailboxMetadata)(args.id);
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const receiving = result.receivingRuntime?.status;
+        this.log(receiving === 'running'
+            ? 'Incoming processing: running (DNS and SMTP delivery are not verified by this command).'
+            : receiving === 'starting'
+                ? 'Incoming processing: starting. Refresh before using a recovery address.'
+                : receiving === 'unavailable'
+                    ? 'Incoming processing: unavailable. Do not use this address for account recovery until receiving is restored.'
+                    : 'Incoming processing: unverified. Refresh before using a recovery address.');
+        if (!result.mailbox) {
+            this.log('No mailbox provisioned. Configure the mailbox in the agent settings.');
+            return;
+        }
+        this.log(`Address: ${result.mailbox.address}`);
+        this.log(`Address lifecycle: ${result.mailbox.status}`);
+        this.log(`Sending: ${result.mailbox.sending}`);
+        if (result.mailbox.sendingPausedReason) {
+            this.log(`Sending paused: ${result.mailbox.sendingPausedReason}`);
+        }
+        this.log(`Version: ${result.mailbox.version}`);
+    }
+}
+exports.default = AgentsMailboxShow;

package/dist/commands/agents/operating-plan.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const data_provider_1 = require("@skrr-ai/data-provider");
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const roles_1 = require("../../lib/roles");
@@ -26,6 +27,13 @@ class AgentOperatingPlan extends base_command_1.BaseCommand {
                 this.log(`  Responsibility: ${r.purpose}`);
                 this.log(`  Evidence: ${r.evidence.status}${r.evidence.issues?.length ? ` (${r.evidence.issues.join(', ')})` : ''}`);
                 this.log("  Execution authority: tools, sandbox and approvals use the Agent's runtime permissions.");
+                for (const observation of r.evidenceAuthority?.observations || []) {
+                    const comparison = (0, data_provider_1.describeObservationChange)({
+                        ...observation.serverComparison,
+                        changeReason: observation.serverComparison.reason,
+                    });
+                    this.log(`  Observation: ${observation.key} — ${comparison.reason}${comparison.progress ? ` ${comparison.progress}` : ''}${comparison.reference ? `; ${comparison.reference}` : ''} (AGENT-REPORTED)`);
+                }
                 for (const q of r.inquiries)
                     this.log(`  Inquiry: ${q.question} [${q.status}] — ${q.decisionImpact}`);
                 for (const w of r.work)

package/dist/commands/agents/roles/capture.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../../../base-command';
+export default class RolesCapture extends BaseCommand {
+    static description: string;
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        key: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        title: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        commitment: import("@oclif/core/lib/interfaces").OptionFlag<string[], import("@oclif/core/lib/interfaces").CustomOptions>;
+        compass: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        output: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/roles/capture.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const node_fs_1 = require("node:fs");
+const base_command_1 = require("../../../base-command");
+const roles_1 = require("../../../lib/roles");
+class RolesCapture extends base_command_1.BaseCommand {
+    static description = 'Capture selected owner responsibilities as a portable role draft with explicit omissions';
+    static args = {
+        id: core_1.Args.string({ required: true, ignoreStdin: true, description: 'Agent ID' }),
+    };
+    static flags = {
+        key: core_1.Flags.string({ required: true, description: 'Portable role key' }),
+        title: core_1.Flags.string({ required: true, description: 'Role title' }),
+        commitment: core_1.Flags.string({
+            required: true,
+            multiple: true,
+            description: 'Responsibility ID (repeat for each)',
+        }),
+        compass: core_1.Flags.string({ description: 'Compass to capture' }),
+        output: core_1.Flags.string({ description: 'Save portable spec JSON for review' }),
+        json: core_1.Flags.boolean({ description: 'Output draft and omissions as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(RolesCapture);
+        try {
+            const result = await roles_1.roleApi.capture(args.id, {
+                key: flags.key,
+                title: flags.title,
+                commitmentIds: flags.commitment,
+                ...(flags.compass ? { compassId: flags.compass } : {}),
+            });
+            if (flags.output)
+                (0, node_fs_1.writeFileSync)(flags.output, `${JSON.stringify(result.spec, null, 2)}\n`, { mode: 0o600 });
+            if (flags.json) {
+                this.log(JSON.stringify(result, null, 2));
+                return;
+            }
+            this.log(`Captured ${result.spec.title}; review before installation.`);
+            for (const omission of result.omitted)
+                this.log(`Omitted ${omission.responsibilityKey || 'role'}.${omission.field}: ${omission.reason}`);
+            for (const prerequisite of result.prerequisites)
+                this.log(prerequisite);
+            if (flags.output)
+                this.log(`Portable draft saved to ${flags.output}.`);
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+}
+exports.default = RolesCapture;

