@skrr-ai/cli 0.1.95 → 0.1.96

package/dist/commands/commitments/observations.js

@@ -1,8 +1,49 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseObservationWindow = parseObservationWindow;
+exports.renderObservationWindow = renderObservationWindow;
 const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const commitments_1 = require("../../lib/commitments");
+/** Explicit ISO FROM/TO intervals avoid local-time or rolling-window ambiguity. */
+function parseObservationWindow(value) {
+    const parts = value.split('/');
+    const timestamp = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+    const [from, to] = parts.map((entry) => new Date(entry).getTime());
+    const realCalendarDay = (part) => {
+        const day = part.slice(0, 10);
+        const parsed = new Date(`${day}T00:00:00Z`);
+        return Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 10) === day;
+    };
+    if (parts.length !== 2 ||
+        !parts.every((part) => timestamp.test(part) && realCalendarDay(part)) ||
+        !Number.isFinite(from) ||
+        !Number.isFinite(to) ||
+        to <= from ||
+        to - from > data_provider_1.OBSERVATION_WINDOW_MAX_MS)
+        throw new Error('Window requires ISO FROM/TO with an explicit timezone and a positive span of at most 90 days');
+    return { from: new Date(from).toISOString(), to: new Date(to).toISOString() };
+}
+function renderObservationWindow(response, log) {
+    // Always announce partial data before showing figures, including baseline truncation.
+    if (response.truncated)
+        log('TRUNCATED: bounded sample only; figures are incomplete.');
+    log('Agent-reported samples; as-of interval coverage is not independent verification.');
+    const display = (label, value) => {
+        const window = value;
+        log(`${label}: [${window.from}, ${window.to})`);
+        log(`Samples: ${window.count}; numeric: ${window.numericCount}; unreadable: ${window.gapCount}; uncovered ms: ${window.gapMs}`);
+        log(`Mean: ${window.mean ?? 'unknown'}; sum: ${window.sum ?? 'unknown'}; first: ${window.first ?? 'unknown'}; last: ${window.last ?? 'unknown'}`);
+    };
+    if (response.baseline) {
+        display('Baseline', response.baseline);
+        display('After', response.after);
+        log(`Comparison: ${response.sufficient ? `delta=${response.delta}; ratio=${response.ratio}` : `unavailable (${response.reason})`}`);
+    }
+    else
+        display('Window', response.summary);
+}
 /**
  * `skrr commitments observations <id>` — what this commitment's runs saw.
  *
@@ -30,6 +71,18 @@ class CommitmentsObservations extends base_command_1.BaseCommand {
     };
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        latest: core_1.Flags.boolean({
+            description: 'Latest recorded attempt per current declared key (not history)',
+        }),
+        key: core_1.Flags.string({ description: 'Observation key for --window' }),
+        window: core_1.Flags.string({
+            description: 'Half-open ISO FROM/TO interval, at most 90 days',
+            dependsOn: ['key'],
+        }),
+        'compare-to': core_1.Flags.string({
+            description: 'Baseline ISO FROM/TO interval',
+            dependsOn: ['window'],
+        }),
         limit: core_1.Flags.integer({ description: 'Rows to include', min: 1, max: 200 }),
         'declared-only': core_1.Flags.boolean({
             description: 'Only keys the operator declared — the rows that can move the loop',
@@ -45,10 +98,42 @@ class CommitmentsObservations extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(CommitmentsObservations);
+        if (flags.latest && (flags.window || flags.cursor || flags['changed-only'] || flags.since))
+            this.error('--latest cannot be combined with --window, --cursor, --changed-only, or --since');
         let response;
+        if (flags.window) {
+            try {
+                if (flags['declared-only'] || flags['changed-only'] || flags.since || flags.cursor)
+                    this.error('--window cannot be combined with list filters');
+                const query = {
+                    key: flags.key,
+                    ...parseObservationWindow(flags.window),
+                    limit: flags.limit,
+                };
+                const baseline = flags['compare-to'] ? parseObservationWindow(flags['compare-to']) : null;
+                response = baseline
+                    ? await commitments_1.commitmentApi.observationCompare(args.commitmentId, {
+                        ...query,
+                        baselineFrom: baseline.from,
+                        baselineTo: baseline.to,
+                    })
+                    : await commitments_1.commitmentApi.observationSeries(args.commitmentId, query);
+            }
+            catch (err) {
+                this.handleApiError(err);
+            }
+            if (flags.json)
+                this.log(JSON.stringify(response, null, 2));
+            else
+                renderObservationWindow(response, (line) => this.log(line));
+            return;
+        }
+        if (flags.key)
+            this.error('--key requires --window');
         try {
             response = await commitments_1.commitmentApi.observations(args.commitmentId, {
                 limit: flags.limit,
+                latest: flags.latest || undefined,
                 declaredOnly: flags['declared-only'] || undefined,
                 changedOnly: flags['changed-only'] || undefined,
                 since: flags.since,
@@ -66,6 +151,7 @@ class CommitmentsObservations extends base_command_1.BaseCommand {
             // facts; a filter that empties the list must not claim the first
             // (OSK-10953).
             const filters = [
+                flags.latest ? '--latest' : null,
                 flags['declared-only'] ? '--declared-only' : null,
                 flags['changed-only'] ? '--changed-only' : null,
                 flags.since ? `--since ${flags.since}` : null,
@@ -73,6 +159,8 @@ class CommitmentsObservations extends base_command_1.BaseCommand {
             const emptyMessage = filters.length
                 ? `No observations match ${filters.join(' ')}.`
                 : 'No observations recorded.';
+            if (response?.truncated)
+                this.log(`TRUNCATED: ${response.omitted} current keys omitted; increase --limit (max 200).`);
             (0, commitments_1.renderCommitmentObservations)(response, (line) => this.log(line), { emptyMessage });
         }
         (0, commitments_1.renderListPageHint)(response, (line) => this.log(line));

