@skrr-ai/cli 0.1.47 → 0.1.49

package/dist/commands/machines/dedicated/service/status.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const format_1 = require("../../../../lib/format");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated service status` — one service, as the machine
+ * computes it right now: the spec it reconciles, the state it derived, and
+ * the exits it has seen.
+ *
+ * Status is computed from `spec + live children`, never stored — so what
+ * prints here is what the reconciler believes, not a record that can drift.
+ */
+class DedicatedServiceStatus extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Show one service: spec, computed status and recent exits';
+    static examples = [
+        '<%= config.bin %> machines dedicated service status <lease-id> <name>',
+        '<%= config.bin %> machines dedicated service status <lease-id> <name> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceStatus);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callService('get', {
+            leaseId,
+            name: args.name,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? {}, null, 2));
+            return;
+        }
+        const spec = result?.spec ?? {};
+        this.log(`service ${args.name} on ${leaseId}`);
+        const row = (label, value) => {
+            const cell = (0, format_1.formatCell)(value);
+            if (cell !== '-')
+                this.log(`  ${label.padEnd(13)}${cell}`);
+        };
+        // The wire's detail is an object (reason/exitCode/signal/restarts/…),
+        // not a string — serviceDetailText renders its fields or the row prints
+        // "[object Object]".
+        const detailText = (0, dedicated_service_1.serviceDetailText)(result?.detail);
+        row('status', [result?.status, detailText].filter(Boolean).join(' — ') || undefined);
+        row('restart', spec.restart);
+        row('command', Array.isArray(spec.command) ? spec.command.join(' ') : spec.shell);
+        row('cwd', spec.cwd);
+        row('created by', spec.createdBy);
+        row('revision', spec.revision);
+        row('notify', spec.notify === undefined ? undefined : String(spec.notify));
+        row('disabled', spec.disabled === undefined ? undefined : String(spec.disabled));
+        row('updated', spec.updatedAt ? (0, format_1.localStamp)(spec.updatedAt) : undefined);
+        const exits = result?.exits ?? [];
+        if (exits.length > 0) {
+            this.log('');
+            this.log('recent exits:');
+            (0, format_1.renderTable)(exits.slice(-10).map((exit) => ({
+                at: (0, format_1.formatCell)(exit.at ? (0, format_1.localStamp)(exit.at) : undefined),
+                code: (0, format_1.formatCell)(exit.exitCode ?? '-'),
+                signal: (0, format_1.formatCell)(exit.signal ?? '-'),
+            })), [
+                { key: 'at', header: 'AT' },
+                { key: 'code', header: 'EXIT' },
+                { key: 'signal', header: 'SIGNAL' },
+            ], (line) => this.log(line));
+        }
+        this.log('');
+        this.log('spec:');
+        this.log(JSON.stringify(spec, null, 2));
+    }
+}
+exports.default = DedicatedServiceStatus;

package/dist/commands/machines/dedicated/service/stop.d.ts

@@ -0,0 +1,20 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service stop` — desired state to stopped.
+ *
+ * This is the ONLY durable stop: it changes declared intent, so it survives
+ * the same restarts, checkpoints and replacements the service itself does.
+ * Killing the process is a symptom; stopping the declaration is the act.
+ */
+export default class DedicatedServiceStop extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/stop.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+/**
+ * `skrr machines dedicated service stop` — desired state to stopped.
+ *
+ * This is the ONLY durable stop: it changes declared intent, so it survives
+ * the same restarts, checkpoints and replacements the service itself does.
+ * Killing the process is a symptom; stopping the declaration is the act.
+ */
+class DedicatedServiceStop extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Set a service’s desired state to stopped (survives machine restarts)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service stop <lease-id> <name>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceStop);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        await this.runServiceAction(leaseId, args.name, 'stop', flags);
+    }
+}
+exports.default = DedicatedServiceStop;

