@skrr-ai/cli 0.1.36 → 0.1.38

package/dist/commands/harnesses/models.js

@@ -38,7 +38,16 @@ class HarnessesModels extends base_command_1.BaseCommand {
         const report = payload;
         const models = report?.models ?? [];
         if (models.length === 0) {
-            this.log('This harness advertises no models.');
+            // "This harness advertises no models." is true and answers none of the
+            // three questions a reader has: is this a product gap, my machine's
+            // fault, or a broken command? Saying which provider was resolved and
+            // where the list comes from picks one — and, in the bug this replaced,
+            // would have shown `provider` as null on a Claude harness and named the
+            // defect on sight.
+            const resolved = report?.provider;
+            this.log(resolved
+                ? `No models are listed for ${resolved}. skrr keeps a curated list per provider and ${resolved} has no entries in it, so pick a model on the agent instead — \`skrr agents update <agent> --model <id>\` accepts an id this list does not name.`
+                : 'This harness resolved to no provider, so no model list could be built. That is a defect, not a configuration problem — report it with the harness id.');
             return;
         }
         if (report?.provider || report?.source) {

package/dist/commands/harnesses/show.d.ts

@@ -10,3 +10,18 @@ export default class HarnessesShow extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * Say what the caller DID pass, not only what they did not.
+ *
+ * Every id in this product is a bare string, and three of them are printed side
+ * by side: `machines show` takes a machine or daemon id, `harnesses show` takes
+ * a Harness id. `machines show <daemon-id>` succeeds, so a user who learns that
+ * reasonably tries the same id here — and got back only a restatement of the
+ * rule they had just broken, plus the Mongo field name `_id`, which names an
+ * implementation detail rather than anything they can see.
+ *
+ * The shapes below are the ones our own output prints, so recognising them
+ * costs nothing and turns a refusal into a redirect. Anything unrecognised
+ * still falls through to the general answer rather than being guessed at.
+ */
+export declare function describeWrongHarnessRef(ref: string): string;

package/dist/commands/harnesses/show.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeWrongHarnessRef = describeWrongHarnessRef;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const harness_provider_input_1 = require("../../lib/harness-provider-input");
@@ -35,9 +36,9 @@ class HarnessesShow extends base_command_1.BaseCommand {
             // "HTTP 400 Bad Request — GET /api/harnesses/<id>". Any 400 on this
             // lookup is the id being wrong, so branch on the status.
             if (err instanceof api_fetch_1.ApiFetchError && err.status === 400) {
-                this.error(`Not a harness id: ${args.harness}\n` +
-                    'A harness id is the 24-character Harness _id. Run `skrr harnesses list --all` ' +
-                    'to see the ids on this account.', { exit: 1 });
+                this.error(`Not a harness id: ${args.harness}\n${describeWrongHarnessRef(args.harness)}`, {
+                    exit: 1,
+                });
                 return;
             }
             this.handleApiError(err);
@@ -61,6 +62,14 @@ class HarnessesShow extends base_command_1.BaseCommand {
         this.log(`  provider    ${harness.provider}`);
         // `harnessLocation` is the difference between "your laptop" and "a cloud row",
         // and it decides which verbs apply: ping and claudeEngine are local-only.
+        // When YOUR alias is covering the shared name, say so and show both. The
+        // header prints the effective name, which is the alias — without this the
+        // value `harnesses update --name` just wrote appears on no surface at all,
+        // and you cannot tell you are reading your own label rather than the one
+        // everyone else sees.
+        if (harness.aliased && harness.sharedName && harness.sharedName !== harness.name) {
+            this.log(`  shared name ${harness.sharedName}  (your alias is showing instead)`);
+        }
         this.log(`  mode        ${harness.harnessLocation ?? 'unknown'}`);
         this.log(`  status      ${harness.status ?? 'unknown'}`);
         // Only for the claude provider. The daemon stamps `claudeEngine` on every
@@ -77,3 +86,35 @@ class HarnessesShow extends base_command_1.BaseCommand {
     }
 }
 exports.default = HarnessesShow;
+/**
+ * Say what the caller DID pass, not only what they did not.
+ *
+ * Every id in this product is a bare string, and three of them are printed side
+ * by side: `machines show` takes a machine or daemon id, `harnesses show` takes
+ * a Harness id. `machines show <daemon-id>` succeeds, so a user who learns that
+ * reasonably tries the same id here — and got back only a restatement of the
+ * rule they had just broken, plus the Mongo field name `_id`, which names an
+ * implementation detail rather than anything they can see.
+ *
+ * The shapes below are the ones our own output prints, so recognising them
+ * costs nothing and turns a refusal into a redirect. Anything unrecognised
+ * still falls through to the general answer rather than being guessed at.
+ */
+function describeWrongHarnessRef(ref) {
+    const seeIds = 'Run `skrr harnesses list --all` to see the harness ids on this account.';
+    if (/^daemon_/.test(ref)) {
+        return `That is a daemon id. \`skrr machines show ${ref}\` takes those. ${seeIds}`;
+    }
+    if (/^machine:/.test(ref)) {
+        return `That is a machine id. \`skrr machines show ${ref}\` takes those. ${seeIds}`;
+    }
+    if (/^(lease:|dedicated-runtime:|hosted-machine:)/.test(ref)) {
+        return ('That is a machine id for a rented runtime. `skrr machines show` takes it as printed; ' +
+            `\`skrr machines dedicated show\` takes the part after the colon. ${seeIds}`);
+    }
+    if (/^[0-9a-f]{24}$/i.test(ref)) {
+        // Right shape, wrong row — so the id is not the thing to explain.
+        return `No harness on this account has that id. ${seeIds}`;
+    }
+    return `A harness id is 24 hexadecimal characters. ${seeIds}`;
+}

