@skrr-ai/cli 0.1.49 → 0.1.51

package/dist/commands/daemon/status.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.readinessPointer = readinessPointer;
 const core_1 = require("@oclif/core");
 const exec_runtime_binary_1 = require("../../lib/exec-runtime-binary");
+const live_runtime_binary_1 = require("../../lib/live-runtime-binary");
 /**
  * The status report is the runtime's, and it describes the daemon: running,
  * connected, which credential. Whether the coding-agent CLIs on the machine can
@@ -41,7 +42,20 @@ class DaemonStatus extends core_1.Command {
         // mistake, one directory over.
         const argv = this.argv;
         try {
-            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['status', ...argv]);
+            // Status describes the LIVE daemon, so render it with the live daemon's
+            // own binary when that is a different build from the first `skrrd` on
+            // PATH, and say which one rendered it either way (OSK-12102). The note
+            // goes to stderr so `--json` stays one document on stdout.
+            const pathBinary = (0, exec_runtime_binary_1.findRuntimeBinary)();
+            const decision = pathBinary
+                ? (0, live_runtime_binary_1.decideStatusBinary)(pathBinary, (0, live_runtime_binary_1.profileFromArgs)(argv), (0, live_runtime_binary_1.defaultLiveRuntimeDeps)())
+                : null;
+            const note = decision ? (0, live_runtime_binary_1.describeStatusBinary)(decision) : null;
+            if (note)
+                process.stderr.write(`${note}\n`);
+            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['status', ...argv], {
+                binary: decision?.binary,
+            });
             const pointer = readinessPointer(argv, code);
             if (pointer)
                 this.log(pointer);

package/dist/commands/goals/create.d.ts

@@ -10,6 +10,7 @@ export default class GoalsCreate extends BaseCommand {
         level: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'target-date': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        label: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         project: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         parent: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'owner-agent': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/goals/create.js

@@ -5,6 +5,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const web_url_1 = require("../../lib/web-url");
 const prompt_1 = require("../../lib/prompt");
+const label_ref_1 = require("../../lib/label-ref");
 const projects_1 = require("../../lib/projects");
 const created_line_1 = require("../../lib/created-line");
 class GoalsCreate extends base_command_1.BaseCommand {
@@ -30,6 +31,10 @@ class GoalsCreate extends base_command_1.BaseCommand {
         }),
         'target-date': core_1.Flags.string({ description: 'Target date (YYYY-MM-DD or ISO timestamp)' }),
         space: core_1.Flags.string({ description: 'Space ID to link this goal into after creation' }),
+        label: core_1.Flags.string({
+            description: 'Attach a label (repeatable) — id, or a name from `skrr labels list --applicable-to goal`. An unknown name is refused, never created.',
+            multiple: true,
+        }),
         project: core_1.Flags.string({
             description: 'Project to contain this goal — id, or a ref (OSK-P-12) alongside --space, or a qualified ref (OSK-S-3/OSK-P-12)',
         }),
@@ -102,6 +107,23 @@ class GoalsCreate extends base_command_1.BaseCommand {
                 exit: 1,
             });
         }
+        let resolvedLabelIds;
+        try {
+            const ids = await (0, label_ref_1.resolveLabelRefs)(flags.label, {
+                applicableTo: 'goal',
+                ...(process.env.OVERSKY_WORKSPACE_ID
+                    ? { workspaceId: process.env.OVERSKY_WORKSPACE_ID }
+                    : {}),
+            });
+            resolvedLabelIds = ids.length > 0 ? ids : undefined;
+        }
+        catch (err) {
+            if (err instanceof label_ref_1.LabelRefError)
+                this.error(err.message, { exit: 1 });
+            this.handleApiError(err);
+        }
+        if (resolvedLabelIds)
+            payload.labelIds = resolvedLabelIds;
         let created;
         try {
             created = await data_provider_1.dataService.createGoal(payload);

