@skrr-ai/cli 0.1.25 → 0.1.26

package/dist/commands/machines/dedicated/restart.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const base_command_1 = require("../../../base-command");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
-class DedicatedMachinesRestart extends base_command_1.BaseCommand {
-    static description = 'Restart a Dedicated Runtime lease';
+class DedicatedMachinesRestart extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Restart a Dedicated Runtime to recover availability. Files survive; memory, shells and background jobs do not.';
     static examples = [
         '<%= config.bin %> machines dedicated restart <lease-id>',
-        '<%= config.bin %> machines dedicated restart <lease-id> --json',
+        '<%= config.bin %> machines dedicated restart <lease-id> --wait',
+        '<%= config.bin %> machines dedicated restart <lease-id> --wait --timeout 10m --json',
     ];
     static args = {
         lease: core_1.Args.string({
@@ -18,25 +19,13 @@ class DedicatedMachinesRestart extends base_command_1.BaseCommand {
     };
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        ...dedicated_lease_command_1.dedicatedWaitFlags,
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(DedicatedMachinesRestart);
-        let response;
-        try {
-            response = await (0, dedicated_machines_1.performDedicatedLeaseAction)(args.lease, 'restart');
-        }
-        catch (err) {
-            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
-            if (message)
-                this.error(message, { exit: 1 });
-            this.handleApiError(err);
-        }
-        if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
-            return;
-        }
-        this.log(`Dedicated Runtime ${(0, dedicated_machines_1.dedicatedLeaseId)(response?.lease)} ${(0, dedicated_machines_1.dedicatedLeaseState)(response?.lease)}.`);
+        const response = await this.callDedicated(() => (0, dedicated_machines_1.performDedicatedLeaseAction)(args.lease, 'restart', this.scopeFrom(flags)));
+        await this.reportLeaseAction(response, flags, { kind: 'running' }, 'Restarting');
     }
 }
 exports.default = DedicatedMachinesRestart;

package/dist/commands/machines/dedicated/show.d.ts

@@ -1,5 +1,5 @@
-import { BaseCommand } from '../../../base-command';
-export default class DedicatedMachinesShow extends BaseCommand {
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+export default class DedicatedMachinesShow extends DedicatedLeaseCommand {
     static description: string;
     static examples: string[];
     static args: {