package/dist/commands/harnesses/update.js

@@ -29,7 +29,7 @@ class HarnessesUpdate extends base_command_1.BaseCommand {
         }),
         description: core_1.Flags.string({ description: 'New description' }),
         'claude-engine': core_1.Flags.string({
-            description: 'How Claude Code runs on this machine: `sdk` in-process (needed for AskUserQuestion), `cli` as a child process. Local harnesses only.',
+            description: 'How Claude Code runs on this machine: `sdk` in-process (needed for AskUserQuestion), `cli` as a child process. Local CLAUDE harnesses only — the server refuses it on any other provider, because nothing would ever read it.',
             options: ['cli', 'sdk'],
         }),
     };

package/dist/commands/harnesses/usage.d.ts

@@ -1,6 +1,12 @@
 import { BaseCommand } from '../../base-command';
 export type UsageRow = {
     /** Fleet rollup only — one row per harness. */
+    harnessId?: string;
+    /**
+     * The pre-rename spelling of `harnessId`. The server stopped sending it at
+     * the harness rename; reading it alone left the HARNESS column printing `-`
+     * on every row of the rollup. Kept as a fallback for an older deployment.
+     */
     runtimeId?: string;
     name?: string;
     /** Single-harness report only — one row per hour. */
@@ -12,6 +18,25 @@ export type UsageRow = {
     outputTokens?: number;
     cachedInputTokens?: number;
 };
+/**
+ * The rows to render, whichever spelling the server used.
+ *
+ * `byHarness` is what it sends today. This reader asked only for `byRuntime` —
+ * the pre-rename spelling — so the fleet rollup was ALWAYS empty and the
+ * command always printed "No usage recorded.", while `--json` on the same call
+ * showed $24.93 across 46 sessions. A rollup cannot be empty while its own
+ * members are not, which is what made it findable.
+ *
+ * The old spellings stay as fallbacks, after the current one, so an older
+ * deployment still renders. They are not the primary, which is the whole bug.
+ */
+export declare function selectUsageRows(payload: {
+    byHarness?: UsageRow[];
+    byRuntime?: UsageRow[];
+    usage?: UsageRow[];
+} | undefined): UsageRow[];
+/** The HARNESS cell, under either spelling of the id. */
+export declare function usageRowHarnessCell(row: UsageRow): string;
 export interface UsageTable {
     rows: Record<string, string>[];
     columns: {