package/dist/commands/harnesses/models.d.ts

@@ -1,4 +1,58 @@
 import { BaseCommand } from '../../base-command';
+/**
+ * Why the server fell back to its curated list — `sourceReason` on
+ * `GET /api/harnesses/:id/models`, present only when `source` is `curated`.
+ * The server owns the vocabulary (`MODEL_SOURCE_REASONS` in
+ * `api/server/services/Harness/engineModelCatalog.js`); a value this build
+ * does not recognise still prints, verbatim, rather than vanishing.
+ */
+export type HarnessModelSourceReason = 'no_live_catalog_for_harness' | 'daemon_offline' | 'live_catalog_unsupported' | 'live_probe_failed';
+export interface HarnessModelsReport {
+    provider?: string | null;
+    source?: string;
+    sourceReason?: HarnessModelSourceReason | string;
+    sourceDetail?: string;
+    /** The harness row's own stored default model; empty when unset. */
+    defaultModel?: string | null;
+    /** The harness row's own stored default effort; empty when unset. */
+    defaultReasoningEffort?: string | null;
+    models?: Array<{
+        value?: string;
+        label?: string;
+        description?: string;
+        efforts?: string[];
+        /** The effort this model starts at when none is chosen. */
+        defaultEffort?: string | null;
+        /** The harness's OWN recommendation (Codex `model/list`), not skrr's. */
+        isDefault?: boolean;
+    }>;
+}
+/**
+ * What `default` means on this harness, in lines under the table (OSK-12114).
+ *
+ * Three candidates can answer "which model runs on `default`": the harness
+ * row's stored default, the harness's own configuration on that machine (for
+ * Codex, `model` in its config.toml), and the vendor's recommendation that the
+ * live list marks. They win in that order, and the list alone cannot see the
+ * middle one — so say the order rather than imply the marked model runs.
+ */
+export declare function describeModelDefaults(report: HarnessModelsReport | undefined): string[];
+/**
+ * Stated under every curated answer: the list is ours, not the harness's
+ * admission rule. Without it `curated` reads as "these are the only choices"
+ * — the web card has always said this; the CLI never did.
+ */
+export declare const CURATED_ACCEPTS_ANY_ID = "Any model id the harness itself accepts works too, even if it is not listed \u2014 set it with `skrr agents update <agent> --model <id>`.";
+/**
+ * Why a curated answer is curated, as a clause. `codex · curated` used to
+ * print identically for an offline daemon, a daemon too old to probe, and a
+ * probe that timed out — three different next actions (OSK-12062).
+ */
+export declare function curatedReasonClause(report: HarnessModelsReport | undefined): string;
+/** One line saying where the list came from. */
+export declare function describeModelSource(report: HarnessModelsReport | undefined): string;
+/** What to print when the answer carries no models at all. */
+export declare function describeEmptyModels(report: HarnessModelsReport | undefined): string;
 /**
  * Which models this harness can actually run.
  *

