@skrr-ai/cli 0.1.23 → 0.1.25

package/bin/run.js

@@ -4,6 +4,41 @@ const path = require('node:path');
 const { spawnSync } = require('node:child_process');
 const { findAlternateCli, missingLocalCommandBuild } = require('./dev-fallback');
 
+/**
+ * The version a CLI entry point would run, for the fallback notice. Best effort:
+ * a version we cannot read must never be the reason a command fails.
+ */
+function describeCliVersion(startPath) {
+  const fsModule = require('node:fs');
+  // Resolve through the symlink first. An installed CLI is almost always a link
+  // in a bin directory, and walking up from THAT finds nothing — which is how
+  // the version, the one fact this message exists to report, came back unknown.
+  let resolved = startPath;
+  try {
+    resolved = fsModule.realpathSync(startPath);
+  } catch {
+    // fall through to the path as given
+  }
+  let dir =
+    fsModule.existsSync(resolved) && fsModule.statSync(resolved).isDirectory()
+      ? resolved
+      : path.dirname(resolved);
+  for (let depth = 0; depth < 6; depth += 1) {
+    try {
+      const pkg = JSON.parse(
+        require('node:fs').readFileSync(path.join(dir, 'package.json'), 'utf8'),
+      );
+      if (pkg?.version) return `v${pkg.version}`;
+    } catch {
+      // keep walking
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return 'version unknown';
+}
+
 const cliRoot = path.resolve(__dirname, '..');
 const missingBuildPath = missingLocalCommandBuild({
   cliRoot,
@@ -22,8 +57,26 @@ if (missingBuildPath) {
           requiredCommand: path.relative(path.join(cliRoot, 'dist', 'commands'), missingBuildPath),
         });
   if (fallback) {
+    // A developer verifying a change is the one caller for whom this fallback is
+    // not a safety net: it silently substitutes a DIFFERENT BUILD of the thing
+    // under test. The loop that trips it is exactly fix -> commit -> verify,
+    // because the pre-commit hook reformats staged sources and that invalidates
+    // the whole-tree digest for every command, not just the one edited.
+    //
+    // So name the substitution rather than just the fact, and let anyone who is
+    // verifying turn the fallback off outright.
+    if (process.env.SKRR_NO_DEV_FALLBACK === '1') {
+      console.error(
+        `[skrr] Refusing to fall back: SKRR_NO_DEV_FALLBACK=1 and the local build is stale at ` +
+          `${missingBuildPath}. Run "npm --prefix cli run build".`,
+      );
+      process.exit(1);
+    }
     console.error(
-      `[skrr] Local development build is incomplete (${missingBuildPath}); using fallback CLI ${fallback}.`,
+      `[skrr] Local development build is incomplete (${missingBuildPath}).\n` +
+        `[skrr] Running ${fallback} (${describeCliVersion(fallback)}) INSTEAD OF ` +
+        `this checkout (${describeCliVersion(cliRoot)}). Run "npm --prefix cli run build" to use ` +
+        `your own changes, or set SKRR_NO_DEV_FALLBACK=1 to make this an error.`,
     );
     const delegated = spawnSync(fallback, process.argv.slice(2), {
       stdio: 'inherit',

package/dist/base-command.d.ts

@@ -199,10 +199,10 @@ export declare abstract class BaseCommand extends Command {
      *
      * Shared by every command that accepts an assignee reference. A failure is
      * fatal rather than a silent fall-back to a global directory search: the
-     * server only accepts assignees who are members of the space
-     * (`ASSIGNEE_NOT_IN_SPACE`), so widening the lookup could only ever produce
-     * a request guaranteed to be rejected — or, worse, resolve a typo to a
-     * stranger the caller never intended to name.
+     * server accepts space members, plus only the caller's own unshared agents
+     * (`AgentTaskConsent`; anything else is `ASSIGNEE_NOT_IN_SPACE`), so widening
+     * the lookup could only ever produce a request the server refuses — or,
+     * worse, resolve a typo to a stranger the caller never intended to name.
      */
     protected loadSpaceMembers(spaceId: string): Promise<SpaceMember[]>;
     /**