package/dist/commands/harnesses/usage.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectUsageRows = selectUsageRows;
+exports.usageRowHarnessCell = usageRowHarnessCell;
 exports.buildUsageTable = buildUsageTable;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
@@ -22,6 +24,26 @@ function count(value) {
     const n = Number(value);
     return Number.isFinite(n) ? n.toLocaleString('en-US') : '-';
 }
+/**
+ * The rows to render, whichever spelling the server used.
+ *
+ * `byHarness` is what it sends today. This reader asked only for `byRuntime` —
+ * the pre-rename spelling — so the fleet rollup was ALWAYS empty and the
+ * command always printed "No usage recorded.", while `--json` on the same call
+ * showed $24.93 across 46 sessions. A rollup cannot be empty while its own
+ * members are not, which is what made it findable.
+ *
+ * The old spellings stay as fallbacks, after the current one, so an older
+ * deployment still renders. They are not the primary, which is the whole bug.
+ */
+function selectUsageRows(payload) {
+    return payload?.byHarness ?? payload?.byRuntime ?? payload?.usage ?? [];
+}
+/** The HARNESS cell, under either spelling of the id. */
+function usageRowHarnessCell(row) {
+    const id = row.harnessId ?? row.runtimeId;
+    return id ? String(id).slice(0, 12) : '-';
+}
 const SHARED_COLUMNS = [
     { key: 'provider', header: 'PROVIDER' },
     { key: 'sessions', header: 'SESSIONS' },
@@ -66,7 +88,7 @@ function buildUsageTable(rows, perHarness) {
             ...SHARED_COLUMNS,
         ],
         rows: rows.map((r) => ({
-            harness: r.runtimeId ? String(r.runtimeId).slice(0, 12) : '-',
+            harness: usageRowHarnessCell(r),
             name: (0, format_1.formatCell)(r.name),
             ...shared(r),
         })),
@@ -105,7 +127,7 @@ class HarnessesUsage extends base_command_1.BaseCommand {
         // `{usage, totals}`. Neither is a superset, so read both rather than
         // assuming one and rendering a table of dashes for the other.
         const payload = report;
-        const rows = payload?.byRuntime ?? payload?.usage ?? [];
+        const rows = selectUsageRows(payload);
         const totals = payload?.grandTotals ?? payload?.totals;
         if (rows.length === 0) {
             this.log(args.harness ? 'No usage recorded for this harness.' : 'No usage recorded.');

package/dist/commands/instructions/status.js

@@ -29,6 +29,18 @@ class InstructionsStatus extends base_command_1.BaseCommand {
         // only `bundleId`, so join to the bundle list — including archived/deleted,
         // since a target can outlive its bundle. A failed lookup is non-fatal: the
         // column falls back to the full bundle id.
+        // The live daemons, so a stalled row can tell "this machine now starts its
+        // daemon a different way" from "the daemon is gone" — and only the second
+        // earns a destructive remedy. Non-fatal: an empty list degrades to the old
+        // wording, which is a guess, not a wrong claim about a daemon we checked.
+        let liveDaemonIds = [];
+        try {
+            const daemons = await data_provider_1.dataService.getDaemons();
+            liveDaemonIds = (daemons.active || []).map((d) => d.daemonId);
+        }
+        catch {
+            // Leave it empty.
+        }
         let bundleNames = new Map();
         try {
             const bundleResponse = await data_provider_1.dataService.listManagedInstructionBundles({
@@ -62,7 +74,7 @@ class InstructionsStatus extends base_command_1.BaseCommand {
                 (target.scope === 'global' ? 'global' : target.projectPath || 'project'),
             desired: target.desiredState,
             applied: target.appliedVersionNumber ? `v${target.appliedVersionNumber}` : '-',
-            status: (0, instruction_input_1.describeTargetSync)(target),
+            status: (0, instruction_input_1.describeTargetSync)(target, Date.now(), liveDaemonIds),
         })), [
             { key: 'id', header: 'TARGET ID' },
             // Wide enough for a prompt name (matches `instructions list`'s NAME