package/dist/commands/harnesses/models.js

@@ -1,9 +1,95 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CURATED_ACCEPTS_ANY_ID = void 0;
+exports.describeModelDefaults = describeModelDefaults;
+exports.curatedReasonClause = curatedReasonClause;
+exports.describeModelSource = describeModelSource;
+exports.describeEmptyModels = describeEmptyModels;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
 const harnesses_1 = require("../../lib/harnesses");
+/**
+ * What `default` means on this harness, in lines under the table (OSK-12114).
+ *
+ * Three candidates can answer "which model runs on `default`": the harness
+ * row's stored default, the harness's own configuration on that machine (for
+ * Codex, `model` in its config.toml), and the vendor's recommendation that the
+ * live list marks. They win in that order, and the list alone cannot see the
+ * middle one — so say the order rather than imply the marked model runs.
+ */
+function describeModelDefaults(report) {
+    const provider = report?.provider || 'the harness';
+    const lines = [];
+    const marked = (report?.models ?? []).find((m) => m.isDefault)?.value;
+    if (report?.defaultModel) {
+        lines.push(`Harness default: ${report.defaultModel} — what an agent on \`default\` runs on this harness.`);
+    }
+    else {
+        lines.push(`No harness default is set, so an agent on \`default\` runs the model the daemon's config ` +
+            `or ${provider}'s own config on that machine names` +
+            `${marked ? `, else ${marked} (* — ${provider}'s own recommendation)` : ''}.`);
+    }
+    if (report?.defaultReasoningEffort) {
+        lines.push(`Harness default effort: ${report.defaultReasoningEffort}.`);
+    }
+    lines.push('The model a turn actually ran is reported when it ends (`agents chat` prints `[run] model:`).');
+    return lines;
+}
+/**
+ * Stated under every curated answer: the list is ours, not the harness's
+ * admission rule. Without it `curated` reads as "these are the only choices"
+ * — the web card has always said this; the CLI never did.
+ */
+exports.CURATED_ACCEPTS_ANY_ID = 'Any model id the harness itself accepts works too, even if it is not listed — set it with `skrr agents update <agent> --model <id>`.';
+/**
+ * Why a curated answer is curated, as a clause. `codex · curated` used to
+ * print identically for an offline daemon, a daemon too old to probe, and a
+ * probe that timed out — three different next actions (OSK-12062).
+ */
+function curatedReasonClause(report) {
+    const provider = report?.provider || 'this harness';
+    const detail = report?.sourceDetail ? ` (${report.sourceDetail})` : '';
+    switch (report?.sourceReason) {
+        case 'no_live_catalog_for_harness':
+            return `${provider} has no way to list its own models, so this list is the catalog`;
+        case 'daemon_offline':
+            return `the machine running ${provider} is offline, so its live model list could not be read`;
+        case 'live_catalog_unsupported':
+            return `the daemon on that machine does not offer a live model list — update it to get one`;
+        case 'live_probe_failed':
+            return `asking ${provider} for its live model list failed${detail}`;
+        case undefined:
+        case '':
+            return 'the server did not say why the live list was not used';
+        default:
+            return `live list not used: ${report?.sourceReason}${detail}`;
+    }
+}
+/** One line saying where the list came from. */
+function describeModelSource(report) {
+    switch (report?.source) {
+        case 'managed':
+            return 'managed — the models your plan admits for this harness';
+        case 'live':
+            return `live — reported by the installed ${report.provider || 'harness'} on its machine`;
+        case 'curated':
+            return `curated — skrr's own list; ${curatedReasonClause(report)}`;
+        default:
+            return report?.source ?? 'unknown source';
+    }
+}
+/** What to print when the answer carries no models at all. */
+function describeEmptyModels(report) {
+    const resolved = report?.provider;
+    if (!resolved) {
+        return 'This harness resolved to no provider, so no model list could be built. That is a defect, not a configuration problem — report it with the harness id.';
+    }
+    // An empty answer is always curated: a live or managed answer with no models
+    // degrades to curated server-side. So the reason is what explains it — for
+    // opencode it is usually the live probe, which the old message never named.
+    return `No models are listed for ${resolved}: skrr's curated list has no entries for it, and ${curatedReasonClause(report)}. ${exports.CURATED_ACCEPTS_ANY_ID}`;
+}
 /**
  * Which models this harness can actually run.
  *
@@ -44,29 +130,36 @@ class HarnessesModels extends base_command_1.BaseCommand {
             // where the list comes from picks one — and, in the bug this replaced,
             // would have shown `provider` as null on a Claude harness and named the
             // defect on sight.
-            const resolved = report?.provider;
-            this.log(resolved
-                ? `No models are listed for ${resolved}. skrr keeps a curated list per provider and ${resolved} has no entries in it, so pick a model on the agent instead — \`skrr agents update <agent> --model <id>\` accepts an id this list does not name.`
-                : 'This harness resolved to no provider, so no model list could be built. That is a defect, not a configuration problem — report it with the harness id.');
+            this.log(describeEmptyModels(report));
             return;
         }
         if (report?.provider || report?.source) {
             // The source matters when the list is short: `curated` is our table,
-            // anything else came from the harness itself.
-            this.log(`${report.provider ?? 'unknown provider'} · ${report.source ?? 'unknown source'}`);
+            // anything else came from the harness itself — and a curated answer
+            // says why the harness's own list was not used.
+            this.log(`${report.provider ?? 'unknown provider'} · ${describeModelSource(report)}`);
+            if (report.source === 'curated')
+                this.log(exports.CURATED_ACCEPTS_ANY_ID);
             this.log('');
         }
         (0, format_1.renderTable)(models.map((m) => ({
-            model: (0, format_1.formatCell)(m.value),
+            // `*` is the harness's own recommendation, which the JSON carried as
+            // `isDefault` and this table dropped (OSK-12114).
+            model: `${(0, format_1.formatCell)(m.value)}${m.isDefault ? ' *' : ''}`,
             label: (0, format_1.formatCell)(m.label),
             // An empty efforts array means the model takes no effort setting at
             // all, which is different from one we failed to read.
             efforts: m.efforts && m.efforts.length > 0 ? m.efforts.join(', ') : '-',
+            defaultEffort: m.defaultEffort ? String(m.defaultEffort) : '-',
         })), [
             { key: 'model', header: 'MODEL' },
             { key: 'label', header: 'LABEL', maxWidth: 26 },
             { key: 'efforts', header: 'EFFORTS' },
+            { key: 'defaultEffort', header: 'DEFAULT EFFORT' },
         ], (line) => this.log(line));
+        this.log('');
+        for (const line of describeModelDefaults(report))
+            this.log(line);
     }
 }
 exports.default = HarnessesModels;

