@skrr-ai/cli 0.1.48 → 0.1.50

package/dist/commands/goals/create.js

@@ -5,6 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const web_url_1 = require("../../lib/web-url");
 const prompt_1 = require("../../lib/prompt");
+const label_ref_1 = require("../../lib/label-ref");
 const projects_1 = require("../../lib/projects");
 const created_line_1 = require("../../lib/created-line");
 class GoalsCreate extends base_command_1.BaseCommand {
@@ -30,6 +31,10 @@ class GoalsCreate extends base_command_1.BaseCommand {
         }),
         'target-date': core_1.Flags.string({ description: 'Target date (YYYY-MM-DD or ISO timestamp)' }),
         space: core_1.Flags.string({ description: 'Space ID to link this goal into after creation' }),
+        label: core_1.Flags.string({
+            description: 'Attach a label (repeatable) — id, or a name from `skrr labels list --applicable-to goal`. An unknown name is refused, never created.',
+            multiple: true,
+        }),
         project: core_1.Flags.string({
             description: 'Project to contain this goal — id, or a ref (OSK-P-12) alongside --space, or a qualified ref (OSK-S-3/OSK-P-12)',
         }),
@@ -102,6 +107,23 @@ class GoalsCreate extends base_command_1.BaseCommand {
                 exit: 1,
             });
         }
+        let resolvedLabelIds;
+        try {
+            const ids = await (0, label_ref_1.resolveLabelRefs)(flags.label, {
+                applicableTo: 'goal',
+                ...(process.env.OVERSKY_WORKSPACE_ID
+                    ? { workspaceId: process.env.OVERSKY_WORKSPACE_ID }
+                    : {}),
+            });
+            resolvedLabelIds = ids.length > 0 ? ids : undefined;
+        }
+        catch (err) {
+            if (err instanceof label_ref_1.LabelRefError)
+                this.error(err.message, { exit: 1 });
+            this.handleApiError(err);
+        }
+        if (resolvedLabelIds)
+            payload.labelIds = resolvedLabelIds;
         let created;
         try {
             created = await data_provider_1.dataService.createGoal(payload);

package/dist/commands/logout.js

@@ -39,6 +39,7 @@ const base_command_1 = require("../base-command");
 const config_1 = require("../lib/config");
 const first_party_harness_managed_1 = require("../lib/first-party-harness-managed");
 const auth_storage_1 = require("../lib/auth-storage");
+const daemonBroker_1 = require("../lib/daemonBroker");
 const refresh_1 = require("../lib/refresh");
 const api_fetch_1 = require("../lib/api-fetch");
 const cred_envelope_1 = require("../lib/cred-envelope");
@@ -129,7 +130,17 @@ class Logout extends base_command_1.BaseCommand {
             hasUnreadableEncryptedToken,
             allDevices: flags['all-devices'],
         })) {
-            this.log('Not signed in. Nothing to do.');
+            // On a broker-mode machine (a Dedicated guest descriptor advertising
+            // `access_token`) there IS no local credential to clear — the CLI holds
+            // a per-process token redeemed over loopback and nothing is persisted.
+            // Say that honestly rather than reporting a logout that did not happen.
+            if ((0, daemonBroker_1.findBrokeredHandoffDescriptor)()) {
+                this.log("This machine is signed in through the platform's managed hand-off; " +
+                    'there is no local credential to clear.');
+            }
+            else {
+                this.log('Not signed in. Nothing to do.');
+            }
             return;
         }
         if (flags['all-devices'] && !hasUsableLocalToken) {

package/dist/commands/machines/dedicated/index.js

@@ -40,7 +40,7 @@ class DedicatedMachines extends core_1.Command {
             ['show', 'state, size, spend, health and engines of one lease'],
             ['current', 'the lease of the machine this runs on (or pass `self`)'],
             ['attach', 'pin an agent so its work runs on the machine'],
-            ['terminal', 'open an interactive shell on the machine'],
+            ['terminal', 'open a shell that survives disconnect (ls|kill|rename manage it)'],
             ['sign-in', 'sign in to GitHub CLI, Claude Code or Codex there'],
             ['exec', 'run one command; output and exit code'],
             ['cp', 'copy a file to or from the machine'],