package/dist/commands/labels/list.d.ts

@@ -1,11 +1,34 @@
 import { BaseCommand } from '../../base-command';
+/**
+ * `labels list` — every label you can actually USE, by default.
+ *
+ * This used to default to `--scope user` and show one scope at a time, which
+ * is a faithful rendering of `GET /api/labels` and a poor answer to the
+ * question people ask. `scope` is an OWNERSHIP boundary, not a filter anyone
+ * browses by: a workspace-scoped label is attachable by every member, so
+ * leaving it out of the default view means the vocabulary you are told about
+ * is smaller than the one you have.
+ *
+ * It had a measurable cost. Three workspace-scoped labels existed and were
+ * invisible to the bare command, so nobody knew they were there — which is
+ * part of why the label system shipped complete and went unused, and why a
+ * second `dogfood` nearly got created beside one that already existed.
+ *
+ * `--scope` still narrows to exactly one scope, so every explicit invocation
+ * behaves as it always did. Only the bare command changed, and it changed to
+ * a superset.
+ *
+ * The merge itself is `lib/label-ref.collectLabelVocabulary` — the same
+ * function `--label <name>` resolves through. A separate copy here is how the
+ * name you can type and the name you can see start to disagree.
+ */
 export default class LabelsList extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        scope: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'applicable-to': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'include-archived': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
-        scope: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         'scope-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };

package/dist/commands/labels/list.js

@@ -5,17 +5,48 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
 const label_scope_1 = require("../../lib/label-scope");
+const label_ref_1 = require("../../lib/label-ref");
+/**
+ * `labels list` — every label you can actually USE, by default.
+ *
+ * This used to default to `--scope user` and show one scope at a time, which
+ * is a faithful rendering of `GET /api/labels` and a poor answer to the
+ * question people ask. `scope` is an OWNERSHIP boundary, not a filter anyone
+ * browses by: a workspace-scoped label is attachable by every member, so
+ * leaving it out of the default view means the vocabulary you are told about
+ * is smaller than the one you have.
+ *
+ * It had a measurable cost. Three workspace-scoped labels existed and were
+ * invisible to the bare command, so nobody knew they were there — which is
+ * part of why the label system shipped complete and went unused, and why a
+ * second `dogfood` nearly got created beside one that already existed.
+ *
+ * `--scope` still narrows to exactly one scope, so every explicit invocation
+ * behaves as it always did. Only the bare command changed, and it changed to
+ * a superset.
+ *
+ * The merge itself is `lib/label-ref.collectLabelVocabulary` — the same
+ * function `--label <name>` resolves through. A separate copy here is how the
+ * name you can type and the name you can see start to disagree.
+ */
 class LabelsList extends base_command_1.BaseCommand {
-    static description = 'List labels in a scope';
+    static description = 'List labels — every scope you can use, unless --scope narrows it';
     static examples = [
         '<%= config.bin %> labels list',
         '<%= config.bin %> labels list --applicable-to space',
+        '<%= config.bin %> labels list --scope user',
         '<%= config.bin %> labels list --scope workspace --scope-id <workspace-id>',
         '<%= config.bin %> labels list --include-archived --json',
     ];
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         ...label_scope_1.labelScopeFlags,
+        // No default, unlike the shared flag: its absence is what selects the
+        // merged view, so "not passed" and "passed user" must stay distinguishable.
+        scope: core_1.Flags.string({
+            description: 'Narrow to ONE scope. Omit to list every scope you can use.',
+            options: ['user', 'workspace'],
+        }),
         'applicable-to': core_1.Flags.string({
             description: 'Only labels applicable to this entity type',
             options: [...label_scope_1.LABEL_APPLICABLE],
@@ -25,38 +56,49 @@ class LabelsList extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { flags } = await this.parse(LabelsList);
-        let scope;
-        try {
-            scope = (0, label_scope_1.resolveLabelScope)(flags);
-        }
-        catch (err) {
-            this.error(err.message, { exit: 1 });
-        }
-        let response;
+        const applicableTo = flags['applicable-to'];
+        let items = [];
         try {
-            response = await data_provider_1.dataService.getLabels({
-                ...scope,
-                ...(flags['applicable-to']
-                    ? { applicableTo: flags['applicable-to'] }
-                    : {}),
-                ...(flags['include-archived'] ? { includeArchived: true } : {}),
-            });
+            if (flags.scope) {
+                const scope = (0, label_scope_1.resolveLabelScope)(flags);
+                const response = (await data_provider_1.dataService.getLabels({
+                    ...scope,
+                    ...(applicableTo ? { applicableTo } : {}),
+                    ...(flags['include-archived'] ? { includeArchived: true } : {}),
+                }));
+                items = response?.data ?? [];
+            }
+            else {
+                items = await (0, label_ref_1.collectLabelVocabulary)({
+                    ...(applicableTo ? { applicableTo } : {}),
+                    ...(process.env.OVERSKY_WORKSPACE_ID
+                        ? { workspaceId: process.env.OVERSKY_WORKSPACE_ID }
+                        : {}),
+                    ...(flags['include-archived'] ? { includeArchived: true } : {}),
+                });
+            }
         }
         catch (err) {
+            if (err instanceof Error && !('status' in err))
+                this.error(err.message, { exit: 1 });
             this.handleApiError(err);
         }
         if (flags.json) {
-            this.log(JSON.stringify(response, null, 2));
+            this.log(JSON.stringify({ data: items }, null, 2));
             return;
         }
-        const items = response?.data ?? [];
         if (items.length === 0) {
-            this.log('No labels.');
+            this.log(flags.scope
+                ? 'No labels in this scope.'
+                : 'No labels you can use. Create one with `labels create --name <name> --applicable-to <entity>`.');
             return;
         }
         const rows = items.map((l) => ({
             id: String(l.id ?? '-'),
             name: String(l.name ?? '-'),
+            // Where it lives decides who else sees it, and it is the one column the
+            // old single-scope view never had to show.
+            scope: String(l.scope ?? '-'),
             color: String(l.color ?? '-'),
             appliesTo: Array.isArray(l.applicableTo) ? l.applicableTo.join(',') : '-',
             used: String(l.usageCount ?? 0),
@@ -65,6 +107,7 @@ class LabelsList extends base_command_1.BaseCommand {
         (0, format_1.renderTable)(rows, [
             { key: 'id', header: 'ID' },
             { key: 'name', header: 'NAME', maxWidth: 32 },
+            { key: 'scope', header: 'SCOPE' },
             { key: 'color', header: 'COLOR' },
             { key: 'appliesTo', header: 'APPLIES TO' },
             { key: 'used', header: 'USED' },

package/dist/commands/machines/dedicated/catalog.js

@@ -41,16 +41,8 @@ class DedicatedMachinesCatalog extends dedicated_lease_command_1.DedicatedLeaseC
         this.log('\nSizes (--size-preset)');
         if (catalog.sizes.length === 0)
             this.log('  none offered right now');
-        for (const size of catalog.sizes) {
-            const spec = [
-                size.vcpus ? `${size.vcpus} vCPU` : '',
-                size.memoryGiB ? `${size.memoryGiB} GiB RAM` : '',
-                size.accelerator || '',
-            ]
-                .filter(Boolean)
-                .join(' · ');
-            this.log(`  ${String(size.id).padEnd(14)}${spec}`);
-        }
+        for (const line of (0, dedicated_machines_1.dedicatedCatalogSizeLines)(catalog))
+            this.log(line);
         if (catalog.storage) {
             const { minGb, defaultGb, maxGb } = catalog.storage;
             this.log(`\nWorkspace (--storage-gb)\n  ${minGb}–${maxGb} GiB, default ${defaultGb}; grow later, never shrink`);
@@ -64,11 +56,8 @@ class DedicatedMachinesCatalog extends dedicated_lease_command_1.DedicatedLeaseC
         if (catalog.regionClasses.length) {
             this.log(`\nRegion (--region-class)\n  ${catalog.regionClasses.join(', ')}`);
         }
-        this.log('\nPrices');
-        if (catalog.priceLines.length === 0)
-            this.log('  not published by this server');
-        for (const line of catalog.priceLines) {
-            this.log(`  ${line.display || `${(0, dedicated_machines_1.formatUsdCents)(line.amountCents)} ${line.label || ''}`}`);
+        for (const line of (0, dedicated_machines_1.dedicatedCatalogPriceLineOutput)(catalog.priceLines, catalog.priceBookVersion)) {
+            this.log(line);
         }
     }
 }

