@skrr-ai/cli 0.1.37 → 0.1.39

package/dist/lib/assignee-resolver.js

@@ -7,6 +7,7 @@ exports.describeMember = describeMember;
 exports.describeCandidates = describeCandidates;
 exports.resolveAssigneeReferences = resolveAssigneeReferences;
 exports.formatResolutionFailure = formatResolutionFailure;
+const failed_lookup_1 = require("./failed-lookup");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const OBJECT_ID_RE = /^[0-9a-fA-F]{24}$/;
 const UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
@@ -84,6 +85,11 @@ function resolveMember(query, members, kind) {
     if (!q) {
         return { ok: false, code: 'NOT_FOUND', query: raw, kind, candidates: pool };
     }
+    // A failed lookup's output is refused before the name tiers can match it.
+    // See `failed-lookup.ts`.
+    if ((0, failed_lookup_1.isFailedLookupValue)(raw)) {
+        return { ok: false, code: 'NOT_A_REFERENCE', query: raw, kind, candidates: [] };
+    }
     const tiers = [
         // 1. Exact id. Case-sensitive on purpose — ids are opaque.
         (m) => m.id === raw,
@@ -186,6 +192,8 @@ function formatResolutionFailure(failure, bin = 'skrr') {
     const noun = failure.kind === 'user' ? 'person' : 'agent';
     const plural = failure.kind === 'user' ? 'people' : 'agents';
     switch (failure.code) {
+        case 'NOT_A_REFERENCE':
+            return (0, failed_lookup_1.describeFailedLookupValue)(failure.query, noun);
         case 'AMBIGUOUS':
             return (`"${failure.query}" matches ${failure.candidates.length} ${plural} in this space:\n` +
                 `${describeCandidates(failure.candidates)}\n` +

package/dist/lib/bulk-task-targets.d.ts

@@ -29,6 +29,18 @@ export type BulkApplyResult = {
  * semantics match `skrr tasks bulk-update`). `apply` returns whether the task
  * actually changed (already-satisfied tasks are reported as no-ops).
  */
+/**
+ * The server's reason for a failed per-task write, not the transport's.
+ *
+ * A bulk run used to record `err.message`, which for a dataService call is the
+ * transport line — `HTTP 400 Bad Request — PATCH https://…/api/tasks/<id>` — so
+ * `tasks actions attach --all-in-space` printed that once per task and named
+ * neither the ref nor the rule that refused it (OSK-9652). The same call made
+ * for a single task goes through `handleApiError`, which reads the body. This
+ * reads it the same way: `message`, then `error`, plus the first validation
+ * detail when the server sent one.
+ */
+export declare function bulkFailureMessage(err: unknown): string;
 export declare function applyToTaskTargets(targets: Array<{
     id: string;
     identifier?: string;

package/dist/lib/bulk-task-targets.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.listSpaceTaskTargets = listSpaceTaskTargets;
+exports.bulkFailureMessage = bulkFailureMessage;
 exports.applyToTaskTargets = applyToTaskTargets;
 exports.formatBulkOutcome = formatBulkOutcome;
 exports.parseStatusFilter = parseStatusFilter;
@@ -34,6 +35,38 @@ async function listSpaceTaskTargets(options) {
  * semantics match `skrr tasks bulk-update`). `apply` returns whether the task
  * actually changed (already-satisfied tasks are reported as no-ops).
  */
+/**
+ * The server's reason for a failed per-task write, not the transport's.
+ *
+ * A bulk run used to record `err.message`, which for a dataService call is the
+ * transport line — `HTTP 400 Bad Request — PATCH https://…/api/tasks/<id>` — so
+ * `tasks actions attach --all-in-space` printed that once per task and named
+ * neither the ref nor the rule that refused it (OSK-9652). The same call made
+ * for a single task goes through `handleApiError`, which reads the body. This
+ * reads it the same way: `message`, then `error`, plus the first validation
+ * detail when the server sent one.
+ */
+function bulkFailureMessage(err) {
+    const e = err;
+    if (e && typeof e.body === 'string' && e.body.trim()) {
+        try {
+            const body = JSON.parse(e.body);
+            const reason = [body.message, body.error].find((value) => typeof value === 'string' && value.trim().length > 0);
+            if (reason) {
+                const detail = Array.isArray(body.details) ? body.details[0] : undefined;
+                const detailText = detail && typeof detail.message === 'string'
+                    ? ` — ${Array.isArray(detail.path) && detail.path.length ? `${detail.path.join('.')}: ` : ''}${detail.message}`
+                    : '';
+                const status = typeof e.status === 'number' ? ` (HTTP ${e.status})` : '';
+                return `${reason}${detailText}${status}`;
+            }
+        }
+        catch {
+            /* not JSON: fall back to the transport message below */
+        }
+    }
+    return err instanceof Error ? err.message : String(err);
+}
 async function applyToTaskTargets(targets, apply) {
     const result = { succeeded: [], failed: [] };
     for (const target of targets) {
@@ -46,7 +79,7 @@ async function applyToTaskTargets(targets, apply) {
             result.failed.push({
                 id: target.id,
                 label,
-                error: err instanceof Error ? err.message : String(err),
+                error: bulkFailureMessage(err),
             });
         }
     }