package/dist/commands/machines/dedicated/sign-in.js

@@ -44,7 +44,10 @@ class DedicatedMachinesSignIn extends dedicated_lease_command_1.DedicatedLeaseCo
         // Said before, not after: once the code is entered the credential already
         // sits on the workspace volume, in every later snapshot.
         process.stderr.write(`${preset.label} sign-in is stored on the workspace volume and shared by everything running as skrr-workload on this machine, including agents. Prefer a narrowly-scoped account or token.\n`);
-        await this.openDedicatedTerminal(args.lease, flags, preset.command);
+        // Its own named session — not `main`: a sign-in typed into a shell that
+        // is running a dev server would wait forever for a prompt that is not
+        // coming, and the session survives a detached OAuth flow either way.
+        await this.openDedicatedTerminal(args.lease, { ...flags, name: 'sign-in' }, preset.command);
     }
 }
 exports.default = DedicatedMachinesSignIn;

package/dist/commands/machines/dedicated/terminal/kill.d.ts

@@ -0,0 +1,21 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated terminal kill` — end a persistent session.
+ *
+ * Detaching (Ctrl-], a dropped connection, `terminal` exiting) never ends a
+ * session — the machine keeps the tmux session and everything in it alive
+ * by design. This is the explicit verb that destroys one: the shell and its
+ * whole process tree stop with it.
+ */
+export default class DedicatedMachinesTerminalKill extends DedicatedServiceCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/terminal/kill.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated terminal kill` — end a persistent session.
+ *
+ * Detaching (Ctrl-], a dropped connection, `terminal` exiting) never ends a
+ * session — the machine keeps the tmux session and everything in it alive
+ * by design. This is the explicit verb that destroys one: the shell and its
+ * whole process tree stop with it.
+ */
+class DedicatedMachinesTerminalKill extends dedicated_service_command_1.DedicatedServiceCommand {
+    static description = 'End a persistent terminal session on a Dedicated Runtime — its shell and everything running in it stop.';
+    static examples = [
+        '<%= config.bin %> machines dedicated terminal kill <lease-id> term-2',
+        '<%= config.bin %> machines dedicated terminal ls <lease-id>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({
+            description: 'Session name, as `terminal ls` prints it (e.g. main, term-2)',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesTerminalKill);
+        if (!dedicated_service_1.DEDICATED_TERMINAL_NAME_PATTERN.test(args.name)) {
+            this.error('A session name is lowercase letters, digits and dashes, up to 32 characters (e.g. `dev`, `build-2`).', { exit: 2 });
+        }
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callDedicatedTerminal('kill', {
+            leaseId,
+            name: args.name,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: args.name, killed: true }, null, 2));
+            return;
+        }
+        this.log(`Terminal session '${args.name}' ended — its shell and everything running in it stopped.`);
+    }
+}
+exports.default = DedicatedMachinesTerminalKill;

