@skrr-ai/cli 0.1.21 → 0.1.23

package/dist/commands/api-keys/create.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const managed_agent_keys_1 = require("../../lib/managed-agent-keys");
+/**
+ * Mint a Managed Agents API key for a Space.
+ *
+ * The secret is displayed EXACTLY ONCE. There is no endpoint that reveals it
+ * again, so this command says that where the value is printed rather than in a
+ * footnote — a caller that scrolls past it has to rotate.
+ */
+class ApiKeysCreate extends base_command_1.BaseCommand {
+    static description = 'Mint a Managed Agents API key (osk_*) for a Space. The secret is shown once and never again.';
+    static examples = [
+        '<%= config.bin %> api-keys create --space <space-id> --name "ci"',
+        '<%= config.bin %> api-keys create --space <space-id> --name "probe" --env test --scope environments:write',
+    ];
+    static args = {
+        name: core_1.Args.string({
+            description: 'Human label for the key (also settable with --name)',
+            // A positional that reads stdin would swallow a piped secret or script.
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        space: core_1.Flags.string({ description: 'Space that owns the key', required: true }),
+        name: core_1.Flags.string({ description: 'Human label for the key (≤200 chars)' }),
+        env: core_1.Flags.string({ description: 'Key environment', options: ['live', 'test'] }),
+        scope: core_1.Flags.string({
+            description: 'Scope to grant (repeatable, e.g. environments:write)',
+            multiple: true,
+        }),
+        'expires-at': core_1.Flags.string({ description: 'ISO 8601 expiry; must be in the future' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(ApiKeysCreate);
+        const name = flags.name || args.name;
+        if (!name) {
+            this.error('A name is required — pass it positionally or with --name.', { exit: 1 });
+        }
+        let minted;
+        try {
+            minted = await (0, managed_agent_keys_1.createManagedAgentKey)({
+                spaceId: flags.space,
+                name,
+                env: flags.env,
+                scopes: flags.scope,
+                expiresAt: flags['expires-at'],
+            });
+        }
+        catch (err) {
+            // Includes the deployment-configuration case: an unconfigured server
+            // answers 503 with a sentence naming MANAGED_AGENTS_KEY_PEPPER, which is
+            // addressed to an operator and is worth passing through verbatim rather
+            // than flattening into "could not create key".
+            this.handleApiError(err);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(minted, null, 2));
+            return;
+        }
+        this.log('');
+        this.log(`  ${minted.secret}`);
+        this.log('');
+        this.log(minted.secret_warning ||
+            'This is the only time the secret will be displayed. Store it securely.');
+        this.log('');
+        this.log(`  id     ${minted.id}`);
+        this.log(`  name   ${minted.name}`);
+        // No `env` field exists — the environment lives in the prefix, which is
+        // also the only part of a secret any later read will ever show.
+        this.log(`  prefix ${minted.prefix ?? '(none)'}`);
+        this.log(`  scopes ${minted.scopes?.length ? minted.scopes.join(', ') : '(none)'}`);
+    }
+}
+exports.default = ApiKeysCreate;

package/dist/commands/api-keys/list.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../base-command';
+/** Every Managed Agents API key on a Space, including revoked ones. */
+export default class ApiKeysList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/api-keys/list.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const managed_agent_keys_1 = require("../../lib/managed-agent-keys");
+/** Every Managed Agents API key on a Space, including revoked ones. */
+class ApiKeysList extends base_command_1.BaseCommand {
+    static description = "List a Space's Managed Agents API keys. Secrets are never shown — only prefixes.";
+    static examples = ['<%= config.bin %> api-keys list --space <space-id>'];
+    static flags = {
+        space: core_1.Flags.string({ description: 'Space that owns the keys', required: true }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(ApiKeysList);
+        let keys;
+        try {
+            keys = await (0, managed_agent_keys_1.listManagedAgentKeys)(flags.space);
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(keys, null, 2));
+            return;
+        }
+        if (keys.length === 0) {
+            this.log('No API keys on this space.');
+            return;
+        }
+        for (const k of keys) {
+            // A revoked key is listed rather than hidden: "this key was revoked" and
+            // "this key never existed" want different next actions.
+            const state = k.revoked_at ? 'revoked' : k.expires_at ? `expires ${k.expires_at}` : 'active';
+            // The prefix carries the environment; there is no separate field.
+            this.log(`${k.id}  ${(k.prefix ?? '').padEnd(12)}  ${state.padEnd(28)}  ${k.name}`);
+        }
+    }
+}
+exports.default = ApiKeysList;