package/dist/lib/cli-installers.d.ts

@@ -0,0 +1,130 @@
+/** Matches `ManagedCliAuthenticationState` in `daemon/src/cli-installers.ts`. */
+export interface ManagedCliAuthentication {
+    status: 'ready' | 'interactive-required' | 'headless-key-required';
+    source: 'environment' | 'browser' | 'none';
+    message: string;
+}
+/**
+ * Matches `ManagedCliProviderState` in `daemon/src/cli-installers.ts`.
+ *
+ * Every field optional on purpose: this crosses a version boundary. The daemon
+ * on the other end may be older than this CLI (they ship separately, and this
+ * machine routinely runs a daemon bundled inside the desktop app), so a missing
+ * field has to read as "this daemon does not say", never as a falsy answer.
+ */
+export interface ManagedCliProviderState {
+    provider?: string;
+    displayName?: string;
+    binaryName?: string;
+    installed?: boolean;
+    available?: boolean;
+    version?: string;
+    minVersion?: string;
+    meetsMinimum?: boolean;
+    resolvedPath?: string | null;
+    source?: string;
+    installable?: boolean;
+    installDisabledReason?: string | null;
+    platformSupported?: boolean;
+    authentication?: ManagedCliAuthentication | null;
+    job?: {
+        id?: string;
+        status?: string;
+    } | null;
+}
+export interface CliInstallersResponse {
+    daemonId?: string;
+    enabled?: boolean;
+    platform?: string;
+    /** Absent from a daemon older than the field — render as "not reported". */
+    daemonVersion?: string;
+    providers?: ManagedCliProviderState[];
+}
+/**
+ * Providers the platform knows about that this daemon did not offer.
+ *
+ * The inventory is whatever the CONNECTED daemon supports, and an older daemon
+ * legitimately supports fewer: `devin` arrived in daemon 0.8.43, so a machine
+ * running 0.8.35 answers with six providers instead of seven. Observed here —
+ * the desktop app restarted the daemon from its bundled 0.8.35 copy and Devin
+ * disappeared from the install list between two page loads, with nothing on
+ * either screen to explain it. A provider that silently stops existing reads as
+ * dropped support.
+ *
+ * This works WITHOUT a daemon update, which is the point: `daemonVersion` only
+ * helps once apps ship a daemon that reports it, whereas the shared vocabulary
+ * is already on this side of the wire. Naming the gap is what turns "Devin is
+ * gone" into "this daemon is older than Devin".
+ */
+export declare function providersNotOffered(offered: readonly ManagedCliProviderState[] | undefined, known: readonly string[]): string[];
+export declare function listCliInstallers(daemonId: string, credential?: unknown): Promise<CliInstallersResponse>;
+/**
+ * The one-word readiness verdict for a provider, and whether it is good news.
+ *
+ * Four states, and the fourth is the one that matters most to get right:
+ * `unknown`. A provider whose recipe declares no credential resolver reports
+ * `authentication: null`, and that is NOT `ready` — this daemon simply has no
+ * way to read that vendor's credential state. Collapsing the two is the exact
+ * failure `d878b79581` was written to stop, so the word is different and the
+ * detail says why.
+ */
+export declare function readinessOf(provider: ManagedCliProviderState): {
+    label: string;
+    detail: string;
+    ok: boolean;
+};
+/** A job the daemon runs to install one managed provider. */
+export interface ManagedCliInstallJob {
+    id: string;
+    status: 'queued' | 'running' | 'succeeded' | 'failed';
+    error?: string;
+    log?: string[];
+}
+export interface StartInstallResponse {
+    started?: boolean;
+    provider?: ManagedCliProviderState;
+    job?: {
+        id?: string;
+        status?: string;
+    };
+}
+export declare function startManagedCliInstall(daemonId: string, provider: string, credential?: unknown): Promise<StartInstallResponse>;
+export declare function readManagedCliInstallJob(daemonId: string, jobId: string, credential?: unknown): Promise<{
+    job?: ManagedCliInstallJob;
+}>;
+/** A 100 MB download over a hotel connection is the case this has to survive. */
+export declare const INSTALL_MAX_WAIT_MS: number;
+export declare const INSTALL_POLL_INTERVAL_MS = 2000;
+export type FollowJobOutcome = {
+    kind: 'settled';
+    job: ManagedCliInstallJob;
+}
+/** The daemon is still working. NOT a failure — see below. */
+ | {
+    kind: 'timeout';
+    jobId: string;
+} | {
+    kind: 'missing';
+    jobId: string;
+};
+/**
+ * Poll an install job to completion, printing each new log line once.
+ *
+ * The daemon writes the only account of a download the user is waiting on
+ * ("Fetching the signed release manifest", "Verified and installed …"), so the
+ * loop relays it; printing only the unseen tail keeps a poll from repeating the
+ * whole log each time.
+ *
+ * A timeout is returned, never thrown as a failure. Saying "install failed"
+ * because this process ran out of patience is a lie that sends someone to debug
+ * a download that is going fine — so the caller decides the wording, and both
+ * callers say the daemon is still working.
+ */
+export declare function followManagedCliInstallJob(input: {
+    daemonId: string;
+    jobId: string;
+    credential?: unknown;
+    onLogLine?: (line: string) => void;
+    maxWaitMs?: number;
+    pollIntervalMs?: number;
+}): Promise<FollowJobOutcome>;

