@skrr-ai/cli 0.1.97 → 0.1.99

package/dist/commands/signals/sources/list.d.ts

@@ -1,5 +1,5 @@
-import { BaseCommand } from '../../../base-command';
-export default class SourcesList extends BaseCommand {
+import { SignalCommand } from '../../../signal-command';
+export default class SourcesList extends SignalCommand {
     static description: string;
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/signals/sources/list.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const base_command_1 = require("../../../base-command");
+const signal_command_1 = require("../../../signal-command");
 const signals_1 = require("../../../lib/signals");
-class SourcesList extends base_command_1.BaseCommand {
+class SourcesList extends signal_command_1.SignalCommand {
     static description = 'List Signal sources (read-only; credentials are never shown)';
     static flags = { json: core_1.Flags.boolean({ description: 'Output as JSON' }) };
     async run() {

package/dist/commands/signals/sources/receipts.d.ts

@@ -1,5 +1,5 @@
-import { BaseCommand } from '../../../base-command';
-export default class SourcesReceipts extends BaseCommand {
+import { SignalCommand } from '../../../signal-command';
+export default class SourcesReceipts extends SignalCommand {
     static description: string;
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/signals/sources/receipts.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const base_command_1 = require("../../../base-command");
+const signal_command_1 = require("../../../signal-command");
 const signals_1 = require("../../../lib/signals");
-class SourcesReceipts extends base_command_1.BaseCommand {
+class SourcesReceipts extends signal_command_1.SignalCommand {
     static description = 'List recent redacted receipts of a Signal source';
     static flags = { json: core_1.Flags.boolean({ description: 'Output as JSON' }) };
     static args = { id: core_1.Args.string({ required: true, ignoreStdin: true }) };

package/dist/commands/signals/sources/show.d.ts

@@ -1,5 +1,5 @@
-import { BaseCommand } from '../../../base-command';
-export default class SourcesShow extends BaseCommand {
+import { SignalCommand } from '../../../signal-command';
+export default class SourcesShow extends SignalCommand {
     static description: string;
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/signals/sources/show.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const base_command_1 = require("../../../base-command");
+const signal_command_1 = require("../../../signal-command");
 const signals_1 = require("../../../lib/signals");
-class SourcesShow extends base_command_1.BaseCommand {
+class SourcesShow extends signal_command_1.SignalCommand {
     static description = 'Show one Signal source (read-only)';
     static flags = { json: core_1.Flags.boolean({ description: 'Output as JSON' }) };
     static args = { id: core_1.Args.string({ required: true, ignoreStdin: true }) };

package/dist/commands/tasks/assign.js

@@ -196,11 +196,10 @@ class TasksAssign extends base_command_1.BaseCommand {
         if (flags.json) {
             this.log(JSON.stringify({
                 ...(0, web_url_1.withTaskUrl)(this.cliConfig.baseURL, updated),
-                // What each free-text reference actually became — so a caller can
-                // verify the resolution rather than trust it.
+                // Keep request details separate from the canonical assignee arrays
+                // returned by the server, especially when removing co-assignees.
+                assignmentAction: flags.remove ? 'remove' : flags.replace ? 'replace' : 'add',
                 resolved: [...people.resolved, ...agents.resolved],
-                assigneeUserIds: userIds,
-                assigneeAgentIds: agentIds,
             }, null, 2));
             return;
         }

package/dist/commands/tasks/complete.d.ts

@@ -10,6 +10,7 @@ export declare function describePendingReview({ statusType, taskId, resultId, bi
     }>;
 }): string | null;
 export default class TasksComplete extends BaseCommand {
+    static autonomousCredentialPolicy: "bound-session";
     static description: string;
     static examples: string[];
     static args: {

package/dist/commands/tasks/complete.js

@@ -99,6 +99,7 @@ function describePendingReview({ statusType, taskId, resultId, bin, advisories,
         'may close without one — an override is recorded on the resolution.)');
 }
 class TasksComplete extends base_command_1.BaseCommand {
+    static autonomousCredentialPolicy = 'bound-session';
     static description = 'Submit one versioned Result and advance the Task workflow';
     static examples = [
         '<%= config.bin %> tasks complete <task> --summary "Implemented and verified the fix" --deliverable <resource-link-id>',