package/dist/commands/commitments/pause.d.ts

@@ -1,7 +1,7 @@
 import { BaseCommand } from '../../base-command';
 /**
  * `skrr commitments pause <id>` — stop the control loop without losing the
- * contract or its history. The kill-switch for a noisy or misfiring commitment.
+ * contract or its history. An already executing turn may continue.
  */
 export default class CommitmentsPause extends BaseCommand {
     static description: string;

package/dist/commands/commitments/pause.js

@@ -6,10 +6,10 @@ const web_url_1 = require("../../lib/web-url");
 const commitments_1 = require("../../lib/commitments");
 /**
  * `skrr commitments pause <id>` — stop the control loop without losing the
- * contract or its history. The kill-switch for a noisy or misfiring commitment.
+ * contract or its history. An already executing turn may continue.
  */
 class CommitmentsPause extends base_command_1.BaseCommand {
-    static description = 'Pause a commitment — its control loop stops checking';
+    static description = 'Pause a commitment — stops new work; a turn already running may continue until it finishes or reaches its deadline';
     static examples = ['<%= config.bin %> commitments pause <commitment-id>'];
     static args = {
         id: core_1.Args.string({ description: 'Commitment ID', required: true, ignoreStdin: true }),
@@ -30,6 +30,7 @@ class CommitmentsPause extends base_command_1.BaseCommand {
             return;
         }
         this.log(`Paused commitment ${args.id}.`);
+        this.log('Stops new work. A turn already running may continue until it finishes or reaches its deadline.');
         // The status write is the fence and it has landed. The teardown of the
         // wake tree behind it is best-effort, and used to be silent — so a pause
         // that left triggers live looked exactly like one that did not. Say which
@@ -39,7 +40,7 @@ class CommitmentsPause extends base_command_1.BaseCommand {
             .teardown;
         if (teardown?.status === 'degraded') {
             this.warn('The control loop is stopped, but some scheduled wakes may not have been retired yet. ' +
-                'They cannot run anything — every wake is refused while this Commitment is paused — ' +
+                'They cannot start new work — every wake is refused while this Commitment is paused — ' +
                 `and the reconciler retries automatically. Check with: skrr commitments trigger-status ${args.id}`);
         }
         (0, commitments_1.renderCommitmentSummary)(commitment, (line) => this.log(line));