package/dist/commands/machines/dedicated/service/top.d.ts

@@ -0,0 +1,22 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated service top` — per-service cpu, memory and pids
+ * read off the service scopes (phase 2).
+ *
+ * Every service lives in its own `skrr-svc-<name>.scope` cgroup, so its
+ * `cpu.stat`, `memory.current` and `pids.current` are reads, not
+ * instrumentation. A daemon that does not report stats yet gets the honest
+ * answer: the table prints `-`, not invented numbers.
+ */
+export default class DedicatedServiceTop extends DedicatedServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/service/top.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const format_1 = require("../../../../lib/format");
+function formatBytes(bytes) {
+    if (typeof bytes !== 'number' || !Number.isFinite(bytes))
+        return '-';
+    if (bytes >= 1 << 30)
+        return `${(bytes / (1 << 30)).toFixed(1)}G`;
+    if (bytes >= 1 << 20)
+        return `${(bytes / (1 << 20)).toFixed(1)}M`;
+    if (bytes >= 1 << 10)
+        return `${Math.round(bytes / (1 << 10))}K`;
+    return `${bytes}B`;
+}
+function statsCells(stats) {
+    if (!stats)
+        return { cpu: '-', mem: '-', pids: '-' };
+    const cpu = typeof stats.cpuPercent === 'number' ? `${Math.round(stats.cpuPercent)}%` : '-';
+    const mem = typeof stats.memoryBytes === 'number'
+        ? `${formatBytes(stats.memoryBytes)}${typeof stats.memoryMaxBytes === 'number' ? `/${formatBytes(stats.memoryMaxBytes)}` : ''}`
+        : '-';
+    const pids = typeof stats.pidsCurrent === 'number'
+        ? `${stats.pidsCurrent}${typeof stats.pidsMax === 'number' ? `/${stats.pidsMax}` : ''}`
+        : '-';
+    return { cpu, mem, pids };
+}
+/**
+ * `skrr machines dedicated service top` — per-service cpu, memory and pids
+ * read off the service scopes (phase 2).
+ *
+ * Every service lives in its own `skrr-svc-<name>.scope` cgroup, so its
+ * `cpu.stat`, `memory.current` and `pids.current` are reads, not
+ * instrumentation. A daemon that does not report stats yet gets the honest
+ * answer: the table prints `-`, not invented numbers.
+ */
+class DedicatedServiceTop extends dedicated_service_command_1.DedicatedServiceCommand {
+    static summary = 'Per-service cpu/mem/pids from the service scopes (phase 2)';
+    static examples = [
+        '<%= config.bin %> machines dedicated service top <lease-id>',
+        '<%= config.bin %> machines dedicated service top <lease-id> <name>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({
+            description: 'Service name (omit for all services)',
+            required: false,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedServiceTop);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        let rows = [];
+        let statsMissing = false;
+        if (args.name) {
+            const result = await this.callService('get', {
+                leaseId,
+                name: args.name,
+                ...this.scopeFrom(flags),
+            });
+            if (flags.json) {
+                this.log(JSON.stringify(result ?? {}, null, 2));
+                this.closeServiceChannel();
+                return;
+            }
+            statsMissing = !result?.stats;
+            rows = [
+                {
+                    name: args.name,
+                    status: (0, format_1.formatCell)(result?.status ?? 'unknown'),
+                    ...statsCells(result?.stats),
+                },
+            ];
+        }
+        else {
+            const result = await this.callService('list', {
+                leaseId,
+                ...this.scopeFrom(flags),
+            });
+            if (flags.json) {
+                this.log(JSON.stringify(result ?? { services: [] }, null, 2));
+                this.closeServiceChannel();
+                return;
+            }
+            const services = result?.services ?? [];
+            statsMissing = services.some((svc) => !svc.stats);
+            rows = services.map((svc) => ({
+                name: (0, format_1.formatCell)(svc.name ?? svc.spec?.name),
+                status: (0, format_1.formatCell)(svc.status ?? 'unknown'),
+                ...statsCells(svc.stats),
+            }));
+        }
+        this.closeServiceChannel();
+        if (rows.length === 0) {
+            this.log(`No declared services on ${leaseId}.`);
+            return;
+        }
+        (0, format_1.renderTable)(rows, [
+            { key: 'name', header: 'NAME', verbatim: true },
+            { key: 'status', header: 'STATUS' },
+            { key: 'cpu', header: 'CPU' },
+            { key: 'mem', header: 'MEM' },
+            { key: 'pids', header: 'PIDS' },
+        ], (line) => this.log(line));
+        if (statsMissing) {
+            this.log('No stats reported — this machine’s daemon does not expose per-service metrics yet (services_v1 stats).');
+        }
+    }
+}
+exports.default = DedicatedServiceTop;

