@skrr-ai/cli 0.1.49 → 0.1.51

package/dist/commands/machines/dedicated/terminal/kill.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated terminal kill` — end a persistent session.
+ *
+ * Detaching (Ctrl-], a dropped connection, `terminal` exiting) never ends a
+ * session — the machine keeps the tmux session and everything in it alive
+ * by design. This is the explicit verb that destroys one: the shell and its
+ * whole process tree stop with it.
+ */
+class DedicatedMachinesTerminalKill extends dedicated_service_command_1.DedicatedServiceCommand {
+    static description = 'End a persistent terminal session on a Dedicated Runtime — its shell and everything running in it stop.';
+    static examples = [
+        '<%= config.bin %> machines dedicated terminal kill <lease-id> term-2',
+        '<%= config.bin %> machines dedicated terminal ls <lease-id>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({
+            description: 'Session name, as `terminal ls` prints it (e.g. main, term-2)',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesTerminalKill);
+        if (!dedicated_service_1.DEDICATED_TERMINAL_NAME_PATTERN.test(args.name)) {
+            this.error('A session name is lowercase letters, digits and dashes, up to 32 characters (e.g. `dev`, `build-2`).', { exit: 2 });
+        }
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callDedicatedTerminal('kill', {
+            leaseId,
+            name: args.name,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: args.name, killed: true }, null, 2));
+            return;
+        }
+        this.log(`Terminal session '${args.name}' ended — its shell and everything running in it stopped.`);
+    }
+}
+exports.default = DedicatedMachinesTerminalKill;

package/dist/commands/machines/dedicated/terminal/ls.d.ts

@@ -0,0 +1,22 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated terminal ls` — the sessions the machine is
+ * keeping alive.
+ *
+ * A persistent terminal is a tmux session on the guest (`skrr-term-<name>`)
+ * that survives Ctrl-] detaches, disconnects and daemon restarts; this is
+ * the read side of the web lease card's resume picker. Sessions only ever
+ * end through `terminal kill` or the shell's own `exit` — nothing here is
+ * created implicitly.
+ */
+export default class DedicatedMachinesTerminalLs extends DedicatedServiceCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/terminal/ls.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const format_1 = require("../../../../lib/format");
+/**
+ * `skrr machines dedicated terminal ls` — the sessions the machine is
+ * keeping alive.
+ *
+ * A persistent terminal is a tmux session on the guest (`skrr-term-<name>`)
+ * that survives Ctrl-] detaches, disconnects and daemon restarts; this is
+ * the read side of the web lease card's resume picker. Sessions only ever
+ * end through `terminal kill` or the shell's own `exit` — nothing here is
+ * created implicitly.
+ */
+class DedicatedMachinesTerminalLs extends dedicated_service_command_1.DedicatedServiceCommand {
+    static description = 'List the persistent terminal sessions a Dedicated Runtime is keeping alive (the tmux sessions `terminal` attaches to).';
+    static examples = [
+        '<%= config.bin %> machines dedicated terminal ls <lease-id>',
+        '<%= config.bin %> machines dedicated terminal ls <lease-id> --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesTerminalLs);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callDedicatedTerminal('list', {
+            leaseId,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { sessions: [] }, null, 2));
+            return;
+        }
+        const sessions = result?.sessions ?? [];
+        if (sessions.length === 0) {
+            this.log(`No terminal sessions on ${leaseId}.`);
+            this.log(`Open one with \`${this.config.bin} machines dedicated terminal ${leaseId}\`.`);
+            return;
+        }
+        (0, format_1.renderTable)(sessions.map((session) => ({
+            name: (0, format_1.formatCell)(session.name),
+            attached: session.attached ? 'yes' : 'no',
+            created: (0, format_1.formatCell)(
+            // The daemon reports tmux `session_created`, which is SECONDS —
+            // `localStamp` reads a number as milliseconds.
+            typeof session.createdAt === 'number'
+                ? (0, format_1.localStamp)(session.createdAt * 1000)
+                : session.createdAt !== undefined
+                    ? (0, format_1.localStamp)(session.createdAt)
+                    : undefined),
+        })), [
+            { key: 'name', header: 'NAME', verbatim: true },
+            { key: 'attached', header: 'ATTACHED' },
+            { key: 'created', header: 'CREATED' },
+        ], (line) => this.log(line));
+        this.log(`Attach with \`${this.config.bin} machines dedicated terminal ${leaseId} --name <name>\`; end one with \`terminal kill\`.`);
+    }
+}
+exports.default = DedicatedMachinesTerminalLs;

