@skrr-ai/cli 0.1.95 → 0.1.97

package/dist/lib/session-task-write.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionTaskWrite = sessionTaskWrite;
+const api_fetch_1 = require("./api-fetch");
+const credential_resolver_1 = require("./credential-resolver");
+const session_task_endpoints_1 = require("./session-task-endpoints");
+/**
+ * A canonical Task write must retain its authenticated session actor even if
+ * the daemon also grants the CLI a wide credential. The wide credential names
+ * its account, not the Agent that is executing this Task. Passing the trusted
+ * session credential explicitly makes apiFetch keep the server's bound actor.
+ * Human invocations continue through their ordinary Task endpoints.
+ */
+async function sessionTaskWrite(operation, requestedTask, env = process.env) {
+    const credential = (0, credential_resolver_1.resolveTrustedAutonomousCredential)(env);
+    if (!credential)
+        return null;
+    const sessionId = env.OVERSKY_SESSION_ID?.trim();
+    if (!credential.token || !sessionId) {
+        throw Object.assign(new Error('Task writes require this runtime’s bound session credential.'), {
+            code: 'SESSION_TASK_CREDENTIAL_MISSING',
+        });
+    }
+    const prefix = `/api/agentic/sessions/${encodeURIComponent(sessionId)}`;
+    // A scoped endpoint derives its Task and ignores a caller's Task id. Check
+    // the requested coordinate first, so naming a sibling cannot quietly finish
+    // the bound Task instead. The server independently rechecks the live binding
+    // and checkout when committing the write.
+    const bound = await (0, api_fetch_1.apiFetch)(`${prefix}/task`, {
+        credential,
+    });
+    if (!bound.id || !(0, session_task_endpoints_1.requestMatchesBoundTask)(bound, requestedTask)) {
+        throw Object.assign(new Error(`This session is bound to task ${bound.identifier || bound.id || '?'} and cannot write the requested Task.`), {
+            code: 'SESSION_SCOPE_TASK_MISMATCH',
+        });
+    }
+    return {
+        path: `${prefix}/${session_task_endpoints_1.SESSION_TASK_PATH_SUFFIX[operation]}`,
+        credential,
+        taskId: bound.id,
+        task: bound,
+    };
+}

package/dist/lib/signals.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Secret-free Signal lifecycle (`/api/signal-monitors`, read-only sources and schemas).
+ * Source creation, credentials and schema review hand out one-display secrets and stay
+ * in the reviewed UI until a headless secret-display contract is approved.
+ */
+export declare const signalsApi: {
+    listMonitors: () => Promise<unknown>;
+    showMonitor: (id: string) => Promise<unknown>;
+    validateMonitor: (body: unknown) => Promise<any>;
+    createMonitor: (body: unknown) => Promise<any>;
+    testMonitor: (id: string, body: unknown) => Promise<any>;
+    reviseMonitor: (id: string, body: unknown) => Promise<any>;
+    setMonitorStatus: (id: string, status: "active" | "paused") => Promise<any>;
+    monitorTransitions: (id: string) => Promise<unknown>;
+    listSources: () => Promise<unknown>;
+    showSource: (id: string) => Promise<unknown>;
+    sourceReceipts: (id: string) => Promise<unknown>;
+    listSchemas: () => Promise<unknown>;
+    showSchema: (id: string) => Promise<unknown>;
+};

package/dist/lib/signals.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signalsApi = void 0;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * Secret-free Signal lifecycle (`/api/signal-monitors`, read-only sources and schemas).
+ * Source creation, credentials and schema review hand out one-display secrets and stay
+ * in the reviewed UI until a headless secret-display contract is approved.
+ */
+exports.signalsApi = {
+    listMonitors: () => data_provider_1.request.get('/api/signal-monitors'),
+    showMonitor: (id) => data_provider_1.request.get(`/api/signal-monitors/${encodeURIComponent(id)}`),
+    validateMonitor: (body) => data_provider_1.request.post('/api/signal-monitors/validate', body),
+    createMonitor: (body) => data_provider_1.request.post('/api/signal-monitors', body),
+    testMonitor: (id, body) => data_provider_1.request.post(`/api/signal-monitors/${encodeURIComponent(id)}/test`, body),
+    reviseMonitor: (id, body) => data_provider_1.request.post(`/api/signal-monitors/${encodeURIComponent(id)}/revisions`, body),
+    setMonitorStatus: (id, status) => data_provider_1.request.patch(`/api/signal-monitors/${encodeURIComponent(id)}`, { status }),
+    monitorTransitions: (id) => data_provider_1.request.get(`/api/signal-monitors/${encodeURIComponent(id)}/transitions`),
+    listSources: () => data_provider_1.request.get('/api/signal-sources'),
+    showSource: (id) => data_provider_1.request.get(`/api/signal-sources/${encodeURIComponent(id)}`),
+    sourceReceipts: (id) => data_provider_1.request.get(`/api/signal-sources/${encodeURIComponent(id)}/receipts`),
+    listSchemas: () => data_provider_1.request.get('/api/signal-schemas'),
+    showSchema: (id) => data_provider_1.request.get(`/api/signal-schemas/${encodeURIComponent(id)}`),
+};