package/dist/commands/machines/dedicated/sign-in-status.d.ts

@@ -0,0 +1,22 @@
+import type { DedicatedRuntimeSignInStatus } from '@skrr-ai/data-provider';
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated sign-in-status` — the read half of `sign-in`.
+ *
+ * Deliberately a separate command, not a flag on `sign-in`: the whole reason
+ * the endpoint exists is to answer the question WITHOUT starting a sign-in,
+ * and folding it into the verb that signs in would make the distinction a
+ * matter of remembering a flag.
+ */
+export default class DedicatedMachinesSignInStatus extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+export declare function describeSignInStatus(status: DedicatedRuntimeSignInStatus): string;

package/dist/commands/machines/dedicated/sign-in-status.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeSignInStatus = describeSignInStatus;
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+const LABELS = new Map(data_provider_1.DEDICATED_RUNTIME_SIGN_IN_PRESETS.map((preset) => [preset.tool, preset.label]));
+/**
+ * `skrr machines dedicated sign-in-status` — the read half of `sign-in`.
+ *
+ * Deliberately a separate command, not a flag on `sign-in`: the whole reason
+ * the endpoint exists is to answer the question WITHOUT starting a sign-in,
+ * and folding it into the verb that signs in would make the distinction a
+ * matter of remembering a flag.
+ */
+class DedicatedMachinesSignInStatus extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Report whether a Dedicated Runtime is signed in to GitHub CLI, Claude Code and Codex, without starting a sign-in. Read-only on the machine.';
+    static examples = [
+        '<%= config.bin %> machines dedicated sign-in-status <lease-id>',
+        '<%= config.bin %> machines dedicated sign-in-status <lease-id> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesSignInStatus);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const response = await this.callDedicated(() => (0, dedicated_machines_1.getDedicatedRuntimeSignInStatus)(leaseId, this.scopeFrom(flags)));
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        const statuses = response?.statuses ?? [];
+        if (!statuses.length) {
+            this.log('The machine reported no sign-in status.');
+            return;
+        }
+        for (const status of statuses)
+            this.log(describeSignInStatus(status));
+        // `unknown` is not `signed_out`, and the difference decides whether anyone
+        // should go and re-authenticate. Saying it once, at the end, rather than
+        // on every row, keeps the common all-signed-in case one line per tool.
+        if (statuses.every((status) => status.state === 'unknown')) {
+            this.log('\nNothing could be read. The probe may have timed out or the machine may be unreachable — ' +
+                'that is not evidence the credentials are gone. Check again shortly.');
+        }
+        else if (statuses.some((status) => status.state === 'unknown')) {
+            this.log('\n`unknown` means the check could not answer, not that the tool is signed out — ' +
+                'it may not be installed on this image.');
+        }
+        if (response.checkedAt)
+            this.log(`\nChecked ${response.checkedAt}.`);
+        // No state-derived exit code, on purpose. The one a script would reach for
+        // — non-zero when "not signed in" — has no honest definition here, because
+        // it would have to put `unknown` on one side or the other and both are
+        // wrong. `--json` carries the three states; let the caller decide which of
+        // them it cares about.
+    }
+}
+exports.default = DedicatedMachinesSignInStatus;
+const STATE_LABEL = {
+    signed_in: 'signed in',
+    signed_out: 'signed out',
+    unknown: 'unknown',
+};
+function describeSignInStatus(status) {
+    const label = LABELS.get(status.tool) ?? status.tool;
+    const account = status.account ? ` (${status.account})` : '';
+    return `${label.padEnd(12)} ${STATE_LABEL[status.state] ?? status.state}${account}`;
+}