package/dist/commands/tasks/create.js

@@ -159,9 +159,11 @@ class TasksCreate extends base_command_1.BaseCommand {
             description: 'Task priority',
             options: [...tasks_1.TASK_PRIORITIES],
         }),
-        parent: core_1.Flags.string({ description: 'Parent task ID' }),
+        parent: core_1.Flags.string({
+            description: 'Structural parent task ID. Child statuses roll up; all terminal children can automatically close the parent, with unmet obligations recorded. Use --spawned-by for supporting work without status rollup.',
+        }),
         'spawned-by': core_1.Flags.string({
-            description: 'Task whose execution produced this one (lineage). Distinct from --parent (containment) and blockers (ordering).',
+            description: 'Task whose execution produced this one (lineage only, without parent status rollup). Use --parent for structural containment and blockers for ordering.',
         }),
         'spawn-reason': core_1.Flags.string({
             description: 'Why this work exists',

package/dist/commands/tasks/deliverable/add.d.ts

@@ -10,6 +10,7 @@ export declare function defaultDeliverableIdempotencyKey(task: string, payload:
  * optional structured one.
  */
 export default class TasksDeliverableAdd extends BaseCommand {
+    static autonomousCredentialPolicy: "bound-session";
     static description: string;
     static examples: string[];
     static args: {

package/dist/commands/tasks/deliverable/add.js

@@ -59,6 +59,7 @@ function defaultDeliverableIdempotencyKey(task, payload) {
  * optional structured one.
  */
 class TasksDeliverableAdd extends base_command_1.BaseCommand {
+    static autonomousCredentialPolicy = 'bound-session';
     static description = 'Record something this task produced (a commit, a page, a URL, a file, a message, a dataset).\n' +
         '\n' +
         'IDENTITY is the part before @; LOCATION is the part after it. They are not the same ' +

package/dist/commands/tasks/result/submit.d.ts

@@ -1,5 +1,6 @@
 import { BaseCommand } from '../../../base-command';
 export default class TasksResultSubmit extends BaseCommand {
+    static autonomousCredentialPolicy: "bound-session";
     static description: string;
     static examples: string[];
     static args: {

package/dist/commands/tasks/result/submit.js

@@ -53,6 +53,7 @@ function parseJson(value, label) {
     }
 }
 class TasksResultSubmit extends base_command_1.BaseCommand {
+    static autonomousCredentialPolicy = 'bound-session';
     static description = 'Submit the Task Result; this does not self-accept it or turn a domain conclusion into a Review';
     static examples = [
         '<%= config.bin %> tasks result submit <task> --summary "NO-SHIP until Gates A-D pass" --conclusion-type release_recommendation --conclusion-json \'{"posture":"no_ship"}\'',

package/dist/commands/tasks/resume/save.d.ts

@@ -1,5 +1,6 @@
 import { BaseCommand } from '../../../base-command';
 export default class TasksResumeSave extends BaseCommand {
+    static autonomousCredentialPolicy: "bound-session";
     static description: string;
     static args: {
         task: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;

package/dist/commands/tasks/resume/save.js

@@ -9,6 +9,7 @@ const api_fetch_1 = require("../../../lib/api-fetch");
 const session_task_write_1 = require("../../../lib/session-task-write");
 const prompt_1 = require("../../../lib/prompt");
 class TasksResumeSave extends base_command_1.BaseCommand {
+    static autonomousCredentialPolicy = 'bound-session';
     static description = 'Save recovery state without publishing a visible Task Update';
     static args = {
         task: core_1.Args.string({ required: false, ignoreStdin: true, description: 'Task id or ref' }),