package/dist/lib/space-usage.d.ts

@@ -0,0 +1,3 @@
+import { type SpendSummary } from '@skrr-ai/data-provider';
+export declare const getSpaceUsage: (spaceId: string, window?: string) => Promise<SpendSummary>;
+export declare function formatSpaceSpend(summary: SpendSummary): string;

package/dist/lib/space-usage.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSpaceUsage = void 0;
+exports.formatSpaceSpend = formatSpaceSpend;
+const data_provider_1 = require("@skrr-ai/data-provider");
+const getSpaceUsage = (spaceId, window = '30d') => data_provider_1.dataService.getSpaceUsage(spaceId, window);
+exports.getSpaceUsage = getSpaceUsage;
+/** A positive amount under one cent must not print as $0.00; a measured zero stays $0.00. */
+const usd = (amount) => amount > 0 && amount < 0.01 ? '<$0.01' : `$${amount.toFixed(2)}`;
+function formatSpaceSpend(summary) {
+    const attribution = `Attribution since: ${summary.coverage.attributionSince || 'not certified'}; not attributed: ${summary.coverage.notAttributed.join(', ')}`;
+    if (summary.runCount === 0)
+        return `No runs in window\n${attribution}`;
+    const cost = summary.costUsd === null ? 'Not fully attributed' : usd(summary.costUsd);
+    const known = summary.knownCostUsd === null ? 'unavailable' : usd(summary.knownCostUsd);
+    return `${cost}; known subtotal ${known}; ${summary.runCount} cost records; ${summary.byCostStatus.unavailable} unavailable, ${summary.byCostStatus.partial} partial\n${attribution}`;
+}

package/dist/lib/stewardship-output.d.ts

@@ -0,0 +1,4 @@
+import type { WorkspaceGrantReport, WorkspaceStewardshipReport } from './workspaces';
+export declare function printStewardshipCoverage(report: WorkspaceGrantReport, log: (line: string) => void): void;
+export declare function printWorkspaceGrants(report: WorkspaceGrantReport, log: (line: string) => void): void;
+export declare function printWorkspaceStewardship(report: WorkspaceStewardshipReport, log: (line: string) => void): void;