package/dist/commands/agents/roles/install.d.ts

@@ -6,6 +6,7 @@ export default class RolesInstall extends BaseCommand {
     };
     static flags: {
         preview: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'confirm-rule-conflict': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;

package/dist/commands/agents/roles/install.js

@@ -13,6 +13,10 @@ class RolesInstall extends base_command_1.BaseCommand {
             required: true,
             description: 'Server-generated preview JSON saved by agents roles preview',
         }),
+        'confirm-rule-conflict': core_1.Flags.string({
+            multiple: true,
+            description: 'Rule id the role revision changed or removes and you also edited: overwrite or delete your edit (shown as conflicts_with_owner_edit or removed_owner_edited in the preview)',
+        }),
         json: core_1.Flags.boolean({ description: 'Output the installation receipt as JSON' }),
     };
     async run() {
@@ -21,7 +25,10 @@ class RolesInstall extends base_command_1.BaseCommand {
         try {
             const preview = (0, roles_1.readRoleJson)(flags.preview);
             (0, roles_1.assertRolePreview)(preview);
-            const receipt = await roles_1.roleApi.install(args.id, preview);
+            const confirmed = flags['confirm-rule-conflict'] ?? [];
+            const receipt = confirmed.length
+                ? await roles_1.roleApi.install(args.id, preview, confirmed)
+                : await roles_1.roleApi.install(args.id, preview);
             if (flags.json)
                 this.log(JSON.stringify(receipt, null, 2));
             else {

package/dist/commands/agents/roles/preview.d.ts

@@ -6,6 +6,8 @@ export default class RolesPreview extends BaseCommand {
     };
     static flags: {
         file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        params: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        endpoints: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         bindings: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         output: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/agents/roles/preview.js

@@ -11,7 +11,11 @@ class RolesPreview extends base_command_1.BaseCommand {
     };
     static flags = {
         file: core_1.Flags.string({ required: true, description: 'Role operating spec JSON file' }),
-        bindings: core_1.Flags.string({ description: 'JSON context slot → accessible target ID map' }),
+        params: core_1.Flags.string({ description: 'JSON file of typed parameter values' }),
+        endpoints: core_1.Flags.string({
+            description: 'JSON file of endpoint slot → owned endpoint ID bindings',
+        }),
+        bindings: core_1.Flags.string({ description: 'JSON file of context slot → accessible target ID bindings' }),
         output: core_1.Flags.string({ description: 'Save the server preview for review and installation' }),
         json: core_1.Flags.boolean({ description: 'Output the complete preview as JSON' }),
     };
@@ -19,7 +23,7 @@ class RolesPreview extends base_command_1.BaseCommand {
         this.requireAuth();
         const { args, flags } = await this.parse(RolesPreview);
         try {
-            const result = await roles_1.roleApi.preview(args.id, (0, roles_1.readRoleJson)(flags.file), flags.bindings ? (0, roles_1.readRoleJson)(flags.bindings) : {});
+            const result = await roles_1.roleApi.preview(args.id, (0, roles_1.readRoleJson)(flags.file), flags.bindings ? (0, roles_1.readRoleJson)(flags.bindings) : {}, flags.params ? (0, roles_1.readRoleJson)(flags.params) : {}, flags.endpoints ? (0, roles_1.readRoleJson)(flags.endpoints) : {});
             if (flags.output)
                 (0, node_fs_1.writeFileSync)(flags.output, `${JSON.stringify(result, null, 2)}\n`, { mode: 0o600 });
             if (flags.json) {
@@ -28,8 +32,28 @@ class RolesPreview extends base_command_1.BaseCommand {
             }
             this.log(`${result.spec.title} — revision ${result.spec.revision}`);
             this.log(`Compass ${result.compass.id}: archived; expected version ${result.expectedCompassVersion}`);
-            for (const change of result.changes)
+            for (const change of result.changes) {
                 this.log(`  ${change.title}: ${change.change}`);
+                // Governance is ratified by installing this reviewed preview, so each
+                // owned leaf is shown with what it replaces and whether it loosens.
+                for (const field of change.governance || [])
+                    this.log(`    ${field.path}: ${field.change}${field.ownerModified ? '; owner modified' : ''} — ${JSON.stringify(field.current)} → ${JSON.stringify(field.next)}`);
+            }
+            for (const responsibility of (result.resolvedSpec || result.spec).responsibilities)
+                this.log(`  directive ${responsibility.key}: ${responsibility.directive || '(none)'}`);
+            for (const endpoint of result.endpoints || [])
+                this.log(`  endpoint ${endpoint.label}: ${endpoint.status}`);
+            // Enforced rules the role owns: anything the owner has touched is called out.
+            const ruleAdvice = (rule) => {
+                if (rule.change === 'conflicts_with_owner_edit')
+                    return ` — you edited it and this revision changes it; install with --confirm-rule-conflict ${rule.id} to overwrite your edit`;
+                if (rule.change === 'removed_owner_edited')
+                    return ` — you edited it and this revision removes it; install with --confirm-rule-conflict ${rule.id} to delete it`;
+                return '';
+            };
+            for (const rule of result.ruleChanges || [])
+                if (rule.change !== 'unchanged')
+                    this.log(`  rule ${rule.id}: ${rule.change}${rule.ownerStatus ? ` (owner status: ${rule.ownerStatus})` : ''}${ruleAdvice(rule)}`);
             for (const removed of result.removedResponsibilities)
                 this.log(`  ${removed.key}: pause removed responsibility`);
             for (const ctx of result.contexts)