package/dist/commands/machines/dedicated/show.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const base_command_1 = require("../../../base-command");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
-class DedicatedMachinesShow extends base_command_1.BaseCommand {
-    static description = 'Show one Dedicated Runtime lease';
+const harnesses_1 = require("../../../lib/harnesses");
+class DedicatedMachinesShow extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Show one Dedicated Runtime lease: state, size, workspace, spend against the cap, health, deletion clock and the engines its daemon registered';
     static examples = [
         '<%= config.bin %> machines dedicated show <lease-id>',
         '<%= config.bin %> machines dedicated show <lease-id> --json',
@@ -16,43 +17,40 @@ class DedicatedMachinesShow extends base_command_1.BaseCommand {
             required: true,
         }),
     };
-    static flags = { json: core_1.Flags.boolean({ description: 'Output as JSON' }) };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(DedicatedMachinesShow);
-        let response;
-        try {
-            response = await (0, dedicated_machines_1.getDedicatedRuntime)(args.lease);
-        }
-        catch (err) {
-            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
-            if (message)
-                this.error(message, { exit: 1 });
-            this.handleApiError(err);
-        }
+        const response = await this.callDedicated(() => (0, dedicated_machines_1.getDedicatedRuntime)(args.lease, this.scopeFrom(flags)));
         const lease = response?.lease;
         if (!lease) {
             this.error('Dedicated Runtime lease not found.', { exit: 1 });
         }
-        if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
-            return;
-        }
-        this.log((0, dedicated_machines_1.dedicatedLeaseDisplayName)(lease));
-        this.log(`  id           ${(0, dedicated_machines_1.dedicatedLeaseId)(lease)}`);
-        this.log(`  status       ${(0, dedicated_machines_1.dedicatedLeaseState)(lease)}`);
-        if (lease.storage?.retentionClass) {
-            this.log(`  retention    ${lease.storage.retentionClass}`);
-        }
-        if (lease.storage?.backupProfile) {
-            this.log(`  backup       ${lease.storage.backupProfile}`);
+        // The harness rows are what an agent attaches to and what a terminal opens
+        // on, and the lease payload deliberately names no daemon. Best-effort: a
+        // failed harness read must not hide the lease the caller asked for.
+        let harnesses = [];
+        try {
+            const listed = (await (0, harnesses_1.listHarnesses)());
+            harnesses = Array.isArray(listed) ? listed : (listed?.harnesses ?? []);
         }
-        if (lease.storage?.lastBackupAt) {
-            this.log(`  last backup  ${lease.storage.lastBackupAt}`);
+        catch {
+            harnesses = [];
         }
-        if (lease.billing?.monthlySpendLimitCents != null) {
-            this.log(`  monthly cap  ${lease.billing.monthlySpendLimitCents} cents`);
+        if (flags.json) {
+            const engines = (0, dedicated_machines_1.dedicatedLeaseHarnesses)(lease, harnesses).map((harness) => ({
+                harnessId: harness._id,
+                provider: harness.provider,
+                status: harness.status,
+                lastSeenAt: harness.lastSeenAt,
+            }));
+            this.log(JSON.stringify({ ...response, harnesses: engines }, null, 2));
+            return;
         }
+        for (const line of (0, dedicated_machines_1.describeDedicatedLease)(lease, harnesses))
+            this.log(line);
     }
 }
 exports.default = DedicatedMachinesShow;

package/dist/commands/machines/dedicated/sign-in.d.ts

@@ -0,0 +1,19 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated sign-in` — the lease card's Sign in menu.
+ *
+ * Opens the machine's terminal and types the tool's sign-in command once the
+ * shell is ready. The commands are the SAME fixed strings the web offers,
+ * declared once in `@skrr-ai/data-provider`; each is a device-code or
+ * paste-a-code flow, because the machine has no browser.
+ */
+export default class DedicatedMachinesSignIn extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        tool: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {};
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/sign-in.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const TOOLS = data_provider_1.DEDICATED_RUNTIME_SIGN_IN_PRESETS.map((preset) => preset.tool);
+/**
+ * `skrr machines dedicated sign-in` — the lease card's Sign in menu.
+ *
+ * Opens the machine's terminal and types the tool's sign-in command once the
+ * shell is ready. The commands are the SAME fixed strings the web offers,
+ * declared once in `@skrr-ai/data-provider`; each is a device-code or
+ * paste-a-code flow, because the machine has no browser.
+ */
+class DedicatedMachinesSignIn extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Sign in to GitHub CLI, Claude Code or Codex on a Dedicated Runtime, in an interactive terminal. The sign-in is shared by everything that runs on the machine, agents included.';
+    static examples = [
+        '<%= config.bin %> machines dedicated sign-in <lease-id> github',
+        '<%= config.bin %> machines dedicated sign-in <lease-id> claude',
+        '<%= config.bin %> machines dedicated sign-in <lease-id> codex',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: 'Dedicated Runtime lease id',
+            required: true,
+            ignoreStdin: true,
+        }),
+        tool: core_1.Args.string({
+            description: `What to sign in to: ${TOOLS.join(', ')}`,
+            required: true,
+            options: TOOLS,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {};
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesSignIn);
+        const preset = data_provider_1.DEDICATED_RUNTIME_SIGN_IN_PRESETS.find((candidate) => candidate.tool === args.tool);
+        if (!preset) {
+            this.error(`Unknown tool "${args.tool}". Choose one of: ${TOOLS.join(', ')}.`, { exit: 2 });
+        }
+        // Said before, not after: once the code is entered the credential already
+        // sits on the workspace volume, in every later snapshot.
+        process.stderr.write(`${preset.label} sign-in is stored on the workspace volume and shared by everything running as skrr-workload on this machine, including agents. Prefer a narrowly-scoped account or token.\n`);
+        await this.openDedicatedTerminal(args.lease, flags, preset.command);
+    }
+}
+exports.default = DedicatedMachinesSignIn;