package/dist/lib/stewardship-output.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printStewardshipCoverage = printStewardshipCoverage;
+exports.printWorkspaceGrants = printWorkspaceGrants;
+exports.printWorkspaceStewardship = printWorkspaceStewardship;
+const format_1 = require("./format");
+function printStewardshipCoverage(report, log) {
+    if (report.coverage.complete) {
+        log('Coverage: complete within the bounded sources.');
+        return;
+    }
+    log('Coverage: incomplete. Unreadable sources do not confirm absence.');
+    for (const source of report.coverage.sources) {
+        if (source.status === 'unavailable')
+            log(`${source.name}: unavailable`);
+        else if (source.truncated)
+            log(`${source.name}: truncated at 200 rows`);
+    }
+}
+function printWorkspaceGrants(report, log) {
+    printStewardshipCoverage(report, log);
+    printGrantRows(report, log);
+}
+function printGrantRows(report, log) {
+    if (report.grants === null) {
+        log('Grants: unavailable.');
+        return;
+    }
+    if (!report.grants.length) {
+        log('No workspace Grants observed.');
+        return;
+    }
+    (0, format_1.renderTable)(report.grants.map((row) => ({
+        id: row.id,
+        label: row.label,
+        owner: row.ownerUserId,
+        active: row.active ? 'yes' : 'no',
+        expires: row.expiresAt ?? '',
+        envKeys: row.credential?.envKeys.join(', ') ?? '',
+        referencedBy: row.referencedBy === null
+            ? 'unavailable'
+            : `${row.referencedBy.join(', ')}${row.referencesTruncated ? ' (truncated)' : ''}`,
+    })), [
+        { key: 'id', header: 'ID' },
+        { key: 'label', header: 'LABEL' },
+        { key: 'owner', header: 'OWNER' },
+        { key: 'active', header: 'ACTIVE' },
+        { key: 'expires', header: 'EXPIRES' },
+        { key: 'envKeys', header: 'ENV NAMES' },
+        { key: 'referencedBy', header: 'REFERENCED BY' },
+    ], log);
+}
+function printWorkspaceStewardship(report, log) {
+    printStewardshipCoverage(report, log);
+    log(`Membership: ${report.membership.status}${report.membership.role ? ` (${report.membership.role})` : ''}`);
+    for (const [name, rows] of [
+        ['Commitments', report.commitments],
+        ['Approver seats', report.approverSeats],
+    ]) {
+        log(`${name}: ${rows === null ? 'unavailable' : rows.length}`);
+        if (rows?.length)
+            (0, format_1.renderTable)(rows.map((row) => ({
+                id: row.id,
+                title: row.title ?? '',
+                status: row.status ?? '',
+                agentId: row.agentId ?? '',
+            })), [
+                { key: 'id', header: 'ID' },
+                { key: 'title', header: 'TITLE' },
+                { key: 'status', header: 'STATUS' },
+                { key: 'agentId', header: 'EXECUTOR' },
+            ], log);
+    }
+    log(`Authored Agents: ${report.agents === null ? 'unavailable' : report.agents.length}`);
+    if (report.agents?.length)
+        (0, format_1.renderTable)(report.agents.map((row) => ({ id: row.id, name: row.name ?? '' })), [
+            { key: 'id', header: 'ID' },
+            { key: 'name', header: 'NAME' },
+        ], log);
+    log('Grants:');
+    printGrantRows(report, log);
+}

package/dist/lib/task-asset-upload.d.ts

@@ -1,4 +1,4 @@
-import type { WorkResourceKind } from '@skrr-ai/data-provider';
+import type { WorkResourceKind, TaskResourceWriteReceipt } from '@skrr-ai/data-provider';
 export type TaskAssetRole = 'input' | 'evidence' | 'deliverable';
 /**
  * What the bytes ARE in the work ledger, for an upload that is the archived
@@ -24,6 +24,8 @@ export interface TaskAssetLedgerResource {
     expectationIds?: string[];
 }
 export interface UploadedTaskAsset {
+    /** The canonical Task relationship and exact Resource version recorded by this upload. */
+    resourceReceipt?: TaskResourceWriteReceipt;
     id: string;
     /**
      * sha256 (hex) of the bytes the server STORED, as the server recorded them.