package/dist/base-command.js

@@ -645,10 +645,10 @@ class BaseCommand extends core_1.Command {
      *
      * Shared by every command that accepts an assignee reference. A failure is
      * fatal rather than a silent fall-back to a global directory search: the
-     * server only accepts assignees who are members of the space
-     * (`ASSIGNEE_NOT_IN_SPACE`), so widening the lookup could only ever produce
-     * a request guaranteed to be rejected — or, worse, resolve a typo to a
-     * stranger the caller never intended to name.
+     * server accepts space members, plus only the caller's own unshared agents
+     * (`AgentTaskConsent`; anything else is `ASSIGNEE_NOT_IN_SPACE`), so widening
+     * the lookup could only ever produce a request the server refuses — or,
+     * worse, resolve a typo to a stranger the caller never intended to name.
      */
     async loadSpaceMembers(spaceId) {
         let response;
@@ -752,6 +752,14 @@ class BaseCommand extends core_1.Command {
         if (isOclifExitError(err)) {
             return super.catch(err);
         }
+        // Canonical Task Model v1 removed several `tasks complete` flags outright,
+        // so a caller following older instructions — including the managed block the
+        // platform itself installed — got a bare `Nonexistent flags:` with no hint
+        // that the capability moved rather than vanished. Name where each went.
+        const retiredHint = retiredFlagHint(err.message || '');
+        if (retiredHint) {
+            err.message = `${err.message}\n\n${retiredHint}`;
+        }
         if (this.wantsJsonOutput()) {
             const exit = err.exitCode ?? err.oclif?.exit ?? 1;
             process.exitCode = exit;
@@ -1163,7 +1171,10 @@ class BaseCommand extends core_1.Command {
         // terminal refusal or a 500. oclif's pretty-printer renders a `code` on a
         // CLIError as its own `Code: <code>` line, so passing it through gives
         // every skrr command a greppable failure line at no other cost.
-        this.error(message, { exit, code });
+        //
+        // Field-level validation is appended for the same reason: the server names
+        // the offending field and only `--json` callers could read it.
+        this.error(`${message}${formatValidationIssues(details)}`, { exit, code });
     }
     writeJsonCliError({ message, code, status, exit, retryable, details, }) {
         this.log(JSON.stringify({
@@ -1365,8 +1376,10 @@ function describeAssigneeNotInSpace(serverMessage, bin = 'skrr') {
     const base = serverMessage?.trim() || 'That assignee is not a member of this space.';
     if (base.includes(`${bin} spaces members add`))
         return base;
+    // Two ways forward, because the server accepts two consents: membership, or
+    // an owner assigning their own unshared agent to one task (AgentTaskConsent).
     return (`${base}\n  → add it to the space with \`${bin} spaces members add\`, ` +
-        'or assign someone already in it.');
+        'assign someone already in it, or — for your own unshared agent — assign it yourself.');
 }
 /**
  * Server-declared TERMINAL refusals: a state conflict the caller must resolve
@@ -1521,6 +1534,42 @@ function isRetryableFailure(status, body) {
         return false;
     return status === 408 || status === 425 || status === 429 || !!(status && status >= 500);
 }
+/**
+ * Render server-supplied field validation into the human error.