package/dist/commands/machines/dedicated/snapshot.d.ts

@@ -1,11 +1,14 @@
-import { BaseCommand } from '../../../base-command';
-export default class DedicatedMachinesSnapshot extends BaseCommand {
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+export default class DedicatedMachinesSnapshot extends DedicatedLeaseCommand {
     static description: string;
     static examples: string[];
     static args: {
         lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
+        wait: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        timeout: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        interval: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;

package/dist/commands/machines/dedicated/snapshot.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const base_command_1 = require("../../../base-command");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
-class DedicatedMachinesSnapshot extends base_command_1.BaseCommand {
-    static description = 'Snapshot a Dedicated Runtime lease workspace';
+class DedicatedMachinesSnapshot extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Take a recovery point of a Dedicated Runtime workspace before something risky. With --wait, succeeds only once a new recovery point is recorded.';
     static examples = [
         '<%= config.bin %> machines dedicated snapshot <lease-id>',
-        '<%= config.bin %> machines dedicated snapshot <lease-id> --json',
+        '<%= config.bin %> machines dedicated snapshot <lease-id> --wait',
+        '<%= config.bin %> machines dedicated snapshot <lease-id> --wait --json',
     ];
     static args = {
         lease: core_1.Args.string({
@@ -18,25 +19,16 @@ class DedicatedMachinesSnapshot extends base_command_1.BaseCommand {
     };
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        ...dedicated_lease_command_1.dedicatedWaitFlags,
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(DedicatedMachinesSnapshot);
-        let response;
-        try {
-            response = await (0, dedicated_machines_1.performDedicatedLeaseAction)(args.lease, 'snapshot');
-        }
-        catch (err) {
-            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
-            if (message)
-                this.error(message, { exit: 1 });
-            this.handleApiError(err);
-        }
-        if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
-            return;
-        }
-        this.log(`Dedicated Runtime ${(0, dedicated_machines_1.dedicatedLeaseId)(response?.lease)} ${(0, dedicated_machines_1.dedicatedLeaseState)(response?.lease)}.`);
+        const response = await this.callDedicated(() => (0, dedicated_machines_1.performDedicatedLeaseAction)(args.lease, 'snapshot', this.scopeFrom(flags)));
+        // A snapshot returns the lease to the state it left, so the state cannot say
+        // whether it worked. The recovery point's timestamp can: the 202 carries the
+        // previous one, and success is a newer one.
+        await this.reportLeaseAction(response, flags, { kind: 'snapshot', previousBackupAt: response?.lease?.storage?.lastBackupAt ?? null }, 'Snapshotting');
     }
 }
 exports.default = DedicatedMachinesSnapshot;