package/dist/lib/task-asset-upload.js

@@ -47,9 +47,8 @@ exports.postFileToStorage = postFileToStorage;
  *   ≤25MB or image → buffered multipart (canonicalization needs the bytes)
  *   larger non-image → intent → presigned POST to S3 → complete (OSK-9867)
  *
- * Session routing follows the CREDENTIAL, resolved here once per file so a
- * narrowed agent session lands on `task-attachments*` and a human (or a
- * delegated session holding a wide credential) lands on `/api/tasks/:id/*`.
+ * Agent uploads retain the authenticated session producer even beside a wide
+ * delegated credential. Human uploads use `/api/tasks/:id/*`.
  *
  * Retry safety is server-side: the sha256 IS the asset identity, so a second
  * upload of the same bytes returns the existing ready row instead of
@@ -73,7 +72,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../base-command");
 const file_mime_1 = require("./file-mime");
 const api_fetch_1 = require("./api-fetch");
-const session_task_endpoints_1 = require("./session-task-endpoints");
+const session_task_write_1 = require("./session-task-write");
 function mb(bytes) {
     return `${Math.floor(bytes / (1024 * 1024))} MB`;
 }
@@ -89,14 +88,9 @@ function storedDigest(asset) {
  * refuses to act on any other task before a byte leaves the machine.
  */
 async function readTaskForUpload(taskId) {
-    const readPath = await (0, session_task_endpoints_1.sessionScopedTaskPath)('read');
-    if (readPath) {
-        const bound = await (0, api_fetch_1.apiFetch)(readPath);
-        if (!(0, session_task_endpoints_1.requestMatchesBoundTask)(bound, taskId)) {
-            throw new Error(`This session is bound to task ${String(bound.identifier ?? bound.id ?? '?')} — a scoped credential cannot attach files to ${taskId}.`);
-        }
-        return bound;
-    }
+    const target = await (0, session_task_write_1.sessionTaskWrite)('attachment', taskId);
+    if (target)
+        return target.task;
     return (await data_provider_1.dataService.getTask(taskId, { enrich: false }));
 }
 /**
@@ -124,14 +118,13 @@ async function uploadTaskAssetFile(opts) {
         throw new Error(`${filename} exceeds the direct-upload limit (${mb(data_provider_1.TASK_DIRECT_UPLOAD_MAX_BYTES)})`);
     }
     const direct = !isImage && size > data_provider_1.TASK_ATTACHMENT_MAX_BYTES;
-    const sessionPath = await (0, session_task_endpoints_1.sessionScopedTaskPath)('attachment');
+    const sessionTarget = await (0, session_task_write_1.sessionTaskWrite)('attachment', taskId);
     let result;
     try {
-        if (sessionPath) {
-            await readTaskForUpload(taskId);
+        if (sessionTarget) {
             result = direct
-                ? await sessionDirectUpload({ filePath, size, filename, mimeType, role, ledger })
-                : await sessionBufferedUpload({ filePath, filename, mimeType, role, ledger });
+                ? await sessionDirectUpload({ filePath, size, filename, mimeType, role, ledger }, sessionTarget)
+                : await sessionBufferedUpload({ filePath, filename, mimeType, role, ledger }, sessionTarget);
         }
         else {
             result = direct
@@ -148,6 +141,7 @@ async function uploadTaskAssetFile(opts) {
         filename,
         mimeType,
         deduplicated: result.deduplicated === true,
+        ...(result.resourceReceipt ? { resourceReceipt: result.resourceReceipt } : {}),
     };
 }
 /**
@@ -228,9 +222,10 @@ async function genericBufferedUpload(p) {
         formData: fileFormData(p.filePath, p.filename, p.mimeType, p.role, p.ledger),
     });
 }
-async function sessionBufferedUpload(p) {
-    return (0, api_fetch_1.apiFetch)((await (0, session_task_endpoints_1.sessionScopedTaskPath)('attachment')), {
+async function sessionBufferedUpload(p, target) {
+    return (0, api_fetch_1.apiFetch)(target.path, {
         method: 'POST',
+        credential: target.credential,
         body: fileFormData(p.filePath, p.filename, p.mimeType, p.role, p.ledger),
     });
 }
@@ -266,9 +261,10 @@ async function genericDirectUpload(p) {
         attachmentId: intent.attachment.id,
     });
 }
-async function sessionDirectUpload(p) {
-    const intent = await (0, api_fetch_1.apiFetch)((await (0, session_task_endpoints_1.sessionScopedTaskPath)('attachmentIntent')), {
+async function sessionDirectUpload(p, target) {
+    const intent = await (0, api_fetch_1.apiFetch)(`${target.path}/intent`, {
         method: 'POST',
+        credential: target.credential,
         body: {
             filename: p.filename,
             mimeType: p.mimeType,
@@ -295,8 +291,9 @@ async function sessionDirectUpload(p) {
         filename: p.filename,
         mimeType: p.mimeType,
     });
-    return (0, api_fetch_1.apiFetch)((await (0, session_task_endpoints_1.sessionScopedTaskPath)('attachmentComplete')), {
+    return (0, api_fetch_1.apiFetch)(`${target.path}/complete`, {
         method: 'POST',
+        credential: target.credential,
         body: { attachmentId: intent.attachment.id },
     });
 }

package/dist/lib/task-economics.d.ts

@@ -0,0 +1,16 @@
+export declare function economicsFromFlags(flags: {
+    savings?: string;
+    per?: string;
+    effort?: string;
+    risk?: string;
+}, existing?: unknown): {
+    savings?: {
+        amount: number;
+        currency: "USD";
+        per: "month" | "year" | "once";
+    } | undefined;
+    effortHours?: number | undefined;
+    risk?: "low" | "medium" | "high" | undefined;
+    confidence?: "low" | "medium" | "high" | undefined;
+    rationale?: string | undefined;
+} | undefined;