package/dist/lib/cli-installers.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INSTALL_POLL_INTERVAL_MS = exports.INSTALL_MAX_WAIT_MS = void 0;
+exports.providersNotOffered = providersNotOffered;
+exports.listCliInstallers = listCliInstallers;
+exports.readinessOf = readinessOf;
+exports.startManagedCliInstall = startManagedCliInstall;
+exports.readManagedCliInstallJob = readManagedCliInstallJob;
+exports.followManagedCliInstallJob = followManagedCliInstallJob;
+/**
+ * The daemon's managed-CLI installer inventory, as the CLI reads it.
+ *
+ * ## Why this file exists
+ *
+ * `GET /api/daemons/:id/cli-installers` is where `d878b79581` put the answer to
+ * "is this harness actually usable" — `installed`, and for providers whose
+ * credential state the daemon can read, one of `ready` /
+ * `interactive-required` / `headless-key-required`. The whole point of that
+ * change was to stop surfaces answering "is the binary there" instead.
+ *
+ * The CLI called the route from exactly one place (`commands/code/install.ts`),
+ * for one provider, to read one field, and showed the user none of it. So from
+ * the CLI there was no way to learn that a harness listed as `online` had no
+ * binary at all — which is the state this account's `skrr-code` row was in.
+ *
+ * The shape lives here rather than beside a command because two commands read
+ * it now. Root `CLAUDE.md`: a second declaration is how a surface silently
+ * drifts from the server that produced it.
+ */
+const data_provider_1 = require("@skrr-ai/data-provider");
+const api_fetch_1 = require("./api-fetch");
+/**
+ * Providers the platform knows about that this daemon did not offer.
+ *
+ * The inventory is whatever the CONNECTED daemon supports, and an older daemon
+ * legitimately supports fewer: `devin` arrived in daemon 0.8.43, so a machine
+ * running 0.8.35 answers with six providers instead of seven. Observed here —
+ * the desktop app restarted the daemon from its bundled 0.8.35 copy and Devin
+ * disappeared from the install list between two page loads, with nothing on
+ * either screen to explain it. A provider that silently stops existing reads as
+ * dropped support.
+ *
+ * This works WITHOUT a daemon update, which is the point: `daemonVersion` only
+ * helps once apps ship a daemon that reports it, whereas the shared vocabulary
+ * is already on this side of the wire. Naming the gap is what turns "Devin is
+ * gone" into "this daemon is older than Devin".
+ */
+function providersNotOffered(offered, known) {
+    // Canonicalize BOTH sides. An older daemon answers under the spelling it was
+    // built with — the 0.8.35 build reports the first-party harness as
+    // `sky-code`, so a raw comparison against `skrr-code` reported it missing on
+    // a machine where it is installed and working. Caught by running this against
+    // the very daemon the finding was about: the first version of this helper
+    // said "Not offered: devin, skrr-code" when only `devin` was true.
+    const canonical = (value) => typeof value === 'string' ? String((0, data_provider_1.canonicalHarnessProvider)(value) ?? value) : '';
+    const seen = new Set((offered ?? []).map((provider) => canonical(provider.provider)).filter(Boolean));
+    return known.filter((provider) => !seen.has(canonical(provider)));
+}
+async function listCliInstallers(daemonId, credential) {
+    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers`, { credential: credential });
+}
+/**
+ * The one-word readiness verdict for a provider, and whether it is good news.
+ *
+ * Four states, and the fourth is the one that matters most to get right:
+ * `unknown`. A provider whose recipe declares no credential resolver reports