package/dist/commands/api-keys/revoke.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../base-command';
+/** Revoke a key. Irreversible — a revoked key is replaced, never re-enabled. */
+export default class ApiKeysRevoke extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/api-keys/revoke.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const managed_agent_keys_1 = require("../../lib/managed-agent-keys");
+/** Revoke a key. Irreversible — a revoked key is replaced, never re-enabled. */
+class ApiKeysRevoke extends base_command_1.BaseCommand {
+    static description = 'Revoke a Managed Agents API key. Irreversible — mint a replacement rather than expecting to undo this.';
+    static examples = ['<%= config.bin %> api-keys revoke <key-id> --space <space-id>'];
+    static args = {
+        id: core_1.Args.string({ description: 'Key id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        space: core_1.Flags.string({ description: 'Space that owns the key', required: true }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(ApiKeysRevoke);
+        try {
+            const res = await (0, managed_agent_keys_1.revokeManagedAgentKey)(args.id, flags.space);
+            if (flags.json) {
+                this.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            this.log(`Revoked ${args.id}. Anything still presenting it will now be refused.`);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = ApiKeysRevoke;

package/dist/commands/api-keys/rotate.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Mint a replacement secret for an existing key row.
+ *
+ * Same once-only rule as `create`: the new secret is displayed here and nowhere
+ * else, and the previous one stops working.
+ */
+export default class ApiKeysRotate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/api-keys/rotate.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const managed_agent_keys_1 = require("../../lib/managed-agent-keys");
+/**
+ * Mint a replacement secret for an existing key row.
+ *
+ * Same once-only rule as `create`: the new secret is displayed here and nowhere
+ * else, and the previous one stops working.
+ */
+class ApiKeysRotate extends base_command_1.BaseCommand {
+    static description = 'Rotate a Managed Agents API key. The new secret is shown once; the old one stops working.';
+    static examples = ['<%= config.bin %> api-keys rotate <key-id> --space <space-id>'];
+    static args = {
+        id: core_1.Args.string({ description: 'Key id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        space: core_1.Flags.string({ description: 'Space that owns the key', required: true }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(ApiKeysRotate);
+        try {
+            const minted = await (0, managed_agent_keys_1.rotateManagedAgentKey)(args.id, flags.space);
+            if (flags.json) {
+                this.log(JSON.stringify(minted, null, 2));
+                return;
+            }
+            this.log('');
+            this.log(`  ${minted.secret}`);
+            this.log('');
+            this.log(minted.secret_warning ||
+                'This is the only time the secret will be displayed. The previous secret no longer works.');
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = ApiKeysRotate;

package/dist/commands/balance/index.d.ts

@@ -0,0 +1,18 @@
+import BalanceShow from './show';
+/**
+ * `skrr balance` — the balance, not a table of contents.
+ *
+ * The bare topic printed its tagline ("Your hosted usage balance — the ceiling
+ * that refuses a turn") and then a list of four subcommands, with no number
+ * anywhere. The tagline names the value and then does not show it, and three of
+ * the four subcommands are plausible answers to "what is my balance"
+ * (`show`, `usage`, `statement`) — so the reader who typed the noun they wanted
+ * has to disambiguate a menu to get it (OSK-7637).
+ *
+ * Running `show` is what the command's own first line promises. `--help` still
+ * lists every subcommand, which is where a menu belongs.
+ */
+export default class Balance extends BalanceShow {
+    static description: string;
+    static examples: string[];
+}