package/dist/commands/machines/dedicated/terminal/ls.d.ts

@@ -0,0 +1,22 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated terminal ls` — the sessions the machine is
+ * keeping alive.
+ *
+ * A persistent terminal is a tmux session on the guest (`skrr-term-<name>`)
+ * that survives Ctrl-] detaches, disconnects and daemon restarts; this is
+ * the read side of the web lease card's resume picker. Sessions only ever
+ * end through `terminal kill` or the shell's own `exit` — nothing here is
+ * created implicitly.
+ */
+export default class DedicatedMachinesTerminalLs extends DedicatedServiceCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/terminal/ls.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const format_1 = require("../../../../lib/format");
+/**
+ * `skrr machines dedicated terminal ls` — the sessions the machine is
+ * keeping alive.
+ *
+ * A persistent terminal is a tmux session on the guest (`skrr-term-<name>`)
+ * that survives Ctrl-] detaches, disconnects and daemon restarts; this is
+ * the read side of the web lease card's resume picker. Sessions only ever
+ * end through `terminal kill` or the shell's own `exit` — nothing here is
+ * created implicitly.
+ */
+class DedicatedMachinesTerminalLs extends dedicated_service_command_1.DedicatedServiceCommand {
+    static description = 'List the persistent terminal sessions a Dedicated Runtime is keeping alive (the tmux sessions `terminal` attaches to).';
+    static examples = [
+        '<%= config.bin %> machines dedicated terminal ls <lease-id>',
+        '<%= config.bin %> machines dedicated terminal ls <lease-id> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesTerminalLs);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callDedicatedTerminal('list', {
+            leaseId,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { sessions: [] }, null, 2));
+            return;
+        }
+        const sessions = result?.sessions ?? [];
+        if (sessions.length === 0) {
+            this.log(`No terminal sessions on ${leaseId}.`);
+            this.log(`Open one with \`${this.config.bin} machines dedicated terminal ${leaseId}\`.`);
+            return;
+        }
+        (0, format_1.renderTable)(sessions.map((session) => ({
+            name: (0, format_1.formatCell)(session.name),
+            attached: session.attached ? 'yes' : 'no',
+            created: (0, format_1.formatCell)(
+            // The daemon reports tmux `session_created`, which is SECONDS —
+            // `localStamp` reads a number as milliseconds.
+            typeof session.createdAt === 'number'
+                ? (0, format_1.localStamp)(session.createdAt * 1000)
+                : session.createdAt !== undefined
+                    ? (0, format_1.localStamp)(session.createdAt)
+                    : undefined),
+        })), [
+            { key: 'name', header: 'NAME', verbatim: true },
+            { key: 'attached', header: 'ATTACHED' },
+            { key: 'created', header: 'CREATED' },
+        ], (line) => this.log(line));
+        this.log(`Attach with \`${this.config.bin} machines dedicated terminal ${leaseId} --name <name>\`; end one with \`terminal kill\`.`);
+    }
+}
+exports.default = DedicatedMachinesTerminalLs;

package/dist/commands/machines/dedicated/terminal/rename.d.ts

@@ -0,0 +1,23 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated terminal rename` — give a live session a better
+ * name.
+ *
+ * The machine auto-names sessions it allocates (`term-1`, `term-2`, …);
+ * renaming one to `dev` or `build` makes the `terminal --name` you attach
+ * with self-explanatory. The session keeps running — a rename never
+ * detaches or restarts it.
+ */
+export default class DedicatedMachinesTerminalRename extends DedicatedServiceCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        newName: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/terminal/rename.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated terminal rename` — give a live session a better
+ * name.
+ *
+ * The machine auto-names sessions it allocates (`term-1`, `term-2`, …);
+ * renaming one to `dev` or `build` makes the `terminal --name` you attach
+ * with self-explanatory. The session keeps running — a rename never
+ * detaches or restarts it.
+ */
+class DedicatedMachinesTerminalRename extends dedicated_service_command_1.DedicatedServiceCommand {
+    static description = 'Rename a persistent terminal session on a Dedicated Runtime (the session keeps running).';
+    static examples = [
+        '<%= config.bin %> machines dedicated terminal rename <lease-id> term-2 dev',
+        '<%= config.bin %> machines dedicated terminal ls <lease-id>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({
+            description: 'Current session name, as `terminal ls` prints it',
+            required: true,
+            ignoreStdin: true,
+        }),
+        newName: core_1.Args.string({
+            description: 'The name to give it — lowercase letters, digits and dashes',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesTerminalRename);
+        for (const name of [args.name, args.newName]) {
+            if (!dedicated_service_1.DEDICATED_TERMINAL_NAME_PATTERN.test(name)) {
+                this.error('A session name is lowercase letters, digits and dashes, up to 32 characters (e.g. `dev`, `build-2`).', { exit: 2 });
+            }
+        }
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callDedicatedTerminal('rename', {
+            leaseId,
+            name: args.name,
+            newName: args.newName,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: args.name, newName: args.newName }, null, 2));
+            return;
+        }
+        this.log(`Terminal session '${args.name}' is now '${args.newName}'.`);
+    }
+}
+exports.default = DedicatedMachinesTerminalRename;