package/dist/commands/agents/update.d.ts

@@ -45,9 +45,6 @@ export default class AgentsUpdate extends BaseCommand {
         avatar: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'conversation-starter': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'todo-working-hours': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-        'reasoning-tool-escape': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-        'commitment-responsibility': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-        'commitment-responsibility-ceiling': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'max-turns': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'tool-resources': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'install-channel': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/agents/update.js

@@ -116,32 +116,6 @@ class AgentsUpdate extends base_command_1.BaseCommand {
             description: 'When this agent schedules its own work: HH:MM-HH:MM[@<IANA timezone>], e.g. ' +
                 '09:00-18:00@America/Los_Angeles',
         }),
-        // Retired (OSK-11975): a Commitment turn works under the Agent's own
-        // permissions. Hidden, warned on use, and never sent (OSK-12068) — see
-        // `mergeAgentConfigFlags`. Kept parseable so an old script still runs.
-        'reasoning-tool-escape': core_1.Flags.string({
-            description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
-            options: [...agent_config_1.REASONING_TOOL_ESCAPES],
-            multiple: true,
-            deprecated: { message: (0, agent_config_1.retiredCommitmentPermissionFlagMessage)('reasoning-tool-escape') },
-            hidden: true,
-        }),
-        'commitment-responsibility': core_1.Flags.string({
-            description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
-            options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
-            deprecated: {
-                message: (0, agent_config_1.retiredCommitmentPermissionFlagMessage)('commitment-responsibility'),
-            },
-            hidden: true,
-        }),
-        'commitment-responsibility-ceiling': core_1.Flags.string({
-            description: "Retired — has no effect and is not sent. Commitment runs use the agent's own permissions.",
-            options: [...agent_config_1.COMMITMENT_RESPONSIBILITY_LEVELS],
-            deprecated: {
-                message: (0, agent_config_1.retiredCommitmentPermissionFlagMessage)('commitment-responsibility-ceiling'),
-            },
-            hidden: true,
-        }),
         'max-turns': core_1.Flags.integer({ description: 'Maximum turns in one agent run (1-500)' }),
         'tool-resources': core_1.Flags.string({
             description: 'Tool resources JSON object (file_search / context / image_edit bindings)',
@@ -210,11 +184,7 @@ class AgentsUpdate extends base_command_1.BaseCommand {
             this.error(err.message, { exit: 1 });
         }
         if (Object.keys(payload).length === 0) {
-            const retired = agent_config_1.RETIRED_COMMITMENT_PERMISSION_FLAGS.filter((flag) => flags[flag] !== undefined);
-            this.error(retired.length > 0
-                ? `Nothing to update: ${retired.map((flag) => `--${flag}`).join(', ')} ` +
-                    `${retired.length === 1 ? 'is' : 'are'} retired and not sent. ${agent_config_1.COMMITMENT_PERMISSION_FLAG_RETIRED}`
-                : 'Nothing to update. Pass at least one flag (e.g. --name) or --from-json.', { exit: 1 });
+            this.error('Nothing to update. Pass at least one flag (e.g. --name) or --from-json.', { exit: 1 });
         }
         let updated;
         try {