package/dist/commands/commitments/preflight.js

@@ -153,7 +153,8 @@ class CommitmentsPreflight extends base_command_1.BaseCommand {
         for (const endpoint of report.endpoints || []) {
             this.log(`  ${endpoint.available ? 'ok   ' : 'BLOCK'} ${endpoint.label || endpoint.destination}` +
                 ` — ${(endpoint.capabilities || []).join(', ') || 'no capabilities'}` +
-                (endpoint.reason ? ` (${endpoint.reason})` : ''));
+                (endpoint.reason ? ` (${endpoint.reason})` : '') +
+                (!endpoint.available && endpoint.detail ? ` — ${endpoint.detail}` : ''));
         }
         this.log(`\nAttention: ${report.attention?.allowed ? 'delivery allowed now' : `suppressed by ${report.attention?.suppressedBy || 'policy'}`}`);
         if (report.verdict === 'blocked')

package/dist/commands/commitments/reports.d.ts

@@ -19,7 +19,9 @@ export default class CommitmentsReports extends BaseCommand {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         add: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         target: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        review: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         on: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        format: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         remove: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;

package/dist/commands/commitments/reports.js

@@ -6,16 +6,18 @@ const base_command_1 = require("../../base-command");
 const commitments_1 = require("../../lib/commitments");
 const commitment_terms_1 = require("../../lib/commitment-terms");
 /** Destinations that address one specific place and therefore need a target. */
-const DESTINATIONS_NEEDING_TARGET = new Set(['slack_channel']);
+const DESTINATIONS_NEEDING_TARGET = new Set(Object.values(data_provider_1.COMMITMENT_DESTINATION_REGISTRY)
+    .filter((destination) => destination.requiresTarget)
+    .map((destination) => destination.key));
 /**
  * Keep the CLI safe across a rolling data-provider build. Older installed
  * packages expose the compatibility destination list but not the narrowed
  * authoring list; derive the same restriction instead of crashing command
- * discovery or accidentally offering the inert email transport.
+ * discovery.
  */
 const AUTHORABLE_REPORT_DESTINATIONS = Array.isArray(data_provider_1.COMMITMENT_AUTHORABLE_REPORT_DESTINATIONS)
     ? data_provider_1.COMMITMENT_AUTHORABLE_REPORT_DESTINATIONS
-    : data_provider_1.COMMITMENT_REPORT_DESTINATIONS.filter((destination) => destination !== 'email');
+    : data_provider_1.COMMITMENT_REPORT_DESTINATIONS;
 /**
  * Identity of a report target = destination + its target id. The same channel
  * may legitimately appear twice with different `on` conditions (a digest on
@@ -41,6 +43,7 @@ class CommitmentsReports extends base_command_1.BaseCommand {
         '<%= config.bin %> commitments reports <commitment-id>',
         '<%= config.bin %> commitments reports <commitment-id> --add slack_channel --target C0123456 --on material_change',
         '<%= config.bin %> commitments reports <commitment-id> --add main --on completion',
+        '<%= config.bin %> commitments reports <commitment-id> --add user_notify --target <user-id> --review owner',
         '<%= config.bin %> commitments reports <commitment-id> --remove slack_channel:C0123456',
     ];
     static args = {
@@ -53,12 +56,20 @@ class CommitmentsReports extends base_command_1.BaseCommand {
             options: [...AUTHORABLE_REPORT_DESTINATIONS],
         }),
         target: core_1.Flags.string({
-            description: 'Channel id for slack_channel. App and owner-DM destinations need no target.',
+            description: 'Channel id for slack_channel, or the user id for user_notify. App, owner-DM and email destinations need no target (email goes to your verified account address).',
+        }),
+        review: core_1.Flags.string({
+            description: 'Hold the exact text for approver approval before it is sent to this target (owner)',
+            options: [...data_provider_1.COMMITMENT_REPORT_REVIEW_MODES],
         }),
         on: core_1.Flags.string({
             description: 'When to report (default: material_change)',
             options: [...data_provider_1.COMMITMENT_REPORT_TRIGGERS],
         }),
+        format: core_1.Flags.string({
+            description: 'Optional report format (absent: text)',
+            options: ['text', 'report_v1'],
+        }),
         remove: core_1.Flags.string({
             description: 'Report target to remove: "<destination>" or "<destination>:<target>"',
         }),
@@ -66,6 +77,8 @@ class CommitmentsReports extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(CommitmentsReports);
+        if (flags.format && !flags.add)
+            this.error('--format requires --add.', { exit: 1 });
         if (flags.add && flags.remove) {
             this.error('Pass --add or --remove, not both.', { exit: 1 });
         }
@@ -89,6 +102,9 @@ class CommitmentsReports extends base_command_1.BaseCommand {
         try {
             const current = await (0, commitment_terms_1.loadCommitment)(args.id);
             const reports = current.reports ?? [];
+            if (flags.review && !flags.add) {
+                throw new Error('--review applies to a report being added (--add).');
+            }
             if (flags.add) {
                 const destination = flags.add;
                 if (DESTINATIONS_NEEDING_TARGET.has(destination) && !flags.target) {
@@ -102,8 +118,10 @@ class CommitmentsReports extends base_command_1.BaseCommand {
                 const next = {
                     destination,
                     ...(flags.target ? { destinationTarget: flags.target } : {}),
+                    ...(flags.review ? { review: flags.review } : {}),
                     on: flags.on ?? 'material_change',
                     enabled: true,
+                    ...(flags.format ? { format: flags.format } : {}),
                 };
                 payload = { reports: (0, commitment_terms_1.appendUnique)(reports, next, reportKey, 'Report target') };
             }