package/dist/commands/balance/index.js

@@ -0,0 +1,29 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const show_1 = __importDefault(require("./show"));
+/**
+ * `skrr balance` — the balance, not a table of contents.
+ *
+ * The bare topic printed its tagline ("Your hosted usage balance — the ceiling
+ * that refuses a turn") and then a list of four subcommands, with no number
+ * anywhere. The tagline names the value and then does not show it, and three of
+ * the four subcommands are plausible answers to "what is my balance"
+ * (`show`, `usage`, `statement`) — so the reader who typed the noun they wanted
+ * has to disambiguate a menu to get it (OSK-7637).
+ *
+ * Running `show` is what the command's own first line promises. `--help` still
+ * lists every subcommand, which is where a menu belongs.
+ */
+class Balance extends show_1.default {
+    static description = 'Show your hosted usage balance — the ceiling that refuses a turn (not the x402 wallet). ' +
+        'See `balance usage`, `balance statement` and `balance history` for the detail behind it.';
+    static examples = [
+        '<%= config.bin %> balance',
+        '<%= config.bin %> balance --json',
+        '<%= config.bin %> balance statement --desc',
+    ];
+}
+exports.default = Balance;

package/dist/commands/balance/show.d.ts

@@ -1,4 +1,13 @@
 import { BaseCommand } from '../../base-command';
+import { type RuntimeMonthlySpend } from '../../lib/harnesses';
+/**
+ * The hosted-runtime monthly cap rows, as lines.
+ *
+ * Pure so it can be tested the way `renderUsageSummary` is: this screen's job
+ * is to stop a user reading headroom off the wrong cap, and the wording is the
+ * fix, so the wording is what gets pinned.
+ */
+export declare function renderRuntimeSpend(spend: RuntimeMonthlySpend[], log: (line: string) => void): void;
 /**
  * YOUR hosted usage balance — the personal account, and only that one.
  *
@@ -33,6 +42,22 @@ export default class BalanceShow extends BaseCommand {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * The OTHER cap — the one that actually refuses a Hosted Machine.
+     *
+     * Everything above is the credits account and its per-period rate limit. A
+     * hosted runtime is additionally bounded by a MONTHLY spend cap that this
+     * screen never mentioned, so a user could read `Spend cap: $10.00 per day`
+     * and `Cap remaining: $10.00` — headroom on every visible number — while
+     * every agent turn on a Hosted Machine was being refused by a limit with no
+     * surface at all. They could only discover it by being turned away
+     * (OSK-7920, split out of OSK-7900 / OSK-7909).
+     *
+     * Best-effort by design. This is a second call on a screen whose primary
+     * answer is the balance, so a failure here prints a short line and leaves
+     * that answer intact rather than failing the command.
+     */
+    private renderRuntimeSpend;
     /**
      * The workspace account, which is the one a workspace-carrying session is
      * funded from. Rendered in the SAME credits-plus-dollars unit and row labels