package/dist/commands/agents/usage-cap.d.ts

@@ -1,6 +1,6 @@
 import { BaseCommand } from '../../base-command';
 /**
- * YOUR monthly cap on ONE agent's hosted spend (C11), enforced where each of
+ * YOUR daily and/or monthly cap on ONE agent's hosted spend (C11), enforced where each of
  * your hosted Agent SDK runs of it starts. It counts and bounds only the runs
  * billed to you. For a Store agent, pass your installed copy's id — the cap is
  * on the agent that runs, not on the publisher's listing.
@@ -13,7 +13,10 @@ export default class AgentsUsageCap extends BaseCommand {
     };
     static flags: {
         set: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        daily: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         clear: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'clear-daily': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'clear-monthly': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;

package/dist/commands/agents/usage-cap.js

@@ -4,16 +4,18 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 /**
- * YOUR monthly cap on ONE agent's hosted spend (C11), enforced where each of
+ * YOUR daily and/or monthly cap on ONE agent's hosted spend (C11), enforced where each of
  * your hosted Agent SDK runs of it starts. It counts and bounds only the runs
  * billed to you. For a Store agent, pass your installed copy's id — the cap is
  * on the agent that runs, not on the publisher's listing.
  */
 class AgentsUsageCap extends base_command_1.BaseCommand {
-    static description = 'Show, set or remove your monthly hosted-spend cap on an agent';
+    static description = 'Show, set or remove your daily or monthly hosted-spend cap on an agent';
     static examples = [
         '<%= config.bin %> agents usage-cap <agent-id>',
         '<%= config.bin %> agents usage-cap <agent-id> --set 20',
+        '<%= config.bin %> agents usage-cap <agent-id> --daily 2 --set 20',
+        '<%= config.bin %> agents usage-cap <agent-id> --clear-daily',
         '<%= config.bin %> agents usage-cap <agent-id> --clear --json',
     ];
     static args = {
@@ -26,9 +28,24 @@ class AgentsUsageCap extends base_command_1.BaseCommand {
     static flags = {
         set: core_1.Flags.string({
             description: 'Monthly cap in dollars of usage, e.g. 20 or 12.50',
-            exclusive: ['clear'],
+            exclusive: ['clear', 'clear-monthly'],
+        }),
+        daily: core_1.Flags.string({
+            description: 'Daily hosted cap in dollars (UTC day)',
+            exclusive: ['clear', 'clear-daily'],
+        }),
+        clear: core_1.Flags.boolean({
+            description: 'Remove both caps',
+            exclusive: ['set', 'daily', 'clear-daily', 'clear-monthly'],
+        }),
+        'clear-daily': core_1.Flags.boolean({
+            description: 'Remove only the daily cap (the monthly cap is kept)',
+            exclusive: ['clear', 'daily'],
+        }),
+        'clear-monthly': core_1.Flags.boolean({
+            description: 'Remove only the monthly cap (the daily cap is kept)',
+            exclusive: ['clear', 'set'],
         }),
-        clear: core_1.Flags.boolean({ description: 'Remove the cap', exclusive: ['set'] }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
     };
     async run() {
@@ -43,13 +60,30 @@ class AgentsUsageCap extends base_command_1.BaseCommand {
                 });
             }
         }
+        let dailyMicros = null;
+        if (flags.daily !== undefined) {
+            dailyMicros = (0, data_provider_1.parseAgentUsageCapDollars)(flags.daily);
+            if (dailyMicros === null)
+                this.error('--daily takes a positive amount in dollars, like 20 or 12.50', { exit: 2 });
+        }
         let cap;
         try {
-            cap = flags.clear
-                ? await data_provider_1.dataService.clearAgentUsageCap(args.id)
-                : micros !== null
-                    ? await data_provider_1.dataService.setAgentUsageCap(args.id, { monthlyLimitMicros: micros })