package/dist/commands/tasks/retry.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const task_resolver_1 = require("../../lib/task-resolver");
+const start_1 = require("./start");
 /**
  * OSK-3815 — the CLI verb for the `retry_task` action.
  *
@@ -72,8 +73,9 @@ class TasksRetry extends base_command_1.BaseCommand {
         // Step 1 — clear the terminal state. `todo` rather than `backlog`: the task
         // was already triaged into the working set once, and a retry is not a
         // decision to deprioritise it.
+        let movedTask;
         try {
-            await data_provider_1.dataService.moveTask({
+            movedTask = await data_provider_1.dataService.moveTask({
                 taskId: taskRef,
                 status: 'todo',
             });
@@ -81,13 +83,23 @@ class TasksRetry extends base_command_1.BaseCommand {
         catch (err) {
             this.handleApiError(err, { subject: `Task ${taskRef}` });
         }
+        // This receipt describes the first committed transition. Dispatch may
+        // change the Task again, so it is not an overall current-state snapshot.
+        const statusTransition = { requestedStatus: 'todo', task: movedTask };
         if (flags['no-start']) {
             if (flags.json) {
-                this.log(JSON.stringify({ taskId: taskRef, status: 'todo', started: false }));
+                this.log(JSON.stringify({
+                    taskId: taskRef,
+                    status: movedTask?.status,
+                    started: false,
+                    statusTransition,
+                }));
                 return;
             }
-            this.log(`Cleared failed state on ${taskRef} — now todo, not started.`);
-            this.log(`Start it with: skrr tasks start ${taskRef}`);
+            this.log(`Cleared failed state on ${taskRef}; execution was not requested.`);
+            if (typeof movedTask?.status === 'string')
+                this.log(`Status: ${movedTask.status}`);
+            this.log(`Start it with: ${this.config.bin} tasks start ${taskRef}`);
             return;
         }
         let result;
@@ -95,12 +107,32 @@ class TasksRetry extends base_command_1.BaseCommand {
             result = await data_provider_1.dataService.startTask(taskRef, flags.skill ? { skillId: flags.skill } : undefined);
         }
         catch (err) {
+            const waiting = (0, start_1.waitingForMachine)(err);
+            if (waiting) {
+                if (flags.json) {
+                    this.log(JSON.stringify({
+                        waiting: true,
+                        code: 'TASK_WAITING_FOR_MACHINE',
+                        taskId: taskRef,
+                        started: false,
+                        statusTransition,
+                        ...waiting,
+                    }, null, 2));
+                    return;
+                }
+                this.log(`Task ${taskRef} is waiting for the machine to start; the task will run by itself once it is ready.`);
+                if (waiting.message)
+                    this.log(waiting.message);
+                return;
+            }
+            const observedStatus = typeof movedTask?.status === 'string' ? ` (returned status '${movedTask.status}')` : '';
             this.handleApiError(err, {
-                subject: `Task ${taskRef} (failed state was cleared — it is now 'todo')`,
+                subject: `Task ${taskRef} (status transition committed${observedStatus}; start was not confirmed. ` +
+                    `Check ${this.config.bin} tasks show ${taskRef}, then use ${this.config.bin} tasks start ${taskRef} if needed)`,
             });
         }
         if (flags.json) {
-            this.log(JSON.stringify({ ...result, taskId: taskRef, status: 'todo', started: true }, null, 2));
+            this.log(JSON.stringify({ ...result, taskId: taskRef, started: true, statusTransition }, null, 2));
             return;
         }
         this.log(`Retried task ${taskRef}`);

package/dist/commands/tasks/show.js

@@ -518,7 +518,9 @@ class TasksShow extends base_command_1.BaseCommand {
             : ''}`);
         const actionability = t.actionability;
         if (actionability) {
-            this.log(`Next action: ${actionability.nextActor ?? '-'} · ${actionability.state ?? '-'} · ${actionability.reasonCode ?? '-'}`);
+            this.log(actionability.state === 'terminal'
+                ? 'Workflow:    ended · no next executor'
+                : `Next action: ${actionability.nextActor ?? '-'} · ${actionability.state ?? '-'} · ${actionability.reasonCode ?? '-'}`);
             this.log(`Why:         ${actionability.reason ?? '-'}`);
             await this.printBlockerDetail(t, actionability);
         }