package/dist/commands/machines/dedicated/terminal/rename.d.ts

@@ -0,0 +1,23 @@
+import { DedicatedServiceCommand } from '../../../../lib/dedicated-service-command';
+/**
+ * `skrr machines dedicated terminal rename` — give a live session a better
+ * name.
+ *
+ * The machine auto-names sessions it allocates (`term-1`, `term-2`, …);
+ * renaming one to `dev` or `build` makes the `terminal --name` you attach
+ * with self-explanatory. The session keeps running — a rename never
+ * detaches or restarts it.
+ */
+export default class DedicatedMachinesTerminalRename extends DedicatedServiceCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        newName: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/terminal/rename.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_service_command_1 = require("../../../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../../../lib/dedicated-service");
+/**
+ * `skrr machines dedicated terminal rename` — give a live session a better
+ * name.
+ *
+ * The machine auto-names sessions it allocates (`term-1`, `term-2`, …);
+ * renaming one to `dev` or `build` makes the `terminal --name` you attach
+ * with self-explanatory. The session keeps running — a rename never
+ * detaches or restarts it.
+ */
+class DedicatedMachinesTerminalRename extends dedicated_service_command_1.DedicatedServiceCommand {
+    static description = 'Rename a persistent terminal session on a Dedicated Runtime (the session keeps running).';
+    static examples = [
+        '<%= config.bin %> machines dedicated terminal rename <lease-id> term-2 dev',
+        '<%= config.bin %> machines dedicated terminal ls <lease-id>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_service_command_1.SERVICE_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        name: core_1.Args.string({
+            description: 'Current session name, as `terminal ls` prints it',
+            required: true,
+            ignoreStdin: true,
+        }),
+        newName: core_1.Args.string({
+            description: 'The name to give it — lowercase letters, digits and dashes',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesTerminalRename);
+        for (const name of [args.name, args.newName]) {
+            if (!dedicated_service_1.DEDICATED_TERMINAL_NAME_PATTERN.test(name)) {
+                this.error('A session name is lowercase letters, digits and dashes, up to 32 characters (e.g. `dev`, `build-2`).', { exit: 2 });
+            }
+        }
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const result = await this.callDedicatedTerminal('rename', {
+            leaseId,
+            name: args.name,
+            newName: args.newName,
+            ...this.scopeFrom(flags),
+        });
+        this.closeServiceChannel();
+        if (flags.json) {
+            this.log(JSON.stringify(result ?? { name: args.name, newName: args.newName }, null, 2));
+            return;
+        }
+        this.log(`Terminal session '${args.name}' is now '${args.newName}'.`);
+    }
+}
+exports.default = DedicatedMachinesTerminalRename;