package/dist/commands/machines/dedicated/create.d.ts

@@ -17,6 +17,14 @@ export default class DedicatedMachinesCreate extends DedicatedLeaseCommand {
         workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'request-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * The catalog for the summary, or null. Not through `callDedicated`, which
+     * exits on an API error: an unreachable catalog must cost the summary its
+     * detail, not stop a create the user is about to confirm anyway.
+     */
+    private readCatalogForSummary;
 }

package/dist/commands/machines/dedicated/create.js

@@ -4,12 +4,14 @@ const core_1 = require("@oclif/core");
 const node_crypto_1 = require("node:crypto");
 const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+const harnesses_1 = require("../../../lib/harnesses");
 class DedicatedMachinesCreate extends dedicated_lease_command_1.DedicatedLeaseCommand {
     static description = 'Request a Dedicated Runtime lease. See `machines dedicated catalog` for sizes, storage bounds and prices.';
     static examples = [
         '<%= config.bin %> machines dedicated create --name dev-box --size-preset standard',
         '<%= config.bin %> machines dedicated create --name dev-box --size-preset standard --spending-limit-cents 20000',
-        '<%= config.bin %> machines dedicated create --name dev-box --size-preset standard --spending-limit-cents 20000 --repository acme/app --wait --json',
+        '<%= config.bin %> machines dedicated create --name dev-box --size-preset standard --dry-run',
+        '<%= config.bin %> machines dedicated create --name dev-box --size-preset standard --spending-limit-cents 20000 --repository acme/app --yes --wait --json',
     ];
     static flags = {
         name: core_1.Flags.string({ description: 'Display name for the dedicated machine', required: true }),
@@ -55,6 +57,13 @@ class DedicatedMachinesCreate extends dedicated_lease_command_1.DedicatedLeaseCo
             description: 'Idempotency key. Reuse it to safely retry the same create request.',
         }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        yes: core_1.Flags.boolean({
+            char: 'y',
+            description: 'Skip the confirmation. A create starts billing, so it asks first; required when not at a terminal.',
+        }),
+        'dry-run': core_1.Flags.boolean({
+            description: 'Show the size, price, storage, retention and cap this create would use, and create nothing',
+        }),
         ...dedicated_lease_command_1.dedicatedWaitFlags,
     };
     async run() {
@@ -76,6 +85,40 @@ class DedicatedMachinesCreate extends dedicated_lease_command_1.DedicatedLeaseCo
             repositoryRef: flags.repository,
             workspaceId: flags.workspace,
         });
+        // Say what is about to be bought before it is, in the catalog's own numbers.
+        // `destroy` has always asked first; the command that starts a meter did not
+        // (OSK-9592). A catalog read that fails only loses the summary's detail,
+        // never the confirmation itself.
+        if (flags['dry-run'] || !flags.yes) {
+            const catalog = await this.readCatalogForSummary();
+            const summary = (0, dedicated_machines_1.dedicatedCreateSummary)(catalog, {
+                name: flags.name,
+                sizePreset: flags['size-preset'],
+                storageGb: flags['storage-gb'],
+                retentionClass: flags['retention-class'],
+                spendingLimitCents: flags['spending-limit-cents'],
+            });
+            if (flags['dry-run']) {
+                if (flags.json) {
+                    this.log(JSON.stringify({ dryRun: true, request: body, summary }, null, 2));
+                }
+                else {
+                    for (const line of summary)
+                        this.log(line);
+                    this.log('Dry run: nothing was created.');
+                }
+                return;
+            }
+            if (!process.stdin.isTTY) {
+                this.error('Creating a Dedicated Runtime starts billing. Pass --yes to confirm when not at a terminal, or --dry-run to see what it would create.', { exit: 2 });
+            }
+            for (const line of summary)
+                this.log(line);
+            if (!(await this.confirm('Create it? [y/N] '))) {
+                this.log('Aborted. Nothing was created.');
+                this.exit(1);
+            }
+        }
         const response = await this.callDedicated(() => (0, dedicated_machines_1.createDedicatedRuntime)(body));
         const lease = response?.lease;
         const id = (0, dedicated_machines_1.dedicatedLeaseId)(lease);
@@ -97,6 +140,20 @@ class DedicatedMachinesCreate extends dedicated_lease_command_1.DedicatedLeaseCo
             this.log(`Poll: ${this.config.bin} machines dedicated show ${id}  (or pass --wait)`);
         }
     }
+    /**
+     * The catalog for the summary, or null. Not through `callDedicated`, which
+     * exits on an API error: an unreachable catalog must cost the summary its
+     * detail, not stop a create the user is about to confirm anyway.
+     */
+    async readCatalogForSummary() {
+        try {
+            return (0, dedicated_machines_1.dedicatedCatalogFromProducts)(await (0, harnesses_1.listHarnessProducts)());
+        }
+        catch (error) {
+            process.stderr.write(`Could not read the catalog for the summary (${error?.message || 'unknown error'}); showing what was passed.\n`);
+            return null;
+        }
+    }
 }
 exports.default = DedicatedMachinesCreate;
 function newRequestId() {