package/dist/commands/tasks/update.js

@@ -308,20 +308,47 @@ class TasksUpdate extends base_command_1.BaseCommand {
                 const field = expectationsPatch !== undefined || body.expectations !== undefined
                     ? 'Changing Expectations'
                     : 'Changing the description';
-                this.log(`${field} advances the Task specification, so ${count} ${noun} ` +
-                    'will stop counting and must be recorded again.');
+                const disclosure = [
+                    `${field} advances the Task specification, so ${count} ${noun} ` +
+                        'will stop counting and must be recorded again.',
+                ];
                 /*
                  * NAME them. The count alone made the warning unactionable — and it is
                  * task-WIDE, so Expectations you are not touching lose their judgements
                  * too, which a bare number actively hides.
                  */
                 for (const row of settled) {
-                    this.log(`  ${row.id}  ${row.sentence || row.text || ''}`);
+                    disclosure.push(`  ${row.id}  ${row.sentence || row.text || ''}`);
                 }
                 if (settled.length > 0) {
-                    this.log('Revocation covers every Expectation on this Task, including ones this edit ' +
+                    disclosure.push('Revocation covers every Expectation on this Task, including ones this edit ' +
                         'does not touch.');
                 }
+                if (flags.json) {
+                    // JSON callers acknowledge with --yes. Neither disclosure prose nor
+                    // an interactive prompt may precede the single machine-readable result.
+                    this.failWithCliError({
+                        message: disclosure.join('\n') +
+                            '\nNo change made — re-run with `--yes` to accept the revocation.',
+                        code: 'TASK_SPEC_CHANGE_CONFIRMATION_REQUIRED',
+                        exit: 2,
+                        retryable: false,
+                        details: {
+                            taskId: taskRef,
+                            assessmentCount: acceptanceUnreadable ? null : settled.length,
+                            acceptanceReadable: !acceptanceUnreadable,
+                            affectedExpectations: settled.map((row) => ({
+                                id: row.id,
+                                text: row.sentence || row.text || '',
+                            })),
+                            revocationScope: 'all_expectations',
+                            confirmationFlag: '--yes',
+                            disclosure,
+                        },
+                    });
+                }
+                for (const line of disclosure)
+                    this.log(line);
                 const ok = await this.confirm('Continue? [y/N] ');
                 if (!ok) {
                     /*

package/dist/commands/tasks/updates/add.d.ts

@@ -1,5 +1,6 @@
 import { BaseCommand } from '../../../base-command';
 export default class TasksUpdatesAdd extends BaseCommand {
+    static autonomousCredentialPolicy: "bound-session";
     static description: string;
     static examples: string[];
     static args: {

package/dist/commands/tasks/updates/add.js

@@ -60,6 +60,7 @@ function parseJsonObject(value, label) {
     return parsed;
 }
 class TasksUpdatesAdd extends base_command_1.BaseCommand {
+    static autonomousCredentialPolicy = 'bound-session';
     static description = 'Record a meaningful Task Update, optionally with recovery state';
     static examples = [
         '<%= config.bin %> tasks updates add <task> --type progress --summary "Migration review complete" --data \'{"completedSinceLast":["Checked migrations 001-014"],"nextActions":["Review authorization"]}\'',