package/dist/commands/machines/dedicated/ssh-config.d.ts

@@ -0,0 +1,28 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated ssh-config` — the OpenSSH stanza for every lease.
+ *
+ * The block is a wildcard `Host rtl_*.skrr`: installing it once makes
+ * `ssh rtl_<id>.skrr` (and therefore `scp`, `rsync`, `git`, VS Code
+ * Remote-SSH, JetBrains Gateway) work for every Dedicated Runtime the user
+ * ever leases — one device identity and one pin file under ~/.skrr/ssh/,
+ * nothing of the user's own ~/.ssh shared with it.
+ *
+ * By default the block is installed into ~/.ssh/config as a managed region
+ * between the skrr markers, and refuses — rather than edits — a config whose
+ * markers cannot bound a region. `--print` writes the block to stdout for
+ * people who keep their ssh config by hand.
+ */
+export default class DedicatedMachinesSshConfig extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        print: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/ssh-config.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const dedicated_ssh_1 = require("../../../lib/dedicated-ssh");
+/**
+ * `skrr machines dedicated ssh-config` — the OpenSSH stanza for every lease.
+ *
+ * The block is a wildcard `Host rtl_*.skrr`: installing it once makes
+ * `ssh rtl_<id>.skrr` (and therefore `scp`, `rsync`, `git`, VS Code
+ * Remote-SSH, JetBrains Gateway) work for every Dedicated Runtime the user
+ * ever leases — one device identity and one pin file under ~/.skrr/ssh/,
+ * nothing of the user's own ~/.ssh shared with it.
+ *
+ * By default the block is installed into ~/.ssh/config as a managed region
+ * between the skrr markers, and refuses — rather than edits — a config whose
+ * markers cannot bound a region. `--print` writes the block to stdout for
+ * people who keep their ssh config by hand.
+ */
+class DedicatedMachinesSshConfig extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Install (or --print) the ~/.ssh/config block that lets plain ssh/scp/rsync/Remote-SSH reach any Dedicated Runtime.';
+    static examples = [
+        '<%= config.bin %> machines dedicated ssh-config <lease-id>',
+        '<%= config.bin %> machines dedicated ssh-config <lease-id> --print',
+        '<%= config.bin %> machines dedicated ssh-config <lease-id> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: 'Dedicated Runtime lease id, or `self`',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        workspace: core_1.Flags.string({ description: 'Workspace scope' }),
+        print: core_1.Flags.boolean({ description: 'Print the block instead of installing it' }),
+        json: core_1.Flags.boolean({ description: 'Output the block as JSON' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(DedicatedMachinesSshConfig);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        // First use creates the device identity so the block names a file that
+        // exists; its admission still happens per-connection, by the daemon.
+        (0, dedicated_ssh_1.ensureSshIdentity)();
+        const block = (0, dedicated_ssh_1.sshConfigBlock)();
+        if (flags.json) {
+            this.log(JSON.stringify({ leaseId, config: block }, null, 2));
+            return;
+        }
+        if (flags.print) {
+            this.log(`${block}\n`);
+            return;
+        }
+        try {
+            const { configPath } = (0, dedicated_ssh_1.installSshConfigBlock)();
+            process.stderr.write(`Installed the skrr block in ${configPath}. \`ssh ${leaseId}.skrr\` (and scp, rsync, Remote-SSH) just work.\n`);
+        }
+        catch (error) {
+            if (error instanceof dedicated_ssh_1.DedicatedSshError) {
+                this.error(error.message, { exit: 1 });
+            }
+            throw error;
+        }
+    }
+}
+exports.default = DedicatedMachinesSshConfig;