+ *
+ * The canonical Task routes answer a schema rejection with
+ * `{error: 'Invalid request data', details: <zod issues>}` — which names the
+ * exact field — but the human path used to print only the generic sentence, so
+ * `tasks updates add --type finding` failed with `Invalid request data` and the
+ * operator had to re-run the identical command with `--json` to learn that
+ * `data.evidenceRefs` was missing. The answer was already on the wire; only the
+ * renderer threw it away.
+ *
+ * Shape-sniffed rather than typed against zod: `details` also carries unrelated
+ * payloads (outbox ids, oclif suggestions), and those must pass through
+ * untouched rather than render as pseudo-fields.
+ */
+function formatValidationIssues(details) {
+    const issues = Array.isArray(details)
+        ? details
+        : Array.isArray(details?.details)
+            ? details.details
+            : Array.isArray(details?.issues)
+                ? details.issues
+                : [];
+    const lines = [];
+    for (const issue of issues) {
+        const row = issue;
+        const message = typeof row?.message === 'string' ? row.message : '';
+        if (!message)
+            continue;
+        const path = Array.isArray(row.path) ? row.path.join('.') : '';
+        lines.push(path ? `  ${path}: ${message}` : `  ${message}`);
+        if (lines.length === 10)
+            break;
+    }
+    return lines.length > 0 ? `\n${lines.join('\n')}` : '';
+}
 function detailsFromPrettyError(options) {
     const details = {};
     for (const key of ['suggestions', 'ref', 'showHelp']) {
@@ -1537,6 +1586,32 @@ function detailsFromCaughtError(err) {
         details.exit = err.oclif.exit;
     return Object.keys(details).length > 0 ? details : undefined;
 }
+/**
+ * Where a removed flag's capability went. Keyed by flag name so it fires on
+ * oclif's own `Nonexistent flags:` message without parsing its grammar.
+ */
+const RETIRED_FLAG_REPLACEMENTS = {
+    '--verdict': '--verdict is gone: a review decision and a domain conclusion are different facts. ' +
+        'Use `tasks review --decision accepted|changes_requested` for acceptance, and ' +
+        '--conclusion-type/--conclusion-json for a conclusion such as NO-SHIP.',
+    '--outcome': '--outcome is now --summary.',
+    '--finding': '--finding is gone: record findings as `tasks updates add --type finding`.',
+    '--evidence': '--evidence is now --evidence-ref on the Result, or an evidenceRefs entry.',
+    '--next': '--next is now --remaining.',
+    '--deliverables': '--deliverables is now --deliverable <task-resource-link-id>, recorded first with ' +
+        '`tasks deliverable add`.',
+    '--artifact': '--artifact is now --deliverable <task-resource-link-id>, recorded first with ' +
+        '`tasks deliverable add`.',
+    '--supersede': '--supersede is implicit: submitting again creates a new Result version.',
+};
+function retiredFlagHint(message) {
+    if (!/nonexistent flag/i.test(message))
+        return null;
+    const hits = Object.keys(RETIRED_FLAG_REPLACEMENTS).filter((flag) => new RegExp(`${flag}(?![\\w-])`).test(message));
+    if (hits.length === 0)
+        return null;
+    return hits.map((flag) => `  ${RETIRED_FLAG_REPLACEMENTS[flag]}`).join('\n');
+}
 function parseCliErrorCode(err) {
     if (err.name && err.name !== 'Error') {
         return err.name.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toUpperCase();