package/dist/commands/machines/dedicated/terminal.d.ts

@@ -7,6 +7,12 @@ import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
  * `gh auth login`, a REPL, a dev server's interactive setup and `claude` itself
  * reachable only from a browser. This opens the same real PTY the web does,
  * through the same relay and the same admission.
+ *
+ * Sessions are persistent by default (always-on §6.4): the machine runs the
+ * shell inside tmux, so Ctrl-] detaches and the same command re-attaches the
+ * same session — a lost connection re-attaches too, when the machine's image
+ * announces `persistent_terminal_v1`. `terminal ls|kill|rename` are the
+ * session's management verbs; `--ephemeral` is the old disposable shell.
  */
 export default class DedicatedMachinesTerminal extends DedicatedLeaseCommand {
     static description: string;
@@ -17,6 +23,9 @@ export default class DedicatedMachinesTerminal extends DedicatedLeaseCommand {
     static flags: {
         cwd: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         command: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        new: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        ephemeral: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/machines/dedicated/terminal.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const dedicated_service_1 = require("../../../lib/dedicated-service");
 /**
  * `skrr machines dedicated terminal` — the web lease card's "Open terminal",
  * from a terminal.
@@ -10,13 +11,23 @@ const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command"
  * `gh auth login`, a REPL, a dev server's interactive setup and `claude` itself
  * reachable only from a browser. This opens the same real PTY the web does,
  * through the same relay and the same admission.
+ *
+ * Sessions are persistent by default (always-on §6.4): the machine runs the
+ * shell inside tmux, so Ctrl-] detaches and the same command re-attaches the
+ * same session — a lost connection re-attaches too, when the machine's image
+ * announces `persistent_terminal_v1`. `terminal ls|kill|rename` are the
+ * session's management verbs; `--ephemeral` is the old disposable shell.
  */
 class DedicatedMachinesTerminal extends dedicated_lease_command_1.DedicatedLeaseCommand {
-    static description = 'Open an interactive shell on a Dedicated Runtime (a real PTY, as skrr-workload). Ctrl-] closes it.';
+    static description = 'Open an interactive shell on a Dedicated Runtime (a real PTY, as skrr-workload). The session persists on the machine: Ctrl-] detaches, and the same command re-attaches it.';
     static examples = [
         '<%= config.bin %> machines dedicated terminal <lease-id>',
+        '<%= config.bin %> machines dedicated terminal <lease-id> --name dev',
+        '<%= config.bin %> machines dedicated terminal <lease-id> --new',
+        '<%= config.bin %> machines dedicated terminal <lease-id> --ephemeral',
         '<%= config.bin %> machines dedicated terminal <lease-id> --cwd /workspace/repos/app',
         '<%= config.bin %> machines dedicated terminal <lease-id> --command "npm run dev"',
+        '<%= config.bin %> machines dedicated terminal ls <lease-id>',
     ];
     static args = {
         lease: core_1.Args.string({
@@ -27,15 +38,29 @@ class DedicatedMachinesTerminal extends dedicated_lease_command_1.DedicatedLease
     };
     static flags = {
         cwd: core_1.Flags.string({
-            description: 'Directory to start in (defaults to HOME, /workspace/user-data)',
+            description: 'Directory to start in (defaults to HOME, /workspace/user-data). Only applied when the session is created — re-attaching one ignores it.',
         }),
         command: core_1.Flags.string({
             description: 'A command to type into the shell once it shows its prompt, as if you typed it. Not typed if you type first. The shell stays open after it.',
         }),
+        name: core_1.Flags.string({
+            description: "Attach or create the persistent session with this name (default 'main'). Lowercase letters, digits and dashes, up to 32 characters.",
+        }),
+        new: core_1.Flags.boolean({
+            description: 'Open a new persistent session instead of attaching one — the machine names it (term-1, term-2, …) and prints the name so it can be re-attached.',
+            exclusive: ['name'],
+        }),
+        ephemeral: core_1.Flags.boolean({
+            description: 'Open a disposable shell that ends with the connection — the pre-persistent semantics; nothing is kept on the machine.',
+            exclusive: ['name', 'new'],
+        }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(DedicatedMachinesTerminal);
+        if (flags.name !== undefined && !dedicated_service_1.DEDICATED_TERMINAL_NAME_PATTERN.test(flags.name)) {
+            this.error('A session name is lowercase letters, digits and dashes, up to 32 characters (e.g. `dev`, `build-2`).', { exit: 2 });
+        }
         await this.openDedicatedTerminal(args.lease, flags, flags.command);
     }
 }