package/dist/commands/machines/dedicated/ssh-proxy.d.ts

@@ -0,0 +1,22 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated ssh-proxy` — the ProxyCommand half of owner SSH.
+ *
+ * OpenSSH runs this with stdin/stdout wired to the SSH protocol: whatever the
+ * client writes arrives on the machine's sshd, whatever sshd writes is read
+ * back here. Everything else — admission, generation fencing, the ephemeral
+ * key's admission, host-key delivery — is carried by the channel, so this
+ * command's only job is to move bytes honestly and say why it cannot.
+ *
+ * Not for typing into: it writes protocol bytes to stdout and diagnostics to
+ * stderr, exactly like `ssh -W`. Humans want `ssh` (the next command) or the
+ * `ssh-config` block it can print.
+ */
+export default class DedicatedMachinesSshProxy extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        host: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/ssh-proxy.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const dedicated_ssh_1 = require("../../../lib/dedicated-ssh");
+/**
+ * `skrr machines dedicated ssh-proxy` — the ProxyCommand half of owner SSH.
+ *
+ * OpenSSH runs this with stdin/stdout wired to the SSH protocol: whatever the
+ * client writes arrives on the machine's sshd, whatever sshd writes is read
+ * back here. Everything else — admission, generation fencing, the ephemeral
+ * key's admission, host-key delivery — is carried by the channel, so this
+ * command's only job is to move bytes honestly and say why it cannot.
+ *
+ * Not for typing into: it writes protocol bytes to stdout and diagnostics to
+ * stderr, exactly like `ssh -W`. Humans want `ssh` (the next command) or the
+ * `ssh-config` block it can print.
+ */
+class DedicatedMachinesSshProxy extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Bridge stdio to a Dedicated Runtime’s SSH server — the ProxyCommand ssh/scp/rsync/Remote-SSH use. Not an interactive command.';
+    static examples = [
+        "ssh -o ProxyCommand='skrr machines dedicated ssh-proxy %h' rtl_abc123.skrr",
+        '<%= config.bin %> machines dedicated ssh-proxy rtl_abc123.skrr',
+    ];
+    static args = {
+        host: core_1.Args.string({
+            description: 'The ssh host alias (rtl_<id>.skrr) or a bare lease id',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args } = await this.parse(DedicatedMachinesSshProxy);
+        // `%h` arrives as the Host alias (`rtl_<id>.skrr`); a bare id or `self`
+        // work too, so the command is callable by hand.
+        const lease = (0, dedicated_ssh_1.leaseIdForSshHost)(args.host) ??
+            (args.host === 'self' ? await this.resolveLeaseArg('self') : null);
+        if (!lease) {
+            this.error(`Cannot read a lease id from '${args.host}'. Expected rtl_<id> or rtl_<id>.skrr.`, { exit: 2 });
+        }
+        let code;
+        try {
+            code = await (0, dedicated_ssh_1.runSshProxy)({
+                baseURL: this.cliConfig.baseURL,
+                token: this.resolvedCredential.token,
+                leaseId: lease,
+                input: process.stdin,
+                output: process.stdout,
+                errorOutput: process.stderr,
+            });
+        }
+        catch (err) {
+            if (err instanceof dedicated_ssh_1.DedicatedSshError)
+                this.error(err.message, { exit: 1 });
+            throw err;
+        }
+        if (code !== 0)
+            this.exit(code);
+    }
+}
+exports.default = DedicatedMachinesSshProxy;

package/dist/commands/machines/dedicated/ssh.d.ts

@@ -0,0 +1,29 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated ssh` — a real OpenSSH session on a Dedicated
+ * Runtime, as skrr-workload.
+ *
+ * The client on this machine is ordinary `ssh`: this command builds the
+ * options (`-o ProxyCommand=… ssh-proxy %h`, the lease's identity file and
+ * known_hosts) and execs it, so tab-completion, `-L`, agent forwarding and
+ * every other OpenSSH feature behave the way `man ssh` says they do.
+ * `ssh-proxy` carries the protocol over the admitted relay; there is no port
+ * on the machine for the session to have arrived on.
+ *
+ * `scp`, `rsync`, `git` over SSH, VS Code Remote-SSH and JetBrains Gateway
+ * take the same path — they just need the Host block, which `ssh-config`
+ * prints.
+ */
+export default class DedicatedMachinesSsh extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static usage: string;
+    static strict: boolean;
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}