-                    : await data_provider_1.dataService.getAgentUsageCap(args.id);
+            const clearDaily = flags['clear-daily'] === true;
+            const clearMonthly = flags['clear-monthly'] === true;
+            // `null` removes one window on the server; a window not named is untouched.
+            const windows = {
+                ...(micros !== null ? { monthlyLimitMicros: micros } : {}),
+                ...(clearMonthly ? { monthlyLimitMicros: null } : {}),
+                ...(dailyMicros !== null ? { dailyLimitMicros: dailyMicros } : {}),
+                ...(clearDaily ? { dailyLimitMicros: null } : {}),
+            };
+            if (flags.clear)
+                cap = await data_provider_1.dataService.clearAgentUsageCap(args.id);
+            else if (Object.keys(windows).length) {
+                cap = await data_provider_1.dataService.setAgentUsageCap(args.id, windows);
+            }
+            else
+                cap = await data_provider_1.dataService.getAgentUsageCap(args.id);
         }
         catch (err) {
             this.handleApiError(err);
@@ -62,7 +96,10 @@ class AgentsUsageCap extends base_command_1.BaseCommand {
         }
         const resets = String(cap.periodEnd).slice(0, 10);
         if (cap.monthlyLimitMicros === null) {
-            this.log(`Agent ${args.id}: no cap set · ${(0, data_provider_1.formatAgentUsageMicros)(cap.usedMicros)} used by you this month`);
+            // "No cap set" is only true when NEITHER window has one; a daily-only cap
+            // is a cap, and the line below it must not contradict this one.
+            const dailyCapSet = cap.daily?.limitMicros != null;
+            this.log(`Agent ${args.id}: ${dailyCapSet ? 'no monthly cap' : 'no cap set'} · ${(0, data_provider_1.formatAgentUsageMicros)(cap.usedMicros)} used by you this month`);
         }
         else {
             // Figures unclamped: usage past the cap is shown as it is. "Reached" is
@@ -70,6 +107,8 @@ class AgentsUsageCap extends base_command_1.BaseCommand {
             // left can already be too little to start a run.
             this.log(`Agent ${args.id}: ${(0, data_provider_1.formatAgentUsageMicros)(cap.usedMicros)} of ${(0, data_provider_1.formatAgentUsageMicros)(cap.monthlyLimitMicros)} used by you this month (resets ${resets})${cap.exhausted ? ' — cap reached, your new runs are refused' : ''}`);
         }
+        if (cap.daily)
+            this.log(`Today (UTC): ${(0, data_provider_1.formatAgentUsageMicros)(cap.daily.usedMicros)}${cap.daily.limitMicros === null ? ' · no daily cap' : ` of ${(0, data_provider_1.formatAgentUsageMicros)(cap.daily.limitMicros)}`}${cap.daily.exhausted ? ' — daily cap reached, your new runs are refused' : ''} (resets ${cap.daily.periodEnd})`);
         this.log(data_provider_1.AGENT_USAGE_CAP_EXPLANATION);
     }
 }

package/dist/commands/code/doctor.d.ts

@@ -16,6 +16,7 @@ export default class CodeDoctor extends Command {
     static examples: string[];
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        check: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/code/doctor.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const first_party_harness_doctor_1 = require("../../lib/first-party-harness-doctor");
+const first_party_harness_update_1 = require("../../lib/first-party-harness-update");
 /**
  * `skrr code doctor` — diagnose the local first-party harness installation.
  *
@@ -23,9 +24,14 @@ class CodeDoctor extends core_1.Command {
     ];
     static flags = {
         json: core_1.Flags.boolean({ description: 'Emit the report as JSON' }),
+        check: core_1.Flags.boolean({
+            description: 'Also check the signed release channel (the default diagnosis is offline)',
+        }),
     };
     async run() {
         const { flags } = await this.parse(CodeDoctor);
+        if (flags.check)
+            await (0, first_party_harness_update_1.checkLocalCodeUpdate)({ force: true });
         const report = (0, first_party_harness_doctor_1.runDoctor)();
         if (flags.json) {
             this.logJson(report);