package/dist/commands/commitments/update.d.ts

@@ -30,6 +30,7 @@ export default class CommitmentsUpdate extends BaseCommand {
         yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'from-json': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'if-version': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'task-review-policy': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         title: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'agent-directive': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/commitments/update.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
+const core_1 = require("@oclif/core");
+const commitment_product_1 = require("../../lib/commitment-product");
+const data_provider_2 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const prompt_1 = require("../../lib/prompt");
 const web_url_1 = require("../../lib/web-url");
@@ -52,6 +54,10 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
         'if-version': core_1.Flags.integer({
             description: 'Only update this observed contract version; returns a conflict if it changed',
         }),
+        'task-review-policy': core_1.Flags.string({
+            options: [...data_provider_1.TASK_REVIEW_POLICIES],
+            description: 'Owner choice for generated Tasks; required records a blocker but does not stop the owner close.',
+        }),
         title: core_1.Flags.string({ description: 'New title' }),
         description: core_1.Flags.string({ description: 'New description' }),
         'agent-directive': core_1.Flags.string({
@@ -133,9 +139,22 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
         const wantsCadence = flags.cadence !== undefined ||
             flags['cadence-mode'] !== undefined ||
             flags.timezone !== undefined;
+        let payload;
+        try {
+            payload = await (0, prompt_2.readJsonBody)(flags['from-json']);
+        }
+        catch (err) {
+            this.error(err.message, { exit: 1 });
+        }
+        const authoredDelivery = payload.delivery && typeof payload.delivery === 'object' && !Array.isArray(payload.delivery)
+            ? payload.delivery
+            : undefined;
         // Read-modify-write: only pay the extra round-trip when we must merge.
         let current;
-        if (wantsTarget || wantsCadence) {
+        if (wantsTarget ||
+            wantsCadence ||
+            authoredDelivery ||
+            flags['task-review-policy'] !== undefined) {
             try {
                 const res = await commitments_1.commitmentApi.get(args.id);
                 current = res?.commitment;
@@ -147,11 +166,22 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
                 this.error(`Commitment ${args.id} not found.`, { exit: 4 });
             }
         }
-        let payload;
         try {
-            payload = await (0, prompt_2.readJsonBody)(flags['from-json']);
             if (flags['if-version'] !== undefined)
                 payload.expectedVersion = flags['if-version'];
+            if (authoredDelivery || flags['task-review-policy'] !== undefined) {
+                payload.delivery = {
+                    ...(current?.delivery || { version: 1, mode: 'report_only' }),
+                    ...authoredDelivery,
+                    ...(flags['task-review-policy'] !== undefined
+                        ? { reviewPolicy: (0, commitment_product_1.normalizeTaskReviewPolicy)(flags['task-review-policy']) }
+                        : {}),
+                };
+                payload.expectedVersion ??= current?.version;
+            }
+            const declaredDelivery = payload.delivery;
+            if (declaredDelivery?.reviewPolicy !== undefined)
+                (0, commitment_product_1.normalizeTaskReviewPolicy)(declaredDelivery.reviewPolicy);
             if (flags.title)
                 payload.title = flags.title;
             if (flags.description !== undefined)
@@ -168,7 +198,7 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
                 // generic PATCH with no ceremony at all, while `commitments delete` —
                 // whose data is all still on disk, and which is now restorable —
                 // prompts. Ceremony should track how hard something is to undo.
-                if ((0, data_provider_1.isTerminalCommitmentStatus)(flags.status)) {
+                if ((0, data_provider_2.isTerminalCommitmentStatus)(flags.status)) {
                     let confirmed;
                     try {
                         confirmed = await (0, prompt_1.confirmDestructive)(`Set ${args.id} to ${flags.status}? This ends the Commitment — making it active again means archiving it first, then resuming.`, flags.yes);