package/dist/commands/balance/show.js

@@ -1,9 +1,41 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderRuntimeSpend = renderRuntimeSpend;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const balance_1 = require("../../lib/balance");
 const workspaces_1 = require("../../lib/workspaces");
+const harnesses_1 = require("../../lib/harnesses");
+const usd = (cents) => (typeof cents === 'number' ? `$${(cents / 100).toFixed(2)}` : '—');
+/**
+ * The hosted-runtime monthly cap rows, as lines.
+ *
+ * Pure so it can be tested the way `renderUsageSummary` is: this screen's job
+ * is to stop a user reading headroom off the wrong cap, and the wording is the
+ * fix, so the wording is what gets pinned.
+ */
+function renderRuntimeSpend(spend, log) {
+    const capped = spend.filter((row) => row.hasLimit);
+    if (capped.length === 0) {
+        // A product with no cap prints nothing rather than a reassuring "no limit"
+        // line: this section exists to warn, and an absent cap is not news.
+        return;
+    }
+    log('');
+    log('Hosted runtime — a SEPARATE monthly cap from the spend cap above:');
+    for (const row of capped) {
+        // `projected`, not `spent`: admission compares the cap against spend PLUS
+        // the estimated cost of everything still open. Showing only spend would
+        // read as headroom right up to the moment of refusal.
+        const flag = row.exceeded ? '  <- at the cap; turns are being refused' : '';
+        log(`  ${row.machineProduct.padEnd(18)} ${usd(row.projectedCents)} of ` +
+            `${usd(row.limitCents)} projected${flag}`);
+        if (typeof row.openUsageEstimateCents === 'number' && row.openUsageEstimateCents > 0) {
+            log(`  ${''.padEnd(18)} (${usd(row.currentSpendCents)} billed + ` +
+                `${usd(row.openUsageEstimateCents)} estimated for machines still open)`);
+        }
+    }
+}
 /**
  * YOUR hosted usage balance — the personal account, and only that one.
  *
@@ -140,6 +172,7 @@ class BalanceShow extends base_command_1.BaseCommand {
         else {
             this.log('  Auto-refill:    off');
         }
+        await this.renderRuntimeSpend();
         this.log('');
         this.log('A credit is a micro-dollar: 1,000,000 credits = $1.00. The spend cap');
         this.log('is a per-period ceiling, not a second balance. `skrr balance statement`');
@@ -150,6 +183,33 @@ class BalanceShow extends base_command_1.BaseCommand {
         this.log('see `skrr balance show --workspace <id>`. `skrr payments wallet` is the');
         this.log('separate x402 crypto wallet, in USDC — not this balance.');
     }
+    /**
+     * The OTHER cap — the one that actually refuses a Hosted Machine.
+     *
+     * Everything above is the credits account and its per-period rate limit. A
+     * hosted runtime is additionally bounded by a MONTHLY spend cap that this
+     * screen never mentioned, so a user could read `Spend cap: $10.00 per day`
+     * and `Cap remaining: $10.00` — headroom on every visible number — while
+     * every agent turn on a Hosted Machine was being refused by a limit with no
+     * surface at all. They could only discover it by being turned away
+     * (OSK-7920, split out of OSK-7900 / OSK-7909).
+     *
+     * Best-effort by design. This is a second call on a screen whose primary
+     * answer is the balance, so a failure here prints a short line and leaves
+     * that answer intact rather than failing the command.
+     */
+    async renderRuntimeSpend() {
+        let spend;
+        try {
+            ({ spend } = await (0, harnesses_1.getRuntimeMonthlySpend)());
+        }
+        catch {
+            this.log('');
+            this.log('  Hosted runtime: monthly cap unavailable (`skrr harnesses products` to retry)');
+            return;
+        }
+        renderRuntimeSpend(spend, (line) => this.log(line));
+    }
     /**
      * The workspace account, which is the one a workspace-carrying session is
      * funded from. Rendered in the SAME credits-plus-dollars unit and row labels

package/dist/commands/balance/statement.d.ts

@@ -39,6 +39,25 @@ export default class BalanceStatement extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * OSK-7641 — the ledger's default page is the OLDEST one, and nothing said so.
+ *
+ * With no flags the command returned 50 entries spanning three and a half
+ * WEEKS before today, opening with the account's legacy-balance-opening credit.
+ * A reader filtering for "entries since 06:45" got zero and concluded nothing
+ * had been billed at all. That conclusion was wrong, and the output gave them
+ * no way to know it: no range, no order, no "page 1 of many".
+ *
+ * `--desc` already existed (OSK-4823/OSK-4907) and is the fix — but only for
+ * someone who already suspected the default was wrong. So the page states what
+ * it is. The order word comes first because it is what changes the reading.
+ */
+export declare function statementWindowLine(args: {
+    wantNewestFirst: boolean;
+    firstCreatedAt: string | null;
+    lastCreatedAt: string | null;
+    hasMore: boolean;
+}): string;
 /**
  * The "More rows" footer, pointing at the cursor that matches the direction the
  * reader asked for: `--before` continues a newest-first page back through older