+ * `authentication: null`, and that is NOT `ready` — this daemon simply has no
+ * way to read that vendor's credential state. Collapsing the two is the exact
+ * failure `d878b79581` was written to stop, so the word is different and the
+ * detail says why.
+ */
+function readinessOf(provider) {
+    if (provider.platformSupported === false) {
+        return { label: 'unsupported', detail: 'Not available on this platform.', ok: false };
+    }
+    if (!provider.installed) {
+        // `available` without `meetsMinimum` is a REAL third case and reads very
+        // differently from "not installed": the binary is right there and too old.
+        if (provider.available && provider.meetsMinimum === false) {
+            return {
+                label: 'too-old',
+                detail: provider.minVersion
+                    ? `Found ${provider.version || 'an older build'}; needs ${provider.minVersion} or newer.`
+                    : 'The installed build is older than the minimum this harness needs.',
+                ok: false,
+            };
+        }
+        return {
+            label: 'not-installed',
+            detail: provider.installDisabledReason || 'No binary for this provider on this machine.',
+            ok: false,
+        };
+    }
+    const auth = provider.authentication;
+    if (!auth) {
+        return {
+            label: 'unknown',
+            detail: 'Installed. This daemon cannot read this provider’s credential state.',
+            ok: false,
+        };
+    }
+    return { label: auth.status, detail: auth.message, ok: auth.status === 'ready' };
+}
+async function startManagedCliInstall(daemonId, provider, credential) {
+    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/${encodeURIComponent(provider)}/install`, { method: 'POST', body: {}, credential: credential });
+}
+async function readManagedCliInstallJob(daemonId, jobId, credential) {
+    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/jobs/${encodeURIComponent(jobId)}`, { credential: credential });
+}
+/** A 100 MB download over a hotel connection is the case this has to survive. */
+exports.INSTALL_MAX_WAIT_MS = 10 * 60_000;
+exports.INSTALL_POLL_INTERVAL_MS = 2_000;
+/**
+ * Poll an install job to completion, printing each new log line once.
+ *
+ * The daemon writes the only account of a download the user is waiting on
+ * ("Fetching the signed release manifest", "Verified and installed …"), so the
+ * loop relays it; printing only the unseen tail keeps a poll from repeating the
+ * whole log each time.
+ *
+ * A timeout is returned, never thrown as a failure. Saying "install failed"
+ * because this process ran out of patience is a lie that sends someone to debug
+ * a download that is going fine — so the caller decides the wording, and both
+ * callers say the daemon is still working.
+ */
+async function followManagedCliInstallJob(input) {
+    const deadline = Date.now() + (input.maxWaitMs ?? exports.INSTALL_MAX_WAIT_MS);
+    let printed = 0;
+    for (;;) {
+        const res = await readManagedCliInstallJob(input.daemonId, input.jobId, input.credential);
+        const job = res.job;
+        if (!job)
+            return { kind: 'missing', jobId: input.jobId };
+        if (input.onLogLine) {
+            for (const line of (job.log ?? []).slice(printed))
+                input.onLogLine(line);
+            printed = (job.log ?? []).length;
+        }
+        if (job.status === 'succeeded' || job.status === 'failed')
+            return { kind: 'settled', job };
+        if (Date.now() > deadline)
+            return { kind: 'timeout', jobId: input.jobId };
+        await new Promise((resolve) => setTimeout(resolve, input.pollIntervalMs ?? exports.INSTALL_POLL_INTERVAL_MS));
+    }
+}