package/dist/commands/grants/create.d.ts

@@ -20,6 +20,7 @@ export default class GrantsCreate extends BaseCommand {
         commitment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         provider: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         label: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        access: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         env: import("@oclif/core/lib/interfaces").OptionFlag<string[], import("@oclif/core/lib/interfaces").CustomOptions>;
         daemon: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/grants/create.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const grants_1 = require("../../lib/grants");
+const data_provider_1 = require("@skrr-ai/data-provider");
 /**
  * `skrr grants create` — give an agent a credential.
  *
@@ -29,6 +30,10 @@ class GrantsCreate extends base_command_1.BaseCommand {
         }),
         provider: core_1.Flags.string({ description: 'Provider slug (e.g. aws, stripe)', required: true }),
         label: core_1.Flags.string({ description: 'Human label', required: true }),
+        access: core_1.Flags.string({
+            description: 'Advisory provider access class (declared, not verified)',
+            options: [...data_provider_1.GRANT_ACCESS_CLASSES],
+        }),
         description: core_1.Flags.string({ description: 'Optional description' }),
         env: core_1.Flags.string({
             description: 'Credential as NAME=VALUE (repeatable)',
@@ -67,6 +72,7 @@ class GrantsCreate extends base_command_1.BaseCommand {
                 : { kind: 'commitment', commitmentId: flags.commitment },
             provider: flags.provider,
             label: flags.label,
+            ...(flags.access ? { access: flags.access } : {}),
             description: flags.description,
             credential: { kind: 'env', env },
             runtime: { sandbox: !flags['no-sandbox'], daemon: flags.daemon },
@@ -77,6 +83,8 @@ class GrantsCreate extends base_command_1.BaseCommand {
             return;
         }
         this.log(`Stored grant ${grant.id} (${grant.label}).`);
+        if (grant.access)
+            this.log(`  access: ${(0, data_provider_1.describeGrantAccess)(grant.access, grant.accessSource).label}`);
         this.log(`  variables: ${grant.credential?.envKeys.join(', ') || '—'}`);
         this.log('  Values are encrypted and cannot be read back.');
     }

package/dist/commands/grants/rotate.d.ts

@@ -4,6 +4,10 @@ import { BaseCommand } from '../../base-command';
  *
  * Replacement, never a merge: a partial update could leave half of a previous
  * key pair alive alongside the new one.
+ *
+ * A declared access class describes the OLD credential, so rotating clears it
+ * unless `--access` re-declares it for the new one (creator only). Installation-
+ * backed grants keep their attested access; it refreshes through the platform.
  */
 export default class GrantsRotate extends BaseCommand {
     static description: string;
@@ -14,6 +18,7 @@ export default class GrantsRotate extends BaseCommand {
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         env: import("@oclif/core/lib/interfaces").OptionFlag<string[], import("@oclif/core/lib/interfaces").CustomOptions>;
+        access: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/grants/rotate.js