package/dist/lib/commitments.js

@@ -1037,6 +1037,23 @@ columns, empty, log) {
     }
     (0, format_1.renderTable)(rows, columns, log);
 }
+function describeRunCount(usage, key) {
+    const value = usage?.[key];
+    const status = usage?.[`${key}Status`];
+    if (status === 'unknown' ||
+        typeof value !== 'number' ||
+        !Number.isSafeInteger(value) ||
+        value < 0) {
+        return 'unknown';
+    }
+    // A native session proves a floor, not the provider's complete internal
+    // activity. Preserve that distinction in the human ledger, too.
+    if (status === 'lower_bound')
+        return `at least ${value}`;
+    if (status !== undefined && status !== null)
+        return 'unknown';
+    return String(value);
+}
 /** Human view for `commitments ledger`; JSON remains the automation surface. */
 function renderCommitmentLedger(ledger, log) {
     const checks = records(ledger.checks);
@@ -1073,12 +1090,16 @@ function renderCommitmentLedger(ledger, log) {
             id: text(item.id),
             status: text(item.status),
             attempt: `${text(item.attempt, '0')}/${text(item.maxAttempts, '-')}`,
+            turns: describeRunCount(record(item.usage), 'turns'),
+            tools: describeRunCount(record(item.usage), 'toolCallCount'),
             reason: text(firstValue(item, ['reason', 'error']), ''),
             finished: text(firstValue(item, ['completedAt', 'updatedAt', 'startedAt'])),
         })), [
             { key: 'id', header: 'RUN ID', verbatim: true },
             { key: 'status', header: 'STATUS', maxWidth: 12 },
             { key: 'attempt', header: 'ATTEMPT' },
+            { key: 'turns', header: 'TURNS' },
+            { key: 'tools', header: 'TOOLS' },
             { key: 'reason', header: 'REASON', maxWidth: 36 },
             { key: 'finished', header: 'LAST UPDATED', maxWidth: 24 },
         ], 'No runs recorded.', log);
@@ -1247,13 +1268,24 @@ function formatCommitmentCycles(page) {
  */
 function formatCycleLatency(cycle) {
     const latency = cycle.latency;
+    const history = cycle.historyDetail;
+    const disclosure = history?.state === 'compacted'
+        ? [
+            `             Detailed history was compacted${history.at ? ` at ${history.at}` : ''}; available reason and source timestamps were retained.`,
+        ]
+        : history?.state === 'unavailable'
+            ? ['             Detailed history is unavailable; why it is missing was not recorded.']
+            : [];
     const missingFor = (stage) => (latency?.pendingStages ? latency.pendingStages.includes(stage) : latency?.pending)
         ? 'pending'
         : 'unmeasurable';
     if (latency?.measured === false) {
-        return [`             latency: ${latency.pending ? 'pending' : 'unmeasurable'}`];
+        return [...disclosure, `             latency: ${latency.pending ? 'pending' : 'unmeasurable'}`];
     }
-    return Object.entries(latency?.stages || {}).map(([stage, ms]) => `             ${stage}: ${typeof ms === 'number' ? `${ms}ms` : missingFor(stage)}`);
+    return [
+        ...disclosure,
+        ...Object.entries(latency?.stages || {}).map(([stage, ms]) => `             ${stage === 'event_to_turn' ? 'event_to_turn (server handoff)' : stage}: ${typeof ms === 'number' ? `${ms}ms` : missingFor(stage)}`),
+    ];
 }
 const ANSWER_GLYPH = { yes: '✓', no: '✗', 'n/a': '–' };
 /** The six questions for the latest Cycle, the first ✗ carrying its fix. */

package/dist/lib/dedicated-machines.d.ts

@@ -633,15 +633,13 @@ export declare function dedicatedLeaseDisplayName(lease: DedicatedLease | Harnes
 /** `$12.34` — cents are what the API speaks; dollars are what a person reads. */
 export declare function formatUsdCents(cents: number | null | undefined): string;
 /**
- * `$1.23 this month for machines of this type · $500.00 cap for this machine`,
- * or why that sentence cannot be written.
+ * Name the monthly total that the machine's configured cap is checked against.
  *
- * The two figures are different scopes and the sentence has to say so. The spend
- * is a shared pot the server computes for (owner, team, machineProduct), so every
+ * The spend is a shared pot the server computes for (owner, team, machineProduct), so every
  * lease of the same product reports the same number — a machine created minutes
- * ago with no active seconds still reports the month's total. The cap is this
- * lease's own. Printed as "$1.23 this month of $500.00 cap" the only available
- * reading was that this machine had spent it.
+ * ago with no active seconds still reports the month's total. The cap is set on
+ * this lease, but admission compares it against that shared projected total.
+ * An old response without spendScope cannot establish who owns the total.
  */
 export declare function dedicatedSpendSummary(lease: DedicatedLease): string;
 /**