package/dist/commands/balance/statement.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.statementWindowLine = statementWindowLine;
 exports.statementMoreRowsHint = statementMoreRowsHint;
 exports.statementAmount = statementAmount;
 exports.statementAccountHeading = statementAccountHeading;
@@ -130,6 +131,15 @@ class BalanceStatement extends base_command_1.BaseCommand {
             this.log('No ledger entries.');
             return;
         }
+        // WHICH rows these are, before the reader starts drawing conclusions from
+        // them (OSK-7641).
+        this.log(statementWindowLine({
+            wantNewestFirst,
+            firstCreatedAt: entries[0]?.createdAt ?? null,
+            lastCreatedAt: entries[entries.length - 1]?.createdAt ?? null,
+            hasMore: Boolean(wantNewestFirst ? statement.nextBeforeEntryId : statement.nextAfterEntryId),
+        }));
+        this.log('');
         (0, format_1.renderTable)(entries.map((entry) => ({
             when: entry.createdAt ? String(entry.createdAt).slice(0, 19).replace('T', ' ') : '-',
             event: (0, format_1.formatCell)(entry.eventType),
@@ -139,6 +149,11 @@ class BalanceStatement extends base_command_1.BaseCommand {
             // in --json but never printed, so a human could not tell a code session
             // from a hosted run (OSK-4825).
             provider: (0, format_1.formatCell)(entry.provider),
+            // OSK-7641 — the command promises "what incurred it", and a bare
+            // session UUID does not answer that for anyone running more than one
+            // agent. Blank rather than '-' when the producer did not record one, so
+            // an unattributed row does not look like an attributed one.
+            agent: entry.agentId ? String(entry.agentId) : '',
             // The answer to "which session was this?" — the thing the legacy view
             // could never name, and the reason that view read as unexplainable. The
             // compound sourceId already encodes the source type in its first
@@ -152,9 +167,18 @@ class BalanceStatement extends base_command_1.BaseCommand {
             { key: 'service', header: 'SERVICE', maxWidth: 20 },
             { key: 'model', header: 'MODEL', maxWidth: 26 },
             { key: 'provider', header: 'PROVIDER', maxWidth: 16 },
+            { key: 'agent', header: 'AGENT', maxWidth: 26 },
             { key: 'source', header: 'SOURCE' },
             { key: 'amount', header: 'AMOUNT' },
         ], (line) => this.log(line));
+        // The reader's actual question is "what did my last few turns cost", and on
+        // page 1 of an oldest-first ledger the honest answer is "these are not
+        // those rows". Said next to the cursor hint, where a reader who has just
+        // seen three-week-old dates is looking (OSK-7641).
+        if (!wantNewestFirst && statement.nextAfterEntryId) {
+            this.log('');
+            this.log(`Looking for your most recent charges? \`${this.config.bin} balance statement --desc\``);
+        }
         const hint = statementMoreRowsHint({
             bin: this.config.bin,
             workspaceId,
@@ -169,6 +193,34 @@ class BalanceStatement extends base_command_1.BaseCommand {
     }
 }
 exports.default = BalanceStatement;
+/**
+ * OSK-7641 — the ledger's default page is the OLDEST one, and nothing said so.
+ *
+ * With no flags the command returned 50 entries spanning three and a half
+ * WEEKS before today, opening with the account's legacy-balance-opening credit.
+ * A reader filtering for "entries since 06:45" got zero and concluded nothing
+ * had been billed at all. That conclusion was wrong, and the output gave them
+ * no way to know it: no range, no order, no "page 1 of many".
+ *
+ * `--desc` already existed (OSK-4823/OSK-4907) and is the fix — but only for
+ * someone who already suspected the default was wrong. So the page states what
+ * it is. The order word comes first because it is what changes the reading.
+ */
+function statementWindowLine(args) {
+    const order = args.wantNewestFirst ? 'Newest first' : 'Oldest first';
+    const from = statementDay(args.firstCreatedAt);
+    const to = statementDay(args.lastCreatedAt);
+    const range = from && to ? (from === to ? from : `${from} → ${to}`) : 'no dated rows';
+    // "more" is the load-bearing half: a page that does not say it is one reads
+    // as the whole ledger.
+    return `${order} · ${range}${args.hasMore ? ' · more rows follow' : ' · complete'}`;
+}
+function statementDay(value) {
+    if (!value)
+        return null;
+    const text = String(value);
+    return text.length >= 10 ? text.slice(0, 10) : text;
+}
 /**
  * The "More rows" footer, pointing at the cursor that matches the direction the
  * reader asked for: `--before` continues a newest-first page back through older