package/dist/commands/harnesses/leases/list.js

@@ -33,7 +33,7 @@ class HarnessesLeasesList extends base_command_1.BaseCommand {
         }),
         product: core_1.Flags.string({
             description: 'Only this machine product',
-            options: ['hosted-machine', 'hosted-job-machine'],
+            options: ['hosted-machine', 'hosted-job-machine', 'dedicated-machine'],
         }),
     };
     async run() {

package/dist/commands/harnesses/products.js

@@ -31,6 +31,7 @@ const START_COMMAND = {
     // a reader who wants compute at the repository flow is a smaller version of
     // pointing them at a verb nobody implements.
     'hosted-job-machine': 'code jobs run',
+    'dedicated-machine': 'machines dedicated create',
 };
 /**
  * `availability` is a string on some rows and an object on others. The table

package/dist/commands/machines/dedicated/create.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../../base-command';
+export default class DedicatedMachinesCreate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'size-preset': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'region-class': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'storage-gb': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'retention-class': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'backup-profile': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'spending-limit-cents': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'request-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/create.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const node_crypto_1 = require("node:crypto");
+const base_command_1 = require("../../../base-command");
+const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+class DedicatedMachinesCreate extends base_command_1.BaseCommand {
+    static description = 'Request a Dedicated Runtime lease';
+    static examples = [
+        '<%= config.bin %> machines dedicated create --name dev-box --size-preset standard --spending-limit-cents 20000',
+        '<%= config.bin %> machines dedicated create --name dev-box --size-preset standard --spending-limit-cents 20000 --json',
+    ];
+    static flags = {
+        name: core_1.Flags.string({ description: 'Display name for the dedicated machine', required: true }),
+        'size-preset': core_1.Flags.string({
+            description: 'Instance size preset (from harnesses products)',
+            required: true,
+        }),
+        // None of these four carry a client-side default, deliberately.
+        //
+        // The server already defaults every one of them, and a CLI that restates a
+        // default it does not own cannot be right for long. `--storage-gb` proved
+        // it: it defaulted to 100 while the product's default is 50, so a user who
+        // never chose a size was billed for twice the documented disk, the server's
+        // own `workspaceDefaultGb` was unreachable through the CLI, and the
+        // decision record that set the number was wrong for CLI users. The other
+        // three happened to agree, which is worse rather than better — it is the
+        // same bug with the symptom switched off until someone moves a default.
+        'region-class': core_1.Flags.string({
+            description: 'Region class. Defaults to the product catalog value (usually primary).',
+        }),
+        'storage-gb': core_1.Flags.integer({
+            description: 'Workspace storage size in GB. Defaults to the product catalog size.',
+        }),
+        'retention-class': core_1.Flags.string({
+            description: 'Retention class for stopped instances. Defaults to the product catalog value.',
+        }),
+        'backup-profile': core_1.Flags.string({
+            description: 'crash-consistent (AWS Backup) or application-consistent (guest fsfreeze while the daemon is reachable; scheduled DLM when that plan is enabled). Defaults to the product catalog value.',
+        }),
+        'spending-limit-cents': core_1.Flags.integer({
+            description: 'Monthly spending limit in cents. Required before start.',
+            required: true,
+        }),
+        workspace: core_1.Flags.string({ description: 'Workspace scope' }),
+        'request-id': core_1.Flags.string({
+            description: 'Idempotency key. Reuse it to safely retry the same create request.',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(DedicatedMachinesCreate);
+        const body = (0, dedicated_machines_1.dedicatedRuntimeCreateInput)({
+            requestId: flags['request-id'] || newRequestId(),
+            displayName: flags.name,
+            sizePreset: flags['size-preset'],
+            monthlySpendingLimitCents: flags['spending-limit-cents'],
+            regionClass: flags['region-class'],
+            storageGb: flags['storage-gb'],
+            retentionClass: flags['retention-class'],
+            backupProfile: flags['backup-profile'],
+            workspaceId: flags.workspace,
+        });
+        let response;
+        try {
+            response = await (0, dedicated_machines_1.createDedicatedRuntime)(body);
+        }
+        catch (err) {
+            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
+            if (message)
+                this.error(message, { exit: 1 });
+            this.handleApiError(err);
+        }
+        const lease = response?.lease;
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        const id = (0, dedicated_machines_1.dedicatedLeaseId)(lease);
+        this.log(`Dedicated Runtime ${(0, dedicated_machines_1.dedicatedLeaseDisplayName)(lease)} (${id || 'unknown'}) ${(0, dedicated_machines_1.dedicatedLeaseState)(lease)}.`);
+        if (id) {
+            this.log(`Poll: ${this.config.bin} machines dedicated show ${id}`);
+        }
+    }
+}
+exports.default = DedicatedMachinesCreate;
+function newRequestId() {
+    return `dedicated-machine:${Date.now()}:${(0, node_crypto_1.randomBytes)(6).toString('hex')}`;
+}