package/dist/lib/task-economics.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.economicsFromFlags = economicsFromFlags;
+const data_provider_1 = require("@skrr-ai/data-provider");
+function economicsFromFlags(flags, existing) {
+    if ([flags.savings, flags.per, flags.effort, flags.risk].every((value) => value === undefined))
+        return undefined;
+    if ((flags.savings === undefined) !== (flags.per === undefined))
+        throw new Error('--savings and --per must be supplied together (USD/month, year or once).');
+    for (const value of [flags.savings, flags.effort])
+        if (value !== undefined && value.trim() === '')
+            throw new Error('Economic amounts must be explicit nonnegative numbers.');
+    const content = existing && typeof existing === 'object' ? existing : {};
+    return data_provider_1.ProposalEconomicsInputSchema.parse({
+        ...content,
+        ...(flags.savings !== undefined
+            ? { savings: { amount: Number(flags.savings), currency: 'USD', per: flags.per } }
+            : {}),
+        ...(flags.effort !== undefined ? { effortHours: Number(flags.effort) } : {}),
+        ...(flags.risk !== undefined ? { risk: flags.risk } : {}),
+    });
+}

package/dist/lib/triggers.d.ts

@@ -1,4 +1,4 @@
-import { type EmbeddedActionRef, type TriggerPreflightReport } from '@skrr-ai/data-provider';
+import { type EmbeddedActionRef, type TriggerPreflightReport, type TriggerSensorConfig } from '@skrr-ai/data-provider';
 export declare const TRIGGER_KINDS: readonly ["schedule", "once", "event", "stochastic", "self_scheduled", "on_demand", "form", "chat_message"];
 export declare const TRIGGER_SCOPE_KINDS: readonly ["agent", "group_chat_subscriber", "space_oracle", "space_subscriber", "key_result_watcher", "task_watcher", "goal_watcher", "entity_reminder"];
 /**
@@ -18,7 +18,7 @@ export declare const TRIGGER_SCOPE_KINDS: readonly ["agent", "group_chat_subscri
  * capability was live and unreachable. `watch_until` and `sensor_poll` had been
  * in that state for longer.
  */
-export declare const TRIGGER_EXECUTOR_MODES: readonly ["send_message", "run_only", "enqueue_group_chat_agent_turn", "enqueue_assistant_turn", "enqueue_space_assistant_turn", "proactive_orchestrator_check", "auto_dream_orchestrator", "task_schedule_fire", "goal_planner_tick", "morning_briefing", "builtin_action", "task_execute", "watch_until", "sensor_poll", "external_work_task", "notify_user", "space_cycle_rollover"];
+export declare const TRIGGER_EXECUTOR_MODES: readonly ["send_message", "run_only", "enqueue_group_chat_agent_turn", "enqueue_assistant_turn", "enqueue_space_assistant_turn", "proactive_orchestrator_check", "auto_dream_orchestrator", "task_schedule_fire", "goal_planner_tick", "morning_briefing", "builtin_action", "task_execute", "watch_until", "sensor_poll", "external_work_task", "notify_user", "space_cycle_rollover", "workflow_signal"];
 export declare const TRIGGER_EVENT_FILTER_MODES: readonly ["equals", "contains", "in_set"];
 export declare const TRIGGER_CONCURRENCY_POLICIES: readonly ["coalesce_if_active", "allow_parallel"];
 export declare const TRIGGER_FORM_RESPONSE_MODES: readonly ["thank_you_page", "redirect_url", "run_complete"];
@@ -85,7 +85,9 @@ export interface TriggerDefinition {
         kind?: string;
         refs?: Record<string, unknown>;
     };
-    execution?: Record<string, unknown>;
+    execution?: Record<string, unknown> & {
+        sensor?: TriggerSensorConfig;
+    };
     schedule?: Record<string, unknown>;
     once?: Record<string, unknown>;
     event?: Record<string, unknown>;
@@ -341,6 +343,12 @@ export declare function nextRunLabel(trigger: TriggerDefinition): string;
  *     (OSK-7711).
  */
 export declare function armedLabel(trigger: TriggerDefinition): string;
+/**
+ * A keyed sensor that is still ENABLED but degraded (an item has failed for
+ * dozens of polls) reads `yes` in ARMED, which is true and not the whole story.
+ * Marked here so the list says it, not only `triggers show`.
+ */
+export declare function degradedMarker(trigger: TriggerDefinition): string;
 export declare function renderTriggerList(triggers: TriggerDefinition[], log: (line: string) => void): void;
 /**
  * The `duplicate_subscription` warning a create response may carry, as the