package/dist/commands/harnesses/show.d.ts

@@ -10,6 +10,17 @@ export default class HarnessesShow extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * Which permission modes this harness accepts, and its own default (OSK-12130).
+ *
+ * The rule used to surface only as an agent write refusing a mode, so the way
+ * to learn that Gemini runs only as bypassPermissions was three refusals in a
+ * row. Printed only when the server sent it (a local harness row).
+ */
+export declare function harnessPermissionLines(harness: {
+    permissionModes?: unknown;
+    defaultPermissionMode?: unknown;
+}): string[];
 /**
  * Say what the caller DID pass, not only what they did not.
  *

package/dist/commands/harnesses/show.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.harnessPermissionLines = harnessPermissionLines;
 exports.describeWrongHarnessRef = describeWrongHarnessRef;
 exports.resolveHarnessRef = resolveHarnessRef;
 exports.pickHarnessRef = pickHarnessRef;
@@ -113,6 +114,8 @@ class HarnessesShow extends base_command_1.BaseCommand {
         }
         if (harness.daemonId)
             this.log(`  daemon      ${harness.daemonId}`);
+        for (const line of harnessPermissionLines(harness))
+            this.log(line);
         if (verdict) {
             this.log(`  readiness   ${verdict.label} — ${verdict.detail}`);
         }
@@ -124,6 +127,38 @@ class HarnessesShow extends base_command_1.BaseCommand {
     }
 }
 exports.default = HarnessesShow;
+const PERMISSION_MODES_SOURCE_LABELS = {
+    daemon: 'reported by the daemon',
+    daemon_record: 'as the daemon last reported it',
+    static: "from skrr's harness table",
+    vocabulary: 'not declared for this harness; the daemon enforces',
+};
+/**
+ * Which permission modes this harness accepts, and its own default (OSK-12130).
+ *
+ * The rule used to surface only as an agent write refusing a mode, so the way
+ * to learn that Gemini runs only as bypassPermissions was three refusals in a
+ * row. Printed only when the server sent it (a local harness row).
+ */
+function harnessPermissionLines(harness) {
+    const report = harness.permissionModes;
+    const modes = Array.isArray(report?.modes)
+        ? report.modes.filter((m) => typeof m === 'string')
+        : [];
+    if (modes.length === 0)
+        return [];
+    const source = typeof report?.source === 'string'
+        ? (PERMISSION_MODES_SOURCE_LABELS[report.source] ?? report.source)
+        : '';
+    const stored = typeof harness.defaultPermissionMode === 'string' && harness.defaultPermissionMode
+        ? harness.defaultPermissionMode
+        : null;
+    return [
+        `  permission  accepts ${modes.join(', ')}${source ? `  (${source})` : ''}`,
+        `              default ${stored ??
+            "not set — an agent's own mode applies, else the daemon's config (`harnesses update --default-permission-mode`)"}`,
+    ];
+}
 /**
  * Say what the caller DID pass, not only what they did not.
  *