package/dist/commands/machines/dedicated/destroy.js

@@ -45,12 +45,17 @@ class DedicatedMachinesDestroy extends dedicated_lease_command_1.DedicatedLeaseC
         // so it does not ask. This mirrors the server's rule only to decide whether
         // to PROMPT; the server still decides what happens.
         let willPurge = Boolean(flags['purge-storage']);
+        // Read even under --yes when the workspace may be kept: whether a destroy
+        // keeps billing storage is worth saying afterwards, and only the lease as it
+        // stood before the destroy can say it.
+        const prior = willPurge
+            ? undefined
+            : (await this.callDedicated(() => (0, dedicated_machines_1.getDedicatedRuntime)(leaseId, this.scopeFrom(flags))))
+                ?.lease;
         if (!willPurge && !flags.yes) {
-            const current = await this.callDedicated(() => (0, dedicated_machines_1.getDedicatedRuntime)(leaseId, this.scopeFrom(flags)));
-            const lease = current?.lease;
             willPurge =
-                lease?.state === 'archived' ||
-                    (!flags['retain-storage'] && (lease?.storage?.retentionClass || 'none') === 'none');
+                prior?.state === 'archived' ||
+                    (!flags['retain-storage'] && (prior?.storage?.retentionClass || 'none') === 'none');
         }
         if (willPurge && !flags.yes) {
             if (!process.stdin.isTTY) {
@@ -69,6 +74,15 @@ class DedicatedMachinesDestroy extends dedicated_lease_command_1.DedicatedLeaseC
             retentionIntent = 'retain';
         const response = await this.callDedicated(() => (0, dedicated_machines_1.destroyDedicatedRuntime)(leaseId, { ...this.scopeFrom(flags), retentionIntent }));
         await this.reportLeaseAction(response, flags, { kind: 'destroyed' }, 'Destroying');
+        if (!flags.json) {
+            const note = (0, dedicated_machines_1.dedicatedDestroyRetentionNote)(prior, {
+                purge: Boolean(flags['purge-storage']),
+                retain: Boolean(flags['retain-storage']),
+                bin: this.config.bin,
+            });
+            if (note)
+                this.log(note);
+        }
     }
 }
 exports.default = DedicatedMachinesDestroy;