package/dist/lib/dedicated-machines.js

@@ -673,15 +673,13 @@ function formatUsdCents(cents) {
     return `${sign}$${(Math.abs(cents) / 100).toFixed(2)}`;
 }
 /**
- * `$1.23 this month for machines of this type · $500.00 cap for this machine`,
- * or why that sentence cannot be written.
+ * Name the monthly total that the machine's configured cap is checked against.
  *
- * The two figures are different scopes and the sentence has to say so. The spend
- * is a shared pot the server computes for (owner, team, machineProduct), so every
+ * The spend is a shared pot the server computes for (owner, team, machineProduct), so every
  * lease of the same product reports the same number — a machine created minutes
- * ago with no active seconds still reports the month's total. The cap is this
- * lease's own. Printed as "$1.23 this month of $500.00 cap" the only available
- * reading was that this machine had spent it.
+ * ago with no active seconds still reports the month's total. The cap is set on
+ * this lease, but admission compares it against that shared projected total.
+ * An old response without spendScope cannot establish who owns the total.
  */
 function dedicatedSpendSummary(lease) {
     const billing = lease.billing;
@@ -690,14 +688,22 @@ function dedicatedSpendSummary(lease) {
     const cap = billing.monthlySpendLimitCents !== undefined
         ? billing.monthlySpendLimitCents
         : billing.spendingLimitCents;
+    const scope = billing.spendScope?.kind === 'owner_product'
+        ? 'your machines of this type'
+        : billing.spendScope?.kind === 'workspace_product'
+            ? "this workspace's machines of this type"
+            : 'reported machines (scope unavailable)';
+    const capSummary = cap === null
+        ? 'no monthly cap'
+        : `${formatUsdCents(cap)} cap for this machine, checked against the projected monthly total`;
     if (billing.spendStatusUnavailable) {
-        return `spend unavailable right now · ${cap === null ? 'no monthly cap' : `cap ${formatUsdCents(cap)}`}`;
+        return `spend unavailable right now for ${scope} · ${capSummary}`;
     }
     const spent = billing.currentMonthSpendCents;
     const projected = billing.projectedCurrentMonthSpendCents;
     const parts = [
-        `${formatUsdCents(spent)} this month for machines of this type`,
-        cap === null ? 'no monthly cap' : `${formatUsdCents(cap)} cap for this machine`,
+        `${formatUsdCents(spent)} this month for ${scope}`,
+        capSummary,
     ];
     if (typeof projected === 'number' && projected !== spent) {
         parts.push(`projected ${formatUsdCents(projected)}`);
@@ -815,6 +821,9 @@ function describeDedicatedLease(lease, harnesses = [], opts = {}) {
             ? ''
             : (0, harnesses_1.describeHealthReasonSentences)(health.reasons, dedicatedLeaseState(lease));
         row('health', health.assignable ? 'can take work' : `not assignable${why ? `: ${why}` : ''}`);
+        if (health.assignable) {
+            row('provider auth', `separate from runtime health; inspect saved sign-in: skrr machines dedicated sign-in-status ${dedicatedLeaseId(lease)} (credentials supplied for a run may differ)`);
+        }
     }
     row('spend', lease.billing ? dedicatedSpendSummary(lease) : undefined);
     const deletionPlan = dedicatedDeletionLines(lease);