package/dist/commands/harnesses/update.d.ts

@@ -1,7 +1,8 @@
 import { BaseCommand } from '../../base-command';
 import { getHarness } from '../../lib/harnesses';
 /**
- * Rename an harness, or change how Claude Code runs on it.
+ * Rename a harness, change how Claude Code runs on it, or set the model,
+ * reasoning effort and permission mode its sessions default to.
  *
  * `--name` renames it FOR EVERYONE it is shared with. `skrr harnesses alias`
  * changes only what you see; the two are different operations and the server
@@ -21,9 +22,35 @@ export default class HarnessesUpdate extends BaseCommand {
         name: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'claude-engine': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'default-model': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'clear-default-model': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'default-effort': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'clear-default-effort': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'default-permission-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'clear-default-permission-mode': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
+export interface HarnessUpdateFlags {
+    name?: string;
+    description?: string;
+    'claude-engine'?: string;
+    'default-model'?: string;
+    'clear-default-model'?: boolean;
+    'default-effort'?: string;
+    'clear-default-effort'?: boolean;
+    'default-permission-mode'?: string;
+    'clear-default-permission-mode'?: boolean;
+}
+/**
+ * Flags → the `patch` of `PATCH /api/harnesses/:id`. The clear spellings are
+ * the server's own: an empty string clears `defaultModel` and
+ * `defaultReasoningEffort`, `null` clears `defaultPermissionMode`. Clearing is
+ * a separate boolean flag rather than a sentinel value because `none` is a
+ * real reasoning effort (GPT-5.x accepts it), so `--default-effort none` has
+ * to mean "set it to none", not "remove it".
+ */
+export declare function buildHarnessPatch(flags: HarnessUpdateFlags): Record<string, unknown>;
 /**
  * `--name` sets the name everyone sees. When YOUR alias covers it, you will not
  * see the new name anywhere you look, and "Updated <name>." read as though the