package/dist/lib/triggers.js

@@ -29,6 +29,7 @@ exports.fetchAgentScopedTrigger = fetchAgentScopedTrigger;
 exports.scopeLabel = scopeLabel;
 exports.nextRunLabel = nextRunLabel;
 exports.armedLabel = armedLabel;
+exports.degradedMarker = degradedMarker;
 exports.renderTriggerList = renderTriggerList;
 exports.formatDuplicateSubscriptionWarning = formatDuplicateSubscriptionWarning;
 exports.armedStateLabel = armedStateLabel;
@@ -99,6 +100,9 @@ exports.TRIGGER_EXECUTOR_MODES = [
     'external_work_task',
     'notify_user',
     'space_cycle_rollover',
+    // Resolve a workflow step an agent parked with `workflow_await`, when this
+    // trigger's event arrives. Needs `--workflow-event-key`.
+    'workflow_signal',
 ];
 exports.TRIGGER_EVENT_FILTER_MODES = ['equals', 'contains', 'in_set'];
 exports.TRIGGER_CONCURRENCY_POLICIES = ['coalesce_if_active', 'allow_parallel'];
@@ -748,6 +752,15 @@ function armedLabel(trigger) {
     }
     return 'yes';
 }
+/**
+ * A keyed sensor that is still ENABLED but degraded (an item has failed for
+ * dozens of polls) reads `yes` in ARMED, which is true and not the whole story.
+ * Marked here so the list says it, not only `triggers show`.
+ */
+function degradedMarker(trigger) {
+    const reason = trigger.execution?.sensor?.state?.degradedReason;
+    return reason ? ' (degraded)' : '';
+}
 function renderTriggerList(triggers, log) {
     if (triggers.length === 0) {
         log('No triggers.');
@@ -756,7 +769,7 @@ function renderTriggerList(triggers, log) {
     (0, format_1.renderTable)(triggers.map((trigger) => ({
         id: trigger.id ?? '-',
         kind: trigger.kind ?? '-',
-        enabled: armedLabel(trigger),
+        enabled: `${armedLabel(trigger)}${degradedMarker(trigger)}`,
         scope: scopeLabel(trigger),
         next: nextRunLabel(trigger),
         label: trigger.label ?? '',
@@ -768,6 +781,12 @@ function renderTriggerList(triggers, log) {
         { key: 'next', header: 'NEXT/LAST', maxWidth: 24 },
         { key: 'label', header: 'LABEL', maxWidth: 32 },
     ], log);
+    const degraded = triggers.filter((t) => degradedMarker(t));
+    if (degraded.length > 0) {
+        log('');
+        log(`${degraded.length} trigger(s) are enabled but degraded — ` +
+            'see `Degraded:` in `triggers show <id>`.');
+    }
     const unsynced = triggers.filter((t) => armedLabel(t).startsWith('!'));
     if (unsynced.length > 0) {
         log('');
@@ -872,6 +891,44 @@ function renderTriggerSummary(trigger, log, options = {}) {
         log(`Label:    ${trigger.label}`);
     if (trigger.execution?.mode)
         log(`Mode:     ${String(trigger.execution.mode)}`);
+    const sensor = trigger.execution?.mode === 'sensor_poll' ? trigger.execution.sensor : undefined;
+    if (sensor?.measureSink) {
+        log(`Measure:  ${sensor.measureSink.measureId} — platform fetched, unconfirmed`);
+        if (sensor.state?.lastSinkError)
+            log(`Sink:     ${sensor.state.lastSinkError}`);
+        else if (sensor.state?.lastSinkAt)
+            log(`Sink:     last reading ${sensor.state.lastSinkValue ?? '-'} at ${sensor.state.lastSinkAt}`);
+        else
+            log('Sink:     awaiting a numeric reading');
+    }
+    // A keyed sensor can be quietly blind (items held back, unreadable, failing).
+    // Each count is printed, and zero is printed too: "0" and "absent" must read
+    // differently from a sensor that has never been counted.
+    if (sensor?.cursor?.mode === 'keyed' && sensor.state) {
+        const st = sensor.state;
+        const n = (v) => v ?? 0;
+        log(`Keyed:    deferred ${n(st.deferredCount)}, unreadable ${n(st.unreadableCount)}, failed ${n(st.failedItemCount)}, quarantined ${n(st.quarantinedCount)}, duplicates ${n(st.duplicateCount)}, unsubjected ${n(st.unsubjectedCount)} (cumulative)`);
+    }
+    if (sensor?.cursor?.mode === 'keyed' && sensor.state) {
+        const st = sensor.state;
+        // A reseed publishes nothing by design, so it is the one change nothing
+        // else records: say when it happened, why, and how often.
+        if (st.reseededAt) {
+            const why = st.reseededReason
+                ? (data_provider_1.KEYED_RESEED_COPY[st.reseededReason] ?? st.reseededReason)
+                : 'reason not recorded';
+            log(`Reseeded: ${st.reseededAt} (${st.reseededReason ?? 'unknown'}: ${why}); ${st.reseedCount ?? 1} time(s); nothing was published for it`);
+        }
+        if (st.itemFailurePolls)
+            log(`Items:    failing for ${st.itemFailurePolls} poll(s) in a row`);
+    }
+    // The sensor is degraded, not just carrying a line of text: say it first.
+    if (sensor?.state?.degradedReason)
+        log(`Degraded: ${sensor.state.degradedReason}`);
+    if (sensor?.state?.consecutiveErrors)
+        log(`Errors:   ${sensor.state.consecutiveErrors} feed failure(s) in a row (the sensor disables itself if the feed keeps failing)`);
+    if (sensor?.state?.lastError)
+        log(`Problem:  ${sensor.state.lastError}`);
     // An `external_work_task` writes into someone else's system, and which
     // contract governs that write — and whether it posts by itself — was readable
     // only by pulling `execution.effectPolicy` out of raw JSON. A trigger that can