package/dist/commands/browser/doctor.d.ts

@@ -1,6 +1,17 @@
 import { Command } from '@oclif/core';
 export default class BrowserDoctor extends Command {
     static description: string;
+    /**
+     * `browser diagnose` reaches the same command.
+     *
+     * The group's own first line is "Install, diagnose, and configure
+     * capability-scoped skrr Browser access" — so a reader types the verb the
+     * product used to describe itself and gets `error: unknown command
+     * 'diagnose'`, one line, suggesting nothing and not even pointing at
+     * `--help`, which is how every other error surface in this CLI ends
+     * (OSK-7644). Two names for one command is cheaper than the round trip.
+     */
+    static aliases: string[];
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };

package/dist/commands/browser/doctor.js

@@ -4,6 +4,17 @@ const core_1 = require("@oclif/core");
 const browser_1 = require("../browser");
 class BrowserDoctor extends core_1.Command {
     static description = 'Diagnose browser runtime selection, relay, image, and MCP bridge';
+    /**
+     * `browser diagnose` reaches the same command.
+     *
+     * The group's own first line is "Install, diagnose, and configure
+     * capability-scoped skrr Browser access" — so a reader types the verb the
+     * product used to describe itself and gets `error: unknown command
+     * 'diagnose'`, one line, suggesting nothing and not even pointing at
+     * `--help`, which is how every other error surface in this CLI ends
+     * (OSK-7644). Two names for one command is cheaper than the round trip.
+     */
+    static aliases = ['browser:diagnose'];
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output JSON' }),
     };

package/dist/commands/code/jobs/approve.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr code jobs approve` — land the pull request a job opened.
+ *
+ * OSK-7789 listed six verbs on `/api/cloud-coding` and one CLI binding. Four of
+ * the missing five are now bound; this is the last, and it is the one that
+ * FINISHES the work. Without it a headless operator could start a job, watch
+ * it, and stop it — and still had to open a browser to get the result merged,
+ * which is the same shape as the create-only path the finding was about.
+ *
+ * Only a repository-backed job has a pull request. `code jobs run` is bare
+ * compute with no repo, so there is nothing here to approve, and the refusal
+ * says which command produces one rather than reporting a bare 4xx.
+ */
+export default class CodeJobsApprove extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        job: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/code/jobs/approve.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+/**
+ * `skrr code jobs approve` — land the pull request a job opened.
+ *
+ * OSK-7789 listed six verbs on `/api/cloud-coding` and one CLI binding. Four of
+ * the missing five are now bound; this is the last, and it is the one that
+ * FINISHES the work. Without it a headless operator could start a job, watch
+ * it, and stop it — and still had to open a browser to get the result merged,
+ * which is the same shape as the create-only path the finding was about.
+ *
+ * Only a repository-backed job has a pull request. `code jobs run` is bare
+ * compute with no repo, so there is nothing here to approve, and the refusal
+ * says which command produces one rather than reporting a bare 4xx.
+ */
+class CodeJobsApprove extends base_command_1.BaseCommand {
+    static description = 'Approve and merge the pull request a Hosted Job Machine job opened';
+    static examples = [
+        '<%= config.bin %> code jobs approve <job-id>',
+        '<%= config.bin %> code jobs approve <job-id> --json',
+    ];
+    static args = {
+        job: core_1.Args.string({ description: 'Job id', required: true, ignoreStdin: true }),
+    };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output as JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(CodeJobsApprove);
+        let task;
+        try {
+            const res = await data_provider_1.dataService.approveCloudCodingPullRequest(args.job);
+            task = res?.task;
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(task, null, 2));
+            return;
+        }
+        // The SERVER's status, never the one we asked for — approving races a
+        // branch someone merged by hand, and printing an outcome we did not observe
+        // is how a CLI starts inventing them.
+        this.log(`Job ${task?.id ?? args.job} is now ${task?.status ?? 'unknown'}.`);
+        if (task?.prUrl)
+            this.log(`  ${String(task.prUrl)}`);
+    }
+}
+exports.default = CodeJobsApprove;