package/dist/commands/harnesses/update.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHarnessPatch = buildHarnessPatch;
 exports.sharedRenameMessage = sharedRenameMessage;
 const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const harnesses_1 = require("../../lib/harnesses");
 const harness_labels_1 = require("../../lib/harness-labels");
 /**
- * Rename an harness, or change how Claude Code runs on it.
+ * Rename a harness, change how Claude Code runs on it, or set the model,
+ * reasoning effort and permission mode its sessions default to.
  *
  * `--name` renames it FOR EVERYONE it is shared with. `skrr harnesses alias`
  * changes only what you see; the two are different operations and the server
@@ -16,10 +19,13 @@ const harness_labels_1 = require("../../lib/harness-labels");
  * version first and a concurrent edit answers 409 instead of overwriting.
  */
 class HarnessesUpdate extends base_command_1.BaseCommand {
-    static description = 'Rename a harness or set how Claude Code is driven on it';
+    static description = 'Rename a harness, set how Claude Code is driven on it, or set its default model, effort, and permission mode';
     static examples = [
         '<%= config.bin %> harnesses update <harness-id> --name "Studio iMac"',
         '<%= config.bin %> harnesses update <harness-id> --claude-engine sdk',
+        '<%= config.bin %> harnesses update <harness-id> --default-model opus --default-effort high',
+        '<%= config.bin %> harnesses update <harness-id> --default-permission-mode acceptEdits',
+        '<%= config.bin %> harnesses update <harness-id> --clear-default-model --clear-default-effort',
     ];
     static args = {
         harness: core_1.Args.string({ ignoreStdin: true, description: 'Harness ID', required: true }),
@@ -34,19 +40,45 @@ class HarnessesUpdate extends base_command_1.BaseCommand {
             description: 'How Claude Code runs on this machine: `sdk` in-process (needed for AskUserQuestion), `cli` as a child process. Local CLAUDE harnesses only — the server refuses it on any other provider, because nothing would ever read it.',
             options: ['cli', 'sdk'],
         }),
+        'default-model': core_1.Flags.string({
+            description: "Model this harness's sessions use when the agent or task names none, in the harness's own " +
+                'namespace (`opus`, `gpt-5-codex`, …). `skrr harnesses models <harness-id>` lists what it can run. ' +
+                'Not allowlisted: any safe model identifier is stored as given, so check the spelling.',
+            exclusive: ['clear-default-model'],
+        }),
+        'clear-default-model': core_1.Flags.boolean({
+            description: "Remove the default model, so the harness's own default applies",
+            exclusive: ['default-model'],
+        }),
+        'default-effort': core_1.Flags.string({
+            description: "Reasoning effort this harness's sessions default to. Checked against the model the write leaves " +
+                'in place (the new --default-model when you pass both); `skrr harnesses models <harness-id>` lists ' +
+                'the efforts each model accepts. Harnesses with no effort setting refuse it.',
+            exclusive: ['clear-default-effort'],
+        }),
+        'clear-default-effort': core_1.Flags.boolean({
+            description: "Remove the default reasoning effort, so the harness's own default applies",
+            exclusive: ['default-effort'],
+        }),
+        'default-permission-mode': core_1.Flags.string({
+            description: "Permission mode this harness's sessions fall back to when the agent sets none. Local harnesses " +
+                'only. One-shot harnesses (gemini, opencode, cursor, copilot, goose, pi, openclaw) can only run as ' +
+                'bypassPermissions; any other mode is refused for them.',
+            options: [...data_provider_1.LOCAL_HARNESS_PERMISSION_MODES],
+            exclusive: ['clear-default-permission-mode'],
+        }),
+        'clear-default-permission-mode': core_1.Flags.boolean({
+            description: "Remove this harness's permission-mode override, so the daemon's own configured default applies",
+            exclusive: ['default-permission-mode'],
+        }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(HarnessesUpdate);
-        const patch = {};
-        if (flags.name !== undefined)
-            patch.name = flags.name;
-        if (flags.description !== undefined)
-            patch.description = flags.description;
-        if (flags['claude-engine'] !== undefined)
-            patch.claudeEngine = flags['claude-engine'];
+        const patch = buildHarnessPatch(flags);
         if (Object.keys(patch).length === 0) {
-            this.error('Nothing to change. Pass --name, --description, or --claude-engine.', { exit: 1 });
+            this.error('Nothing to change. Pass --name, --description, --claude-engine, --default-model, ' +
+                '--default-effort, --default-permission-mode, or a --clear-default-* flag.', { exit: 1 });
             return;
         }
         try {
@@ -65,6 +97,37 @@ class HarnessesUpdate extends base_command_1.BaseCommand {
     }
 }
 exports.default = HarnessesUpdate;
+/**
+ * Flags → the `patch` of `PATCH /api/harnesses/:id`. The clear spellings are
+ * the server's own: an empty string clears `defaultModel` and
+ * `defaultReasoningEffort`, `null` clears `defaultPermissionMode`. Clearing is
+ * a separate boolean flag rather than a sentinel value because `none` is a
+ * real reasoning effort (GPT-5.x accepts it), so `--default-effort none` has
+ * to mean "set it to none", not "remove it".
+ */
+function buildHarnessPatch(flags) {
+    const patch = {};
+    if (flags.name !== undefined)
+        patch.name = flags.name;
+    if (flags.description !== undefined)
+        patch.description = flags.description;
+    if (flags['claude-engine'] !== undefined)
+        patch.claudeEngine = flags['claude-engine'];
+    if (flags['default-model'] !== undefined)
+        patch.defaultModel = flags['default-model'];
+    if (flags['clear-default-model'])
+        patch.defaultModel = '';
+    if (flags['default-effort'] !== undefined)
+        patch.defaultReasoningEffort = flags['default-effort'];
+    if (flags['clear-default-effort'])
+        patch.defaultReasoningEffort = '';
+    if (flags['default-permission-mode'] !== undefined) {
+        patch.defaultPermissionMode = flags['default-permission-mode'];
+    }
+    if (flags['clear-default-permission-mode'])
+        patch.defaultPermissionMode = null;
+    return patch;
+}
 /**
  * `--name` sets the name everyone sees. When YOUR alias covers it, you will not
  * see the new name anywhere you look, and "Updated <name>." read as though the