package/dist/commands/machines/hosted/connect.js

@@ -45,7 +45,7 @@ class HostedMachinesConnect extends base_command_1.BaseCommand {
                 this.log(`Preview: ${response.session.previewUrl}`);
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);
@@ -79,7 +79,7 @@ class HostedMachinesConnect extends base_command_1.BaseCommand {
                         this.log(`[exit ${exitCode}]`);
                 }
                 catch (err) {
-                    const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+                    const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
                     this.log(message || err.message);
                 }
             }

package/dist/commands/machines/hosted/destroy.js

@@ -28,7 +28,7 @@ class HostedMachinesDestroy extends base_command_1.BaseCommand {
             response = await (0, hosted_machines_1.destroyHostedMachine)(args.id, { workspaceId: flags.workspace });
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/exec.js

@@ -95,7 +95,7 @@ class HostedMachinesExec extends base_command_1.BaseCommand {
             response = await (0, hosted_machines_1.execHostedMachine)(id, body, { workspaceId: flags.workspace });
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/list.js

@@ -28,7 +28,7 @@ class HostedMachinesList extends base_command_1.BaseCommand {
             response = await (0, hosted_machines_1.listHostedMachines)({ workspaceId: flags.workspace, limit: flags.limit });
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/pause.js

@@ -28,7 +28,7 @@ class HostedMachinesPause extends base_command_1.BaseCommand {
             response = await (0, hosted_machines_1.pauseHostedMachine)(args.id, { workspaceId: flags.workspace });
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/pull.js

@@ -85,7 +85,7 @@ class HostedMachinesPull extends base_command_1.BaseCommand {
             }, { workspaceId: flags.workspace });
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message) {
                 this.failWithCliError({
                     message,

package/dist/commands/machines/hosted/resume.js

@@ -48,7 +48,7 @@ class HostedMachinesResume extends base_command_1.BaseCommand {
             }
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/start.js

@@ -128,7 +128,7 @@ class HostedMachinesStart extends base_command_1.BaseCommand {
             // than offering none.
             const strandedId = (0, hosted_machines_1.hostedMachineId)(session);
             if (strandedId) {
-                const cause = (0, hosted_machines_1.formatHostedMachineApiError)(err) ||
+                const cause = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin }) ||
                     err?.message ||
                     'Hosted Machine setup failed.';
                 this.failWithCliError({
@@ -143,7 +143,7 @@ class HostedMachinesStart extends base_command_1.BaseCommand {
                     retryable: false,
                 });
             }
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/status.js