package/dist/lib/signals.js

@@ -2,23 +2,32 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signalsApi = void 0;
 const data_provider_1 = require("@skrr-ai/data-provider");
+const workspace_header_1 = require("./workspace-header");
+function inSignalWorkspace(operation) {
+    if (!(0, workspace_header_1.withWorkspaceHeader)({})['X-Workspace-Id']) {
+        throw new Error(process.env.OVERSKY_AUTONOMOUS_SESSION === '1'
+            ? 'Signal commands require a workspace-bound session. This session has no canonical workspace; --workspace and local selections cannot change its scope. No Signal request was sent.'
+            : 'Signal commands require a selected workspace. Pass --workspace <workspace-id>, or run `skrr workspaces list --json` then `skrr workspaces use <workspace-id>`. No Signal request was sent.');
+    }
+    return operation();
+}
 /**
  * Secret-free Signal lifecycle (`/api/signal-monitors`, read-only sources and schemas).
  * Source creation, credentials and schema review hand out one-display secrets and stay
  * in the reviewed UI until a headless secret-display contract is approved.
  */
 exports.signalsApi = {
-    listMonitors: () => data_provider_1.request.get('/api/signal-monitors'),
-    showMonitor: (id) => data_provider_1.request.get(`/api/signal-monitors/${encodeURIComponent(id)}`),
-    validateMonitor: (body) => data_provider_1.request.post('/api/signal-monitors/validate', body),
-    createMonitor: (body) => data_provider_1.request.post('/api/signal-monitors', body),
-    testMonitor: (id, body) => data_provider_1.request.post(`/api/signal-monitors/${encodeURIComponent(id)}/test`, body),
-    reviseMonitor: (id, body) => data_provider_1.request.post(`/api/signal-monitors/${encodeURIComponent(id)}/revisions`, body),
-    setMonitorStatus: (id, status) => data_provider_1.request.patch(`/api/signal-monitors/${encodeURIComponent(id)}`, { status }),
-    monitorTransitions: (id) => data_provider_1.request.get(`/api/signal-monitors/${encodeURIComponent(id)}/transitions`),
-    listSources: () => data_provider_1.request.get('/api/signal-sources'),
-    showSource: (id) => data_provider_1.request.get(`/api/signal-sources/${encodeURIComponent(id)}`),
-    sourceReceipts: (id) => data_provider_1.request.get(`/api/signal-sources/${encodeURIComponent(id)}/receipts`),
-    listSchemas: () => data_provider_1.request.get('/api/signal-schemas'),
-    showSchema: (id) => data_provider_1.request.get(`/api/signal-schemas/${encodeURIComponent(id)}`),
+    listMonitors: () => inSignalWorkspace(() => data_provider_1.request.get('/api/signal-monitors')),
+    showMonitor: (id) => inSignalWorkspace(() => data_provider_1.request.get(`/api/signal-monitors/${encodeURIComponent(id)}`)),
+    validateMonitor: (body) => inSignalWorkspace(() => data_provider_1.request.post('/api/signal-monitors/validate', body)),
+    createMonitor: (body) => inSignalWorkspace(() => data_provider_1.request.post('/api/signal-monitors', body)),
+    testMonitor: (id, body) => inSignalWorkspace(() => data_provider_1.request.post(`/api/signal-monitors/${encodeURIComponent(id)}/test`, body)),
+    reviseMonitor: (id, body) => inSignalWorkspace(() => data_provider_1.request.post(`/api/signal-monitors/${encodeURIComponent(id)}/revisions`, body)),
+    setMonitorStatus: (id, status) => inSignalWorkspace(() => data_provider_1.request.patch(`/api/signal-monitors/${encodeURIComponent(id)}`, { status })),
+    monitorTransitions: (id) => inSignalWorkspace(() => data_provider_1.request.get(`/api/signal-monitors/${encodeURIComponent(id)}/transitions`)),
+    listSources: () => inSignalWorkspace(() => data_provider_1.request.get('/api/signal-sources')),
+    showSource: (id) => inSignalWorkspace(() => data_provider_1.request.get(`/api/signal-sources/${encodeURIComponent(id)}`)),
+    sourceReceipts: (id) => inSignalWorkspace(() => data_provider_1.request.get(`/api/signal-sources/${encodeURIComponent(id)}/receipts`)),
+    listSchemas: () => inSignalWorkspace(() => data_provider_1.request.get('/api/signal-schemas')),
+    showSchema: (id) => inSignalWorkspace(() => data_provider_1.request.get(`/api/signal-schemas/${encodeURIComponent(id)}`)),
 };

package/dist/lib/space-usage.js

@@ -10,7 +10,7 @@ const usd = (amount) => amount > 0 && amount < 0.01 ? '<$0.01' : `$${amount.toFi
 function formatSpaceSpend(summary) {
     const attribution = `Attribution since: ${summary.coverage.attributionSince || 'not certified'}; not attributed: ${summary.coverage.notAttributed.join(', ')}`;
     if (summary.runCount === 0)
-        return `No runs in window\n${attribution}`;
+        return `No attributed runs in window\n${attribution}`;
     const cost = summary.costUsd === null ? 'Not fully attributed' : usd(summary.costUsd);
     const known = summary.knownCostUsd === null ? 'unavailable' : usd(summary.knownCostUsd);
     return `${cost}; known subtotal ${known}; ${summary.runCount} cost records; ${summary.byCostStatus.unavailable} unavailable, ${summary.byCostStatus.partial} partial\n${attribution}`;