package/dist/commands/logout.js

@@ -39,6 +39,7 @@ const base_command_1 = require("../base-command");
 const config_1 = require("../lib/config");
 const first_party_harness_managed_1 = require("../lib/first-party-harness-managed");
 const auth_storage_1 = require("../lib/auth-storage");
+const daemonBroker_1 = require("../lib/daemonBroker");
 const refresh_1 = require("../lib/refresh");
 const api_fetch_1 = require("../lib/api-fetch");
 const cred_envelope_1 = require("../lib/cred-envelope");
@@ -129,7 +130,17 @@ class Logout extends base_command_1.BaseCommand {
             hasUnreadableEncryptedToken,
             allDevices: flags['all-devices'],
         })) {
-            this.log('Not signed in. Nothing to do.');
+            // On a broker-mode machine (a Dedicated guest descriptor advertising
+            // `access_token`) there IS no local credential to clear — the CLI holds
+            // a per-process token redeemed over loopback and nothing is persisted.
+            // Say that honestly rather than reporting a logout that did not happen.
+            if ((0, daemonBroker_1.findBrokeredHandoffDescriptor)()) {
+                this.log("This machine is signed in through the platform's managed hand-off; " +
+                    'there is no local credential to clear.');
+            }
+            else {
+                this.log('Not signed in. Nothing to do.');
+            }
             return;
         }
         if (flags['all-devices'] && !hasUsableLocalToken) {

package/dist/commands/machines/dedicated/index.js

@@ -40,7 +40,7 @@ class DedicatedMachines extends core_1.Command {
             ['show', 'state, size, spend, health and engines of one lease'],
             ['current', 'the lease of the machine this runs on (or pass `self`)'],
             ['attach', 'pin an agent so its work runs on the machine'],
-            ['terminal', 'open an interactive shell on the machine'],
+            ['terminal', 'open a shell that survives disconnect (ls|kill|rename manage it)'],
             ['sign-in', 'sign in to GitHub CLI, Claude Code or Codex there'],
             ['exec', 'run one command; output and exit code'],
             ['cp', 'copy a file to or from the machine'],

package/dist/commands/machines/dedicated/sign-in.js

@@ -44,7 +44,10 @@ class DedicatedMachinesSignIn extends dedicated_lease_command_1.DedicatedLeaseCo
         // Said before, not after: once the code is entered the credential already
         // sits on the workspace volume, in every later snapshot.
         process.stderr.write(`${preset.label} sign-in is stored on the workspace volume and shared by everything running as skrr-workload on this machine, including agents. Prefer a narrowly-scoped account or token.\n`);
-        await this.openDedicatedTerminal(args.lease, flags, preset.command);
+        // Its own named session — not `main`: a sign-in typed into a shell that
+        // is running a dev server would wait forever for a prompt that is not
+        // coming, and the session survives a detached OAuth flow either way.
+        await this.openDedicatedTerminal(args.lease, { ...flags, name: 'sign-in' }, preset.command);
     }
 }
 exports.default = DedicatedMachinesSignIn;

package/dist/commands/machines/dedicated/terminal/kill.d.ts

@@ -0,0 +1,21 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated terminal kill` — end a persistent session.
+ *
+ * Detaching (Ctrl-], a dropped connection, `terminal` exiting) never ends a
+ * session — the machine keeps the tmux session and everything in it alive
+ * by design. This is the explicit verb that destroys one: the shell and its
+ * whole process tree stop with it.
+ */
+export default class DedicatedMachinesTerminalKill extends DedicatedServiceCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}