package/dist/lib/command-miss.js

@@ -104,17 +104,65 @@ function describeCommandMiss(config, id) {
     // command id, so a whole-string comparison finds nothing and the reader is
     // told only that they are wrong — when the useful answer is "that topic
     // exists and here is what it does have".
+    const typedId = parts.join(':');
+    const spokenId = `${config.bin} ${parts.join(' ')}`;
+    // The id IS registered and the lookup still could not produce it. That is not
+    // a typo, so the "is not a command" wording below would be false — and worse,
+    // the suggestion search then finds the id itself and hands the reader their
+    // own input back:
+    //
+    //     $ skrr agents list --help
+    //         Error: `skrr agents list` is not a command.
+    //         Did you mean: `skrr agents list`?
+    //
+    // Observed against a real build, for ten commands in a row, and it is actively
+    // misleading rather than merely unhelpful: a dogfood run read it as proof that
+    // a shipped release had not shipped its commands. The two facts come from two
+    // sources — `findCommand` loads, `commandIDs` lists — and when they disagree
+    // the honest thing to report is the disagreement, which has a known cause and
+    // a next step.
+    if (config.commandIDs.includes(typedId) || config.topicNames.includes(typedId)) {
+        return (`\`${spokenId}\` is registered but could not be loaded from this build.\n` +
+            `Its compiled output is missing or stale — run \`npm --prefix cli run build\` in a ` +
+            `development checkout, or reinstall the CLI.`);
+    }
     const siblings = config.commandIDs.filter((c) => c.startsWith(`${parts[0]}:`));
-    const suggestions = siblings.length
+    const suggestions = (siblings.length
         ? nearestCommands(parts.slice(0, 2).join(':'), siblings)
-        : nearestCommands(parts.join(':'), [...config.commandIDs, ...config.topicNames]);
-    return (`\`${config.bin} ${parts.join(' ')}\` is not a command.` +
-        (suggestions.length
-            ? `\nDid you mean: ${suggestions
+        : nearestCommands(typedId, [...config.commandIDs, ...config.topicNames]))
+        // A suggestion identical to what was typed is an echo, not a correction.
+        // It can outrank real alternatives too, since nothing is closer to the id
+        // than the id, so it costs a suggestion slot as well as the reader's trust.
+        .filter((candidate) => candidate !== typedId);
+    if (suggestions.length) {
+        return (`\`${spokenId}\` is not a command.` +
+            `\nDid you mean: ${suggestions
                 .map((s) => `\`${config.bin} ${s.split(':').join(' ')}\``)
-                .join(', ')}?`
-            : `\nRun \`${config.bin} --help\` to see the topics.`));
+                .join(', ')}?`);
+    }
+    // The topic the reader typed is real, and nothing in it is spelled like what
+    // they asked for — a different word for it, not a typo. "See the topics"
+    // sent them back to the top level to rediscover the topic they had already
+    // found; what they need is what THIS topic has (OSK-9723: `skrr dm send`,
+    // where `dm` has no `send` at all).
+    if (siblings.length) {
+        const topic = parts[0];
+        const shown = siblings
+            .map((id) => id
+            .slice(topic.length + 1)
+            .split(':')
+            .join(' '))
+            .sort()
+            .slice(0, MAX_TOPIC_LISTING);
+        const more = siblings.length > shown.length ? ', …' : '';
+        return (`\`${spokenId}\` is not a command.\n` +
+            `\`${config.bin} ${topic}\` has: ${shown.map((c) => `\`${c}\``).join(', ')}${more}.\n` +
+            `See \`${config.bin} ${topic} --help\`.`);
+    }
+    return `\`${spokenId}\` is not a command.\nRun \`${config.bin} --help\` to see the topics.`;
 }
+/** Enough to scan at a glance; the topic's own `--help` has the rest. */
+const MAX_TOPIC_LISTING = 10;
 /** Adapt an oclif `Config` to the lookup shape above. */
 function lookupFromConfig(config) {
     return {