@@ -2,12 +2,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const grants_1 = require("../../lib/grants");
 /**
  * `skrr grants rotate` — replace a credential wholesale.
  *
  * Replacement, never a merge: a partial update could leave half of a previous
  * key pair alive alongside the new one.
+ *
+ * A declared access class describes the OLD credential, so rotating clears it
+ * unless `--access` re-declares it for the new one (creator only). Installation-
+ * backed grants keep their attested access; it refreshes through the platform.
  */
 class GrantsRotate extends base_command_1.BaseCommand {
     static description = 'Rotate the credential on an existing grant';
@@ -24,6 +29,10 @@ class GrantsRotate extends base_command_1.BaseCommand {
             multiple: true,
             required: true,
         }),
+        access: core_1.Flags.string({
+            options: [...data_provider_1.GRANT_ACCESS_CLASSES],
+            description: 'Re-declare the access class of the NEW credential (creator only). Without it, rotation clears the declared class.',
+        }),
     };
     async run() {
         this.requireAuth();
@@ -35,13 +44,16 @@ class GrantsRotate extends base_command_1.BaseCommand {
         catch (err) {
             this.error(err.message);
         }
-        const grant = await grants_1.grantApi.rotate(args.grantId, { kind: 'env', env });
+        const grant = await grants_1.grantApi.rotate(args.grantId, { kind: 'env', env }, flags.access);
         if (flags.json) {
             this.log(JSON.stringify(grant, null, 2));
             return;
         }
         this.log(`Rotated grant ${grant.id}.`);
         this.log(`  variables: ${grant.credential?.envKeys.join(', ') || '—'}`);
+        if (!grant.access) {
+            this.log('  access: not declared (rotation clears the declared class; use --access to re-declare)');
+        }
     }
 }
 exports.default = GrantsRotate;

package/dist/commands/grants/update.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base-command';
+export default class GrantsUpdate extends BaseCommand {
+    static description: string;
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        access: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/grants/update.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const grants_1 = require("../../lib/grants");
+class GrantsUpdate extends base_command_1.BaseCommand {
+    static description = 'Update a Grant advisory access class (creator only)';
+    static args = { id: core_1.Args.string({ ignoreStdin: true, required: true }) };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        access: core_1.Flags.string({
+            required: true,
+            options: [...data_provider_1.GRANT_ACCESS_CLASSES],
+            description: 'Declared provider access; does not verify or alter the credential',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(GrantsUpdate);
+        const grant = await grants_1.grantApi.updateAccess(args.id, flags.access);
+        this.log(flags.json
+            ? JSON.stringify(grant, null, 2)
+            : `${grant.id}: ${(0, data_provider_1.describeGrantAccess)(grant.access, grant.accessSource).label}`);
+    }
+}
+exports.default = GrantsUpdate;

package/dist/commands/machines/hosted/start.js

@@ -13,7 +13,7 @@ class HostedMachinesStart extends base_command_1.BaseCommand {
     ];
     static flags = {
         agent: core_1.Flags.string({
-            description: 'Associate machine session metadata with an agent id. Use `agents attach-harness` to make it the agent default.',
+            description: "Agent id (an agent you can view): applies that agent's declared network access. Use `agents attach-harness` to make it the agent default.",
         }),
         conversation: core_1.Flags.string({ description: 'Bind the machine to a conversation id' }),
         environment: core_1.Flags.string({ description: 'Hosted environment id' }),
@@ -154,6 +154,12 @@ class HostedMachinesStart extends base_command_1.BaseCommand {
         }
         const id = (0, hosted_machines_1.hostedMachineId)(session);
         this.log(`Hosted Machine ${id || '(unknown)'} ${(0, hosted_machines_1.hostedMachineStatus)(session)}.`);
+        if (session?.egressPolicy) {
+            this.log(`Network: ${session.egressPolicy} (${session.egressSource || 'source unknown'}; ${session.egressAllowHosts?.length || 0} hosts)`);
+        }
+        if (session?.egressDroppedHosts?.length) {
+            this.log(`Workspace policy dropped: ${session.egressDroppedHosts.join(', ')}`);
+        }
         if (session?.previewUrl)
             this.log(`Preview: ${session.previewUrl}`);
         if (!(0, hosted_machines_1.isHostedMachineReady)(session)) {