package/dist/commands/machines/dedicated/spending-limit.d.ts

@@ -0,0 +1,22 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated spending-limit` — change the monthly cap after create.
+ *
+ * The cap is the ONE guardrail on a machine with no wall-clock TTL: when a
+ * month's spend reaches it, the platform stops compute and keeps the workspace.
+ * It could be set at create and changed from the web lease card, but not from
+ * here — so an operator who hit it at 2am had to find a browser to raise it,
+ * and an agent watching its own machine could not lower it.
+ */
+export default class DedicatedMachinesSpendingLimit extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        cents: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/spending-limit.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+/**
+ * `skrr machines dedicated spending-limit` — change the monthly cap after create.
+ *
+ * The cap is the ONE guardrail on a machine with no wall-clock TTL: when a
+ * month's spend reaches it, the platform stops compute and keeps the workspace.
+ * It could be set at create and changed from the web lease card, but not from
+ * here — so an operator who hit it at 2am had to find a browser to raise it,
+ * and an agent watching its own machine could not lower it.
+ */
+class DedicatedMachinesSpendingLimit extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Change the monthly spending cap of a Dedicated Runtime. At the cap, compute stops and the workspace is kept.';
+    static examples = [
+        '<%= config.bin %> machines dedicated spending-limit <lease-id> --cents 30000',
+        '<%= config.bin %> machines dedicated spending-limit <lease-id> --cents 5000 --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: 'Dedicated Runtime lease id',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        cents: core_1.Flags.integer({
+            description: 'New monthly cap in cents (30000 = $300). Refused below what this month has already spent or is projected to.',
+            required: true,
+            min: 1,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesSpendingLimit);
+        const response = await this.callDedicated(() => (0, dedicated_machines_1.setDedicatedRuntimeSpendingLimit)(args.lease, flags.cents, this.scopeFrom(flags)));
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        const lease = response?.lease;
+        this.log(`Dedicated Runtime ${(0, dedicated_machines_1.dedicatedLeaseId)(lease) || args.lease} spending cap updated.`);
+        if (lease)
+            this.log(`  ${(0, dedicated_machines_1.dedicatedSpendSummary)(lease)}`);
+    }
+}
+exports.default = DedicatedMachinesSpendingLimit;

package/dist/commands/machines/dedicated/start.d.ts

@@ -1,11 +1,14 @@
-import { BaseCommand } from '../../../base-command';
-export default class DedicatedMachinesStart extends BaseCommand {
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+export default class DedicatedMachinesStart extends DedicatedLeaseCommand {
     static description: string;
     static examples: string[];
     static args: {
         lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
+        wait: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        timeout: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        interval: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;

package/dist/commands/machines/dedicated/start.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const base_command_1 = require("../../../base-command");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
-class DedicatedMachinesStart extends base_command_1.BaseCommand {
-    static description = 'Start a Dedicated Runtime lease';
+class DedicatedMachinesStart extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Start a stopped Dedicated Runtime. Files under /workspace are as you left them; nothing that was running is.';
     static examples = [
         '<%= config.bin %> machines dedicated start <lease-id>',
-        '<%= config.bin %> machines dedicated start <lease-id> --json',
+        '<%= config.bin %> machines dedicated start <lease-id> --wait',
+        '<%= config.bin %> machines dedicated start <lease-id> --wait --timeout 10m --json',
     ];
     static args = {
         lease: core_1.Args.string({
@@ -18,25 +19,13 @@ class DedicatedMachinesStart extends base_command_1.BaseCommand {
     };
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        ...dedicated_lease_command_1.dedicatedWaitFlags,
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(DedicatedMachinesStart);
-        let response;
-        try {
-            response = await (0, dedicated_machines_1.performDedicatedLeaseAction)(args.lease, 'start');
-        }
-        catch (err) {
-            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
-            if (message)
-                this.error(message, { exit: 1 });
-            this.handleApiError(err);
-        }
-        if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
-            return;
-        }
-        this.log(`Dedicated Runtime ${(0, dedicated_machines_1.dedicatedLeaseId)(response?.lease)} ${(0, dedicated_machines_1.dedicatedLeaseState)(response?.lease)}.`);
+        const response = await this.callDedicated(() => (0, dedicated_machines_1.performDedicatedLeaseAction)(args.lease, 'start', this.scopeFrom(flags)));
+        await this.reportLeaseAction(response, flags, { kind: 'running' }, 'Starting');
     }
 }
 exports.default = DedicatedMachinesStart;