package/dist/lib/dedicated-lease-command.d.ts

@@ -61,7 +61,22 @@ export declare abstract class DedicatedLeaseCommand extends BaseCommand {
         timeout?: string;
         interval?: number;
         workspace?: string;
-    }, goal: DedicatedWaitGoal | null, verb: string): Promise<void>;
+    }, goal: DedicatedWaitGoal | null, verb: string, 
+    /** Fields a `--json` caller needs that the server response does not carry. */
+    jsonExtra?: Record<string, unknown>): Promise<void>;
 }
 /** The same transient verdict BaseCommand gives an ordinary API call. */
 export declare function dedicatedRuntimeApiErrorRetryable(err: unknown): boolean;
+/**
+ * Accept the id our own output printed.
+ *
+ * `skrr machines list --all` renders a Dedicated Runtime's MACHINE identity,
+ * which the server builds as `lease:${leaseId}` (`machineIdentityForHarness`).
+ * The lease routes want the bare `rtl_…`. Pasting the one you were just shown
+ * therefore 404'd, and the refusal blamed workspace scope — sending you to try
+ * `--workspace` when the fix was deleting six characters.
+ *
+ * Only the prefixes this product itself prints are stripped, so a genuinely
+ * unknown id still fails as an unknown id rather than being silently reshaped.
+ */
+export declare function stripMachineIdentityPrefix(ref: string): string;

package/dist/lib/dedicated-lease-command.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DedicatedLeaseCommand = exports.DEDICATED_LEASE_ARG_DESCRIPTION = exports.DEDICATED_SELF_LEASE = exports.dedicatedWaitFlags = void 0;
 exports.dedicatedRuntimeApiErrorRetryable = dedicatedRuntimeApiErrorRetryable;
+exports.stripMachineIdentityPrefix = stripMachineIdentityPrefix;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../base-command");
 const api_fetch_1 = require("./api-fetch");
@@ -51,7 +52,7 @@ class DedicatedLeaseCommand extends base_command_1.BaseCommand {
      */
     async resolveLeaseArg(lease) {
         if (lease !== exports.DEDICATED_SELF_LEASE)
-            return lease;
+            return stripMachineIdentityPrefix(lease);
         const descriptor = (0, daemonBroker_1.readBootstrap)(daemonBroker_1.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR);
         if (!descriptor?.daemonId) {
             this.error('`self` means the Dedicated Runtime this command runs on, and this is not one (or its daemon is not running). Pass a lease id.', { exit: 2 });
@@ -144,7 +145,9 @@ class DedicatedLeaseCommand extends base_command_1.BaseCommand {
      * Print the lease an action returned, or wait for its operation to finish
      * first when `--wait` was passed.
      */
-    async reportLeaseAction(response, flags, goal, verb) {
+    async reportLeaseAction(response, flags, goal, verb, 
+    /** Fields a `--json` caller needs that the server response does not carry. */
+    jsonExtra = {}) {
         let lease = response?.lease;
         const id = (0, dedicated_machines_1.dedicatedLeaseId)(lease);
         if (flags.wait && goal && id) {
@@ -200,7 +203,7 @@ class DedicatedLeaseCommand extends base_command_1.BaseCommand {
             }
         }
         if (flags.json) {
-            this.log(JSON.stringify({ ...(response || {}), lease }, null, 2));
+            this.log(JSON.stringify({ ...(response || {}), lease, ...jsonExtra }, null, 2));
             return;
         }
         this.log(`Dedicated Runtime ${id || 'unknown'} ${(0, dedicated_machines_1.dedicatedLeaseState)(lease)}.`);
@@ -226,3 +229,23 @@ function dedicatedRuntimeApiErrorRetryable(err) {
     }
     return (0, base_command_1.isRetryableFailure)(err.status, body);
 }
+/**
+ * Accept the id our own output printed.
+ *
+ * `skrr machines list --all` renders a Dedicated Runtime's MACHINE identity,
+ * which the server builds as `lease:${leaseId}` (`machineIdentityForHarness`).
+ * The lease routes want the bare `rtl_…`. Pasting the one you were just shown
+ * therefore 404'd, and the refusal blamed workspace scope — sending you to try
+ * `--workspace` when the fix was deleting six characters.
+ *
+ * Only the prefixes this product itself prints are stripped, so a genuinely
+ * unknown id still fails as an unknown id rather than being silently reshaped.
+ */
+function stripMachineIdentityPrefix(ref) {
+    const trimmed = ref.trim();
+    for (const prefix of ['lease:', 'dedicated-runtime:']) {
+        if (trimmed.startsWith(prefix))
+            return trimmed.slice(prefix.length);
+    }
+    return trimmed;
+}