package/dist/commands/machines/dedicated/destroy.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../../base-command';
+export default class DedicatedMachinesDestroy extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'retain-storage': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'purge-storage': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/destroy.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+class DedicatedMachinesDestroy extends base_command_1.BaseCommand {
+    static description = 'Destroy a Dedicated Runtime lease. Retention class standard/extended archives the lease and keeps the workspace volume; destroy an archived lease to purge storage.';
+    static examples = [
+        '<%= config.bin %> machines dedicated destroy <lease-id>',
+        '<%= config.bin %> machines dedicated destroy <lease-id> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: 'Dedicated Runtime lease id',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        'retain-storage': core_1.Flags.boolean({
+            description: 'Archive the lease and keep the workspace volume',
+            exclusive: ['purge-storage'],
+        }),
+        'purge-storage': core_1.Flags.boolean({
+            description: 'Permanently delete the workspace volume',
+            exclusive: ['retain-storage'],
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesDestroy);
+        let response;
+        try {
+            response = await (0, dedicated_machines_1.destroyDedicatedRuntime)(args.lease, {
+                retentionIntent: flags['purge-storage']
+                    ? 'purge'
+                    : flags['retain-storage']
+                        ? 'retain'
+                        : undefined,
+            });
+        }
+        catch (err) {
+            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
+            if (message)
+                this.error(message, { exit: 1 });
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        this.log(`Dedicated Runtime ${(0, dedicated_machines_1.dedicatedLeaseId)(response?.lease)} ${(0, dedicated_machines_1.dedicatedLeaseState)(response?.lease)}.`);
+    }
+}
+exports.default = DedicatedMachinesDestroy;

package/dist/commands/machines/dedicated/grow.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../../base-command';
+export default class DedicatedMachinesGrow extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        'storage-gb': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/grow.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+class DedicatedMachinesGrow extends base_command_1.BaseCommand {
+    static description = 'Increase Dedicated Runtime workspace storage. Shrink is unsupported.';
+    static examples = [
+        '<%= config.bin %> machines dedicated grow <lease-id> --storage-gb 200',
+        '<%= config.bin %> machines dedicated grow <lease-id> --storage-gb 200 --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: 'Dedicated Runtime lease id',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        'storage-gb': core_1.Flags.integer({
+            description: 'New workspace size in GiB. Must be larger than the current size.',
+            required: true,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesGrow);
+        let response;
+        try {
+            response = await (0, dedicated_machines_1.growDedicatedRuntime)(args.lease, flags['storage-gb']);
+        }
+        catch (err) {
+            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
+            if (message)
+                this.error(message, { exit: 1 });
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        this.log(`Dedicated Runtime ${(0, dedicated_machines_1.dedicatedLeaseId)(response?.lease)} ${(0, dedicated_machines_1.dedicatedLeaseState)(response?.lease)}.`);
+    }
+}
+exports.default = DedicatedMachinesGrow;

package/dist/commands/machines/dedicated/health-check.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base-command';
+export default class DedicatedMachinesHealthCheck extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/health-check.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+class DedicatedMachinesHealthCheck extends base_command_1.BaseCommand {
+    static description = 'Health-check a Dedicated Runtime lease';
+    static examples = [
+        '<%= config.bin %> machines dedicated health-check <lease-id>',
+        '<%= config.bin %> machines dedicated health-check <lease-id> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: 'Dedicated Runtime lease id',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesHealthCheck);
+        let response;
+        try {
+            response = await (0, dedicated_machines_1.performDedicatedLeaseAction)(args.lease, 'health-check');
+        }
+        catch (err) {
+            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
+            if (message)
+                this.error(message, { exit: 1 });
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        this.log(`Dedicated Runtime ${(0, dedicated_machines_1.dedicatedLeaseId)(response?.lease)} ${(0, dedicated_machines_1.dedicatedLeaseState)(response?.lease)}.`);
+    }
+}
+exports.default = DedicatedMachinesHealthCheck;