@@ -42,7 +42,7 @@ class HostedMachinesStatus extends base_command_1.BaseCommand {
                 response = await (0, hosted_machines_1.getHostedMachine)(args.id, { workspaceId: flags.workspace });
             }
             catch (err) {
-                const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+                const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
                 if (message)
                     this.error(message, { exit: 1 });
                 this.handleApiError(err);
@@ -78,6 +78,7 @@ class HostedMachinesStatus extends base_command_1.BaseCommand {
         this.log(`Machine lease: ${session.machineLeaseId || '-'}`);
         this.log(`Repos: ${(0, hosted_machines_1.hostedMachineRepoSummary)(session)}`);
         this.log(`Preview: ${session.previewUrl || '-'}`);
+        this.log(`Isolation: ${(0, hosted_machines_1.hostedMachineIsolationSummary)(session)}`);
         if (session.idleTimeoutMs)
             this.log(`Idle timeout: ${session.idleTimeoutMs}ms`);
         const error = (0, hosted_machines_1.hostedMachineErrorSummary)(session);

package/dist/commands/tasks/create.js

@@ -221,6 +221,7 @@ class TasksCreate extends base_command_1.BaseCommand {
         }),
         tag: core_1.Flags.string({ description: 'Tag (repeatable)', multiple: true }),
         'label-id': core_1.Flags.string({
+            aliases: ['label'],
             description: 'Attach a task label (repeatable) — id, or a name from `skrr labels list --applicable-to task`. ' +
                 'An unknown name is refused, never created. Manage labels with `skrr labels`.',
             multiple: true,

package/dist/commands/tasks/list.js

@@ -380,6 +380,7 @@ class TasksList extends base_command_1.BaseCommand {
             multiple: true,
         }),
         'label-id': core_1.Flags.string({
+            aliases: ['label'],
             description: 'Filter to tasks carrying EVERY listed label id (repeatable, AND-intersection)',
             multiple: true,
         }),

package/dist/commands/tasks/update.js

@@ -158,6 +158,7 @@ class TasksUpdate extends base_command_1.BaseCommand {
         }),
         tag: core_1.Flags.string({ description: 'Replace tags (repeatable)', multiple: true }),
         'label-id': core_1.Flags.string({
+            aliases: ['label'],
             description: 'Replace the task labels with these ids (repeatable, whole-list). ' +
                 'Use `skrr tasks labels attach/detach` for incremental changes.',
             multiple: true,

package/dist/lib/agent-config.d.ts

@@ -1,5 +1,7 @@
 export declare const COMMITMENT_RESPONSIBILITY_LEVELS: readonly ["reasoning_only", "full_ownership"];
 export declare const REASONING_TOOL_ESCAPES: readonly ["bash", "browser"];
+/** Warning printed by the three retired Commitment permission flags (OSK-11975). */
+export declare const COMMITMENT_PERMISSION_FLAG_RETIRED = "This setting no longer has any effect: Commitment runs use the agent's own permissions.";
 export declare const RELEASE_INSTALL_CHANNELS: readonly ["latest", "manual"];
 /**
  * `09:00-18:00` or `09:00-18:00@America/Los_Angeles`, or a JSON object.

package/dist/lib/agent-config.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RELEASE_INSTALL_CHANNELS = exports.REASONING_TOOL_ESCAPES = exports.COMMITMENT_RESPONSIBILITY_LEVELS = void 0;
+exports.RELEASE_INSTALL_CHANNELS = exports.COMMITMENT_PERMISSION_FLAG_RETIRED = exports.REASONING_TOOL_ESCAPES = exports.COMMITMENT_RESPONSIBILITY_LEVELS = void 0;
 exports.parseWorkingHoursFlag = parseWorkingHoursFlag;
 exports.mergeAgentConfigFlags = mergeAgentConfigFlags;
 const prompt_1 = require("./prompt");
 const agent_visual_refs_1 = require("./agent-visual-refs");
 exports.COMMITMENT_RESPONSIBILITY_LEVELS = ['reasoning_only', 'full_ownership'];
 exports.REASONING_TOOL_ESCAPES = ['bash', 'browser'];
+/** Warning printed by the three retired Commitment permission flags (OSK-11975). */
+exports.COMMITMENT_PERMISSION_FLAG_RETIRED = "This setting no longer has any effect: Commitment runs use the agent's own permissions.";
 exports.RELEASE_INSTALL_CHANNELS = ['latest', 'manual'];
 /**
  * `09:00-18:00` or `09:00-18:00@America/Los_Angeles`, or a JSON object.