package/dist/commands/machines/dedicated/list.js

@@ -40,9 +40,14 @@ class DedicatedMachinesList extends dedicated_lease_command_1.DedicatedLeaseComm
             }
             return;
         }
+        const scopeSpendCents = (0, dedicated_machines_1.dedicatedScopeMonthSpendCents)(leases);
+        if (scopeSpendCents !== null) {
+            this.log(`Dedicated Runtime spend this month, across every machine listed: ${(0, dedicated_machines_1.formatUsdCents)(scopeSpendCents)}`);
+            this.log('');
+        }
         (0, format_1.renderTable)(leases.map((lease) => ({
             id: (0, format_1.formatCell)((0, dedicated_machines_1.dedicatedLeaseId)(lease)),
-            status: (0, format_1.formatCell)((0, dedicated_machines_1.dedicatedLeaseState)(lease)),
+            status: (0, format_1.formatCell)((0, dedicated_machines_1.dedicatedLeaseStatusCell)(lease)),
             name: (0, format_1.formatCell)((0, dedicated_machines_1.dedicatedLeaseDisplayName)(lease)),
             size: (0, format_1.formatCell)([
                 lease.resources?.sizePreset,
@@ -50,17 +55,15 @@ class DedicatedMachinesList extends dedicated_lease_command_1.DedicatedLeaseComm
             ]
                 .filter(Boolean)
                 .join(' ') || '-'),
-            spend: (0, format_1.formatCell)(lease.billing
-                ? `${(0, dedicated_machines_1.formatUsdCents)(lease.billing.currentMonthSpendCents)}/${(0, dedicated_machines_1.formatUsdCents)(lease.billing.monthlySpendLimitCents)}${lease.billing.spendingLimitExceeded ? ' OVER' : ''}`
-                : '-'),
+            cap: (0, format_1.formatCell)((0, dedicated_machines_1.dedicatedLeaseCapCell)(lease)),
             retention: (0, format_1.formatCell)(lease.storage?.retentionClass || '-'),
             backup: (0, format_1.formatCell)(lease.storage?.lastBackupAt || '-'),
         })), [
             { key: 'id', header: 'ID' },
-            { key: 'status', header: 'STATUS' },
+            { key: 'status', header: 'STATUS', maxWidth: 28 },
             { key: 'name', header: 'NAME', maxWidth: 28 },
             { key: 'size', header: 'SIZE', maxWidth: 18 },
-            { key: 'spend', header: 'MONTH/CAP', maxWidth: 24 },
+            { key: 'cap', header: 'MONTHLY CAP', maxWidth: 24 },
             { key: 'retention', header: 'RETENTION', maxWidth: 14 },
             { key: 'backup', header: 'LAST BACKUP', maxWidth: 24 },
         ], (line) => this.log(line));

package/dist/commands/machines/hosted/list.js

@@ -61,6 +61,18 @@ class HostedMachinesList extends base_command_1.BaseCommand {
             { key: 'repos', header: 'REPOS', maxWidth: 36 },
             { key: 'preview', header: 'PREVIEW', maxWidth: 48 },
         ], (line) => this.log(line));
+        // How to find the same box in the other list. `machines list` identifies a
+        // hosted machine by `lease:<leaseId>` — a different random string from the
+        // `sbs_` id in the ID column above — so side by side the two commands read
+        // as two unrelated machines. Saying the mapping once, where both values are
+        // already on screen, is cheaper than a column nobody can interpret.
+        const withLease = sessions.filter((session) => session.machineLeaseId);
+        if (withLease.length > 0) {
+            this.log('');
+            this.log(`In \`${this.config.bin} machines list\` these appear under their LEASE id as ` +
+                `\`lease:<lease>\` — e.g. \`lease:${String(withLease[0].machineLeaseId)}\`. ` +
+                `\`machines show\` takes either.`);
+        }
     }
     /**
      * OSK-2045 — this command lists Hosted Machine *sessions* and nothing else,