package/dist/commands/machines/dedicated/incident-close.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base-command';
+export default class DedicatedMachinesIncidentClose extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/incident-close.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+class DedicatedMachinesIncidentClose extends base_command_1.BaseCommand {
+    static description = 'Close a Dedicated Runtime AZ-recovery incident hold. Does not delete the workspace.';
+    static examples = [
+        '<%= config.bin %> machines dedicated incident-close <lease-id>',
+        '<%= config.bin %> machines dedicated incident-close <lease-id> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: 'Dedicated Runtime lease id',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesIncidentClose);
+        let response;
+        try {
+            response = await (0, dedicated_machines_1.closeDedicatedRuntimeIncidentHold)(args.lease);
+        }
+        catch (err) {
+            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
+            if (message)
+                this.error(message, { exit: 1 });
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        this.log(`Dedicated Runtime ${(0, dedicated_machines_1.dedicatedLeaseId)(response?.lease)} ${(0, dedicated_machines_1.dedicatedLeaseState)(response?.lease)}.`);
+    }
+}
+exports.default = DedicatedMachinesIncidentClose;

package/dist/commands/machines/dedicated/index.d.ts

@@ -0,0 +1,6 @@
+import { Command } from '@oclif/core';
+export default class DedicatedMachines extends Command {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/index.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+class DedicatedMachines extends core_1.Command {
+    // This line is read at the moment someone CHOOSES between the two products,
+    // so it states the trade rather than restating the product name. "Manage
+    // Dedicated Runtime leases" told a user nothing they could decide on, and the
+    // difference that matters — files survive a restart, running processes do not
+    // — was invisible until a restart lost their work.
+    static description = 'A private VM with a durable workspace — files survive restart, running processes do not';
+    static examples = [
+        '<%= config.bin %> machines dedicated list',
+        '<%= config.bin %> machines dedicated show <lease-id>',
+        '<%= config.bin %> machines dedicated create --name dev-box --size-preset standard --spending-limit-cents 20000',
+        '<%= config.bin %> machines dedicated stop <lease-id>',
+        '<%= config.bin %> machines dedicated start <lease-id>',
+        '<%= config.bin %> machines dedicated restart <lease-id>',
+        '<%= config.bin %> machines dedicated snapshot <lease-id>',
+        '<%= config.bin %> machines dedicated grow <lease-id> --storage-gb 200',
+        '<%= config.bin %> machines dedicated incident-close <lease-id>',
+        '<%= config.bin %> machines dedicated health-check <lease-id>',
+        '<%= config.bin %> machines dedicated destroy <lease-id>',
+    ];
+    async run() {
+        this.log('skrr Dedicated Runtime commands:');
+        this.log('  skrr machines dedicated list          list Dedicated Runtime leases');
+        this.log('  skrr machines dedicated show          show one Dedicated Runtime lease');
+        this.log('  skrr machines dedicated create        request a Dedicated Runtime');
+        this.log('  skrr machines dedicated start         start a stopped runtime');
+        this.log('  skrr machines dedicated stop          stop compute and keep the disk');
+        this.log('  skrr machines dedicated restart       restart the instance; files stay');
+        this.log('  skrr machines dedicated snapshot      create a recovery point');
+        this.log('  skrr machines dedicated grow          increase workspace storage; shrink is unsupported');
+        this.log('  skrr machines dedicated incident-close close AZ-recovery evidence hold');
+        this.log('  skrr machines dedicated health-check  probe daemon and disk liveness');
+        this.log('  skrr machines dedicated destroy       stop compute; keep or purge the workspace disk');
+    }
+}
+exports.default = DedicatedMachines;

package/dist/commands/machines/dedicated/list.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base-command';
+export default class DedicatedMachinesList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        state: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}