package/dist/commands/machines/dedicated/stop.d.ts

@@ -1,11 +1,14 @@
-import { BaseCommand } from '../../../base-command';
-export default class DedicatedMachinesStop extends BaseCommand {
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+export default class DedicatedMachinesStop extends DedicatedLeaseCommand {
     static description: string;
     static examples: string[];
     static args: {
         lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
+        wait: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        timeout: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        interval: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;

package/dist/commands/machines/dedicated/stop.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const base_command_1 = require("../../../base-command");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
-class DedicatedMachinesStop extends base_command_1.BaseCommand {
-    static description = 'Stop a Dedicated Runtime lease';
+class DedicatedMachinesStop extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Stop a Dedicated Runtime: compute billing ends, the workspace volume and its storage billing stay. Running processes end.';
     static examples = [
         '<%= config.bin %> machines dedicated stop <lease-id>',
-        '<%= config.bin %> machines dedicated stop <lease-id> --json',
+        '<%= config.bin %> machines dedicated stop <lease-id> --wait',
+        '<%= config.bin %> machines dedicated stop <lease-id> --wait --timeout 10m --json',
     ];
     static args = {
         lease: core_1.Args.string({
@@ -18,25 +19,13 @@ class DedicatedMachinesStop extends base_command_1.BaseCommand {
     };
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        ...dedicated_lease_command_1.dedicatedWaitFlags,
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(DedicatedMachinesStop);
-        let response;
-        try {
-            response = await (0, dedicated_machines_1.performDedicatedLeaseAction)(args.lease, 'stop');
-        }
-        catch (err) {
-            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
-            if (message)
-                this.error(message, { exit: 1 });
-            this.handleApiError(err);
-        }
-        if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
-            return;
-        }
-        this.log(`Dedicated Runtime ${(0, dedicated_machines_1.dedicatedLeaseId)(response?.lease)} ${(0, dedicated_machines_1.dedicatedLeaseState)(response?.lease)}.`);
+        const response = await this.callDedicated(() => (0, dedicated_machines_1.performDedicatedLeaseAction)(args.lease, 'stop', this.scopeFrom(flags)));
+        await this.reportLeaseAction(response, flags, { kind: 'stopped' }, 'Stopping');
     }
 }
 exports.default = DedicatedMachinesStop;

package/dist/commands/machines/dedicated/terminal.d.ts

@@ -0,0 +1,22 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated terminal` — the web lease card's "Open terminal",
+ * from a terminal.
+ *
+ * `exec` has no TTY and cannot drive anything that prompts, which left
+ * `gh auth login`, a REPL, a dev server's interactive setup and `claude` itself
+ * reachable only from a browser. This opens the same real PTY the web does,
+ * through the same relay and the same admission.
+ */
+export default class DedicatedMachinesTerminal extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        cwd: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        command: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/terminal.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+/**
+ * `skrr machines dedicated terminal` — the web lease card's "Open terminal",
+ * from a terminal.
+ *
+ * `exec` has no TTY and cannot drive anything that prompts, which left
+ * `gh auth login`, a REPL, a dev server's interactive setup and `claude` itself
+ * reachable only from a browser. This opens the same real PTY the web does,
+ * through the same relay and the same admission.
+ */
+class DedicatedMachinesTerminal extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Open an interactive shell on a Dedicated Runtime (a real PTY, as skrr-workload). Ctrl-] closes it.';
+    static examples = [
+        '<%= config.bin %> machines dedicated terminal <lease-id>',
+        '<%= config.bin %> machines dedicated terminal <lease-id> --cwd /workspace/repos/app',
+        '<%= config.bin %> machines dedicated terminal <lease-id> --command "npm run dev"',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: 'Dedicated Runtime lease id',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        cwd: core_1.Flags.string({
+            description: 'Directory to start in (defaults to HOME, /workspace/user-data)',
+        }),
+        command: core_1.Flags.string({
+            description: 'A command to type into the shell once it is ready, as if you typed it. The shell stays open after it.',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesTerminal);
+        await this.openDedicatedTerminal(args.lease, flags, flags.command);
+    }
+}
+exports.default = DedicatedMachinesTerminal;