package/dist/lib/unsupported-managed-task-write.d.ts

@@ -0,0 +1,2 @@
+/** Refuse before a composite command can partially mutate a Task as Human. */
+export declare function refuseUnsupportedManagedTaskWrite(operation: string, supportedTool?: string, env?: Record<string, string | undefined>): void;

package/dist/lib/unsupported-managed-task-write.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refuseUnsupportedManagedTaskWrite = refuseUnsupportedManagedTaskWrite;
+const credential_resolver_1 = require("./credential-resolver");
+/** Refuse before a composite command can partially mutate a Task as Human. */
+function refuseUnsupportedManagedTaskWrite(operation, supportedTool, env = process.env) {
+    if (!(0, credential_resolver_1.resolveTrustedAutonomousCredential)(env))
+        return;
+    throw Object.assign(new Error(`${operation} have no bound-session CLI endpoint. ` +
+        (supportedTool ? `Use ${supportedTool} through this Agent’s authenticated tool runtime, or ask a person to make the change. ` : 'Ask a person to make this change. ') +
+        'No Task was changed and no files were uploaded.'), { code: 'SESSION_TASK_WRITE_UNSUPPORTED' });
+}

package/dist/lib/usage-discovery.d.ts

@@ -23,6 +23,14 @@ import type { CommandManifest } from './command-manifest';
  * only then whether the bound is still the right size.
  */
 export declare const USAGE_OVERVIEW_TOKEN_BUDGET = 240;
+/**
+ * Topics listed under another domain instead of as their own overview line.
+ * Every command keeps its own id (`skrr proposals list`); only the discovery
+ * grouping changes, and `skrr usage <folded>` resolves to the host page, which
+ * names the folded topic in an `Includes:` line so it stays reachable.
+ * `proposals` is the unified proposal inbox, so it reads as part of `inbox`.
+ */
+export declare const USAGE_DOMAIN_FOLDS: Readonly<Record<string, string>>;
 export declare const USAGE_DOMAIN_TOKEN_BUDGET = 500;
 export type UsageCommand = {
     command: string;
@@ -46,6 +54,8 @@ export type UsageReference = {
     object: 'sky_usage_reference';
     generatedFrom: 'oclif.manifest.json';
     domain: string;
+    /** Topics folded into this domain (see `USAGE_DOMAIN_FOLDS`). */
+    includes?: string[];
     tokenBudget: number;
     estimatedTokens: number;
     page: number;