package/dist/commands/machines/list.js

@@ -37,16 +37,16 @@ class MachinesList extends base_command_1.BaseCommand {
         catch (err) {
             this.handleApiError(err);
         }
+        const all = machines ?? [];
+        const shown = flags.all ? all : all.filter((m) => (0, machines_1.isReachableMachine)(m));
         if (flags.json) {
-            this.log(JSON.stringify(machines, null, 2));
+            this.log(JSON.stringify(shown, null, 2));
             return;
         }
-        if (!machines || machines.length === 0) {
+        if (all.length === 0) {
             this.log('No machines. Install a daemon with `skrr harnesses install-token`.');
             return;
         }
-        const all = machines;
-        const shown = flags.all ? all : all.filter((m) => (0, machines_1.isReachableMachine)(m));
         if (shown.length === 0) {
             this.log(`No machine is reachable right now (${(0, machines_1.hiddenMachinesSummary)(all)}) — see them with --all.`);
             return;

package/dist/commands/measures/confirm.d.ts

@@ -1,11 +1,5 @@
 import { BaseCommand } from '../../base-command';
-/**
- * `skrr measures confirm` — turn a claim into ground truth.
- *
- * This is the human-in-the-loop step whose `agentOutcome` equivalent shipped
- * with zero callers, which left every value claim in the system permanently
- * unverified.
- */
+/** Confirm a reading and display the server-derived attribution. */
 export default class MeasuresConfirm extends BaseCommand {
     static description: string;
     static examples: string[];

package/dist/commands/measures/confirm.js

@@ -1,17 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const measures_1 = require("../../lib/measures");
-/**
- * `skrr measures confirm` — turn a claim into ground truth.
- *
- * This is the human-in-the-loop step whose `agentOutcome` equivalent shipped
- * with zero callers, which left every value claim in the system permanently
- * unverified.
- */
+/** Confirm a reading and display the server-derived attribution. */
 class MeasuresConfirm extends base_command_1.BaseCommand {
-    static description = 'Confirm an observation (marks it as ground truth)';
+    static description = 'Confirm an observation with credential-derived evidence attribution';
     static examples = [
         '<%= config.bin %> measures confirm <measure-id> --at 2026-07-28T00:00:00Z',
         '<%= config.bin %> measures confirm <measure-id> --latest',
@@ -22,7 +17,9 @@ class MeasuresConfirm extends base_command_1.BaseCommand {
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         at: core_1.Flags.string({ description: 'observedAt of the reading to confirm (ISO-8601)' }),
-        latest: core_1.Flags.boolean({ description: 'Confirm the most recent unconfirmed reading' }),
+        latest: core_1.Flags.boolean({
+            description: 'Confirm the most recent reading lacking person confirmation',
+        }),
     };
     async run() {
         this.requireAuth();
@@ -33,19 +30,23 @@ class MeasuresConfirm extends base_command_1.BaseCommand {
                 this.error('Specify --at <iso-instant> or --latest.');
             }
             const measure = await measures_1.measureApi.get(args.measureId);
-            const unconfirmed = measure.observations.filter((o) => !o.confirmed);
-            if (unconfirmed.length === 0) {
-                this.log('Nothing to confirm — every reading is already confirmed.');
+            const selection = (0, data_provider_1.latestConfirmableMeasureReading)(measure.observations);
+            if (selection.ambiguous) {
+                this.error('Multiple retained readings have the same timestamp; the existing confirmation endpoint cannot distinguish them. No confirmation was sent.');
+            }
+            const unconfirmed = selection.reading;
+            if (!unconfirmed) {
+                this.log('Nothing to confirm — no eligible reading lacking person confirmation is available.');
                 return;
             }
-            observedAt = unconfirmed[unconfirmed.length - 1].observedAt;
+            observedAt = unconfirmed.observedAt;
         }
         const measure = await measures_1.measureApi.confirm(args.measureId, observedAt);
         if (flags.json) {
             this.log(JSON.stringify(measure, null, 2));
             return;
         }
-        this.log(`Confirmed. ${measure.rollup.confirmedCount}/${measure.rollup.observationCount} readings are ground truth.`);
+        this.log((0, measures_1.recordConfirmationForObservation)(measure.observations.find((o) => Date.parse(o.observedAt) === Date.parse(observedAt))).message);
     }
 }
 exports.default = MeasuresConfirm;