package/dist/commands/tasks/list.js

@@ -86,6 +86,33 @@ function emptyTasksMessage(flags, bin = 'skrr') {
         lines.push('      no longer has that status. Try `--execution-state active` (running now) or');
         lines.push(`      \`--execution-state recovered\` (reaped, startable), or \`${bin} tasks active\`.`);
     }
+    else if (typeof flags.status === 'string' &&
+        flags.status.length > 0 &&
+        !flags['execution-state']) {
+        // A filter that matches nothing and a board that IS empty print the same
+        // thing, and the caller cannot tell which they are looking at. Observed:
+        // `--status todo` on a board whose open column is `backlog` said `No tasks.`
+        // while twelve were open, and it was believed.
+        //
+        // Not fixed by validating the value, for two reasons. A status is a
+        // Space-owned workflow-state id — TASK_STATUSES is a legacy default set, not
+        // a closed vocabulary — so a space may legitimately define one we have never
+        // heard of. And `todo` IS a built-in, so refusing unknown values would not
+        // have caught the case that prompted this. What distinguishes the two
+        // readings is naming the filter and how to drop it.
+        //
+        // Silent when `--execution-state` is also set, to leave the exact bare
+        // string the branch above deliberately produces for that combination. The
+        // same ambiguity exists there, but overturning a pinned decision is not
+        // this change's business.
+        lines.push('');
+        lines.push(`Note: nothing matched \`--status ${flags.status}\`. A status is a workflow-state id the`);
+        lines.push('      space owns, so a board need not use this one at all.');
+        lines.push('  → See what this scope actually holds: the same command without `--status`.');
+        if (!data_provider_1.TASK_STATUSES.includes(flags.status)) {
+            lines.push(`      (built-in ids: ${data_provider_1.TASK_STATUSES.join(', ')})`);
+        }
+    }
     return lines.join('\n');
 }
 /**

package/dist/lib/daemonBroker.d.ts

@@ -36,6 +36,7 @@
  * liveness with `process.kill(pid, 0)` to filter stale files left behind
  * by a force-killed daemon.
  */
+import { type AuthBackend } from './auth-storage';
 import { type CliConfig } from './config';
 /**
  * Wire-shape of the bootstrap file. Mirrors
@@ -86,6 +87,13 @@ export interface DaemonBrokerResult {
      * the mint/confirm split, where the mint still revoked eagerly.
      */
     familyId?: string;
+    /**
+     * Where `attemptDaemonBrokerLoginAndPersist` actually stored the credential.
+     * Callers label the token's source from this, not from the platform: Keychain
+     * only exists on macOS, and even there a failed Keychain write falls back to
+     * the file.
+     */
+    storedIn?: Exclude<AuthBackend, 'none'>;
 }
 /**
  * Explicit reasons the broker path could fail. These exist to keep the

package/dist/lib/daemonBroker.js

@@ -527,7 +527,7 @@ async function attemptDaemonBrokerLoginAndPersist(opts) {
     if (!serverOrigin) {
         throw new Error('Daemon-broker credential persistence requires a valid CLI baseURL.');
     }
-    (0, auth_storage_1.writeToBackend)({
+    const storedIn = (0, auth_storage_1.writeToBackend)({
         token: outcome.accessToken,
         refreshToken: outcome.refreshToken,
         ...(expiryToEpochMs(outcome.accessExpiresAt) !== undefined
@@ -548,7 +548,7 @@ async function attemptDaemonBrokerLoginAndPersist(opts) {
             familyId: outcome.familyId,
         });
     }
-    return outcome;
+    return storedIn === 'none' ? outcome : { ...outcome, storedIn };
 }
 // ---------------------------------------------------------------------
 // Auto-broker on first command (BaseCommand.init hook)