package/dist/lib/usage-discovery.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.USAGE_DOMAIN_TOKEN_BUDGET = exports.USAGE_OVERVIEW_TOKEN_BUDGET = void 0;
+exports.USAGE_DOMAIN_TOKEN_BUDGET = exports.USAGE_DOMAIN_FOLDS = exports.USAGE_OVERVIEW_TOKEN_BUDGET = void 0;
 exports.estimateUsageTokens = estimateUsageTokens;
 exports.usageDomains = usageDomains;
 exports.buildUsageOverview = buildUsageOverview;
@@ -34,6 +34,14 @@ const command_manifest_1 = require("./command-manifest");
  * only then whether the bound is still the right size.
  */
 exports.USAGE_OVERVIEW_TOKEN_BUDGET = 240;
+/**
+ * Topics listed under another domain instead of as their own overview line.
+ * Every command keeps its own id (`skrr proposals list`); only the discovery
+ * grouping changes, and `skrr usage <folded>` resolves to the host page, which
+ * names the folded topic in an `Includes:` line so it stays reachable.
+ * `proposals` is the unified proposal inbox, so it reads as part of `inbox`.
+ */
+exports.USAGE_DOMAIN_FOLDS = { proposals: 'inbox' };
 exports.USAGE_DOMAIN_TOKEN_BUDGET = 500;
 const GENERIC_FLAGS = new Set(['bare', 'help', 'json', 'token', 'workspace']);
 /**
@@ -74,7 +82,8 @@ function buildUsageOverview(manifest, bin = 'skrr') {
 }
 /** Return case-insensitive manifest domain names without inventing aliases. */
 function resolveUsageDomain(manifest, value) {
-    const needle = value.trim().toLowerCase();
+    const trimmed = value.trim().toLowerCase();
+    const needle = exports.USAGE_DOMAIN_FOLDS[trimmed] ?? trimmed;
     return usageDomains(manifest).find(({ domain }) => domain.toLowerCase() === needle)?.domain;
 }
 /**
@@ -95,10 +104,12 @@ function buildUsageReference(manifest, domainInput, options = {}) {
     if (!Number.isInteger(requested) || index < 0 || index >= pages.length)
         return undefined;
     const data = pages[index];
+    const includes = foldedTopics(manifest, domain);
     const draft = {
         object: 'sky_usage_reference',
         generatedFrom: 'oclif.manifest.json',
         domain,
+        ...(includes.length > 0 ? { includes } : {}),
         tokenBudget: exports.USAGE_DOMAIN_TOKEN_BUDGET,
         estimatedTokens: 0,
         page: requested,
@@ -122,6 +133,8 @@ function renderUsageReference(reference, bin = 'skrr') {
         `${reference.domain} commands — page ${reference.page}/${reference.pages} ` +
             `(${reference.commandCount} total; manifest-derived).`,
     ];
+    if (reference.includes?.length)
+        lines.push(`Includes: ${reference.includes.join(', ')}.`);
     for (const command of reference.data) {
         const flags = command.keyFlags.length > 0 ? ` Flags: ${command.keyFlags.join(', ')}.` : '';
         lines.push(`${bin} ${command.command} — ${command.description}.${flags} Example: ${command.example}`);
@@ -167,13 +180,21 @@ function auditUsageBudgets(manifest, bin = 'skrr') {
 function groupEntries(manifest) {
     const grouped = new Map();
     for (const entry of (0, command_manifest_1.visibleCommandEntries)(manifest)) {
-        const domain = entry.id.split(':')[0];
+        const topic = entry.id.split(':')[0];
+        const domain = exports.USAGE_DOMAIN_FOLDS[topic] ?? topic;
         const existing = grouped.get(domain) ?? [];
         existing.push(entry);
         grouped.set(domain, existing);
     }
     return grouped;
 }
+function foldedTopics(manifest, domain) {
+    const present = new Set((0, command_manifest_1.visibleCommandEntries)(manifest).map((entry) => entry.id.split(':')[0]));
+    return Object.entries(exports.USAGE_DOMAIN_FOLDS)
+        .filter(([topic, host]) => host === domain && present.has(topic))
+        .map(([topic]) => topic)
+        .sort();
+}
 function usageCommand(entry, bin) {
     const flags = Object.entries(entry.flags)
         .filter(([, value]) => !value.hidden)

package/dist/lib/workflow-run-budget.d.ts

@@ -0,0 +1,12 @@
+type RunLike = Record<string, unknown>;
+/**
+ * Human lines for a run's duration budget and for a run the budget stopped.
+ *
+ * The server derives `budget` per read and stamps `error.code =
+ * WORKFLOW_RUN_DEADLINE` on a run it cancelled; this only words them. A run with
+ * neither prints nothing: no budget is not "0 minutes left".
+ */
+export declare function describeRunBudget(run: RunLike): string[];
+/** The status cell, naming a time-limit stop where the plain status would hide it. */
+export declare function runStatusLabel(run: RunLike): string;
+export {};