package/dist/commands/machines/dedicated/terminal.d.ts

@@ -7,6 +7,12 @@ import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
  * `gh auth login`, a REPL, a dev server's interactive setup and `claude` itself
  * reachable only from a browser. This opens the same real PTY the web does,
  * through the same relay and the same admission.
+ *
+ * Sessions are persistent by default (always-on §6.4): the machine runs the
+ * shell inside tmux, so Ctrl-] detaches and the same command re-attaches the
+ * same session — a lost connection re-attaches too, when the machine's image
+ * announces `persistent_terminal_v1`. `terminal ls|kill|rename` are the
+ * session's management verbs; `--ephemeral` is the old disposable shell.
  */
 export default class DedicatedMachinesTerminal extends DedicatedLeaseCommand {
     static description: string;
@@ -17,6 +23,9 @@ export default class DedicatedMachinesTerminal extends DedicatedLeaseCommand {
     static flags: {
         cwd: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         command: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        new: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        ephemeral: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/machines/dedicated/terminal.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const dedicated_service_1 = require("../../../lib/dedicated-service");
 /**
  * `skrr machines dedicated terminal` — the web lease card's "Open terminal",
  * from a terminal.
@@ -10,13 +11,23 @@ const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command"
  * `gh auth login`, a REPL, a dev server's interactive setup and `claude` itself
  * reachable only from a browser. This opens the same real PTY the web does,
  * through the same relay and the same admission.
+ *
+ * Sessions are persistent by default (always-on §6.4): the machine runs the
+ * shell inside tmux, so Ctrl-] detaches and the same command re-attaches the
+ * same session — a lost connection re-attaches too, when the machine's image
+ * announces `persistent_terminal_v1`. `terminal ls|kill|rename` are the
+ * session's management verbs; `--ephemeral` is the old disposable shell.
  */
 class DedicatedMachinesTerminal extends dedicated_lease_command_1.DedicatedLeaseCommand {
-    static description = 'Open an interactive shell on a Dedicated Runtime (a real PTY, as skrr-workload). Ctrl-] closes it.';
+    static description = 'Open an interactive shell on a Dedicated Runtime (a real PTY, as skrr-workload). The session persists on the machine: Ctrl-] detaches, and the same command re-attaches it.';
     static examples = [
         '<%= config.bin %> machines dedicated terminal <lease-id>',
+        '<%= config.bin %> machines dedicated terminal <lease-id> --name dev',
+        '<%= config.bin %> machines dedicated terminal <lease-id> --new',
+        '<%= config.bin %> machines dedicated terminal <lease-id> --ephemeral',
         '<%= config.bin %> machines dedicated terminal <lease-id> --cwd /workspace/repos/app',
         '<%= config.bin %> machines dedicated terminal <lease-id> --command "npm run dev"',
+        '<%= config.bin %> machines dedicated terminal ls <lease-id>',
     ];
     static args = {
         lease: core_1.Args.string({
@@ -27,15 +38,29 @@ class DedicatedMachinesTerminal extends dedicated_lease_command_1.DedicatedLease
     };
     static flags = {
         cwd: core_1.Flags.string({
-            description: 'Directory to start in (defaults to HOME, /workspace/user-data)',
+            description: 'Directory to start in (defaults to HOME, /workspace/user-data). Only applied when the session is created — re-attaching one ignores it.',
         }),
         command: core_1.Flags.string({
             description: 'A command to type into the shell once it shows its prompt, as if you typed it. Not typed if you type first. The shell stays open after it.',
         }),
+        name: core_1.Flags.string({
+            description: "Attach or create the persistent session with this name (default 'main'). Lowercase letters, digits and dashes, up to 32 characters.",
+        }),
+        new: core_1.Flags.boolean({
+            description: 'Open a new persistent session instead of attaching one — the machine names it (term-1, term-2, …) and prints the name so it can be re-attached.',
+            exclusive: ['name'],
+        }),
+        ephemeral: core_1.Flags.boolean({
+            description: 'Open a disposable shell that ends with the connection — the pre-persistent semantics; nothing is kept on the machine.',
+            exclusive: ['name', 'new'],
+        }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(DedicatedMachinesTerminal);
+        if (flags.name !== undefined && !dedicated_service_1.DEDICATED_TERMINAL_NAME_PATTERN.test(flags.name)) {
+            this.error('A session name is lowercase letters, digits and dashes, up to 32 characters (e.g. `dev`, `build-2`).', { exit: 2 });
+        }
         await this.openDedicatedTerminal(args.lease, flags, flags.command);
     }
 }

package/dist/commands/machines/hosted/connect.js

@@ -45,7 +45,7 @@ class HostedMachinesConnect extends base_command_1.BaseCommand {
                 this.log(`Preview: ${response.session.previewUrl}`);
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);
@@ -79,7 +79,7 @@ class HostedMachinesConnect extends base_command_1.BaseCommand {
                         this.log(`[exit ${exitCode}]`);
                 }
                 catch (err) {
-                    const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+                    const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
                     this.log(message || err.message);
                 }
             }

package/dist/commands/machines/hosted/destroy.js

@@ -28,7 +28,7 @@ class HostedMachinesDestroy extends base_command_1.BaseCommand {
             response = await (0, hosted_machines_1.destroyHostedMachine)(args.id, { workspaceId: flags.workspace });
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/exec.js

@@ -95,7 +95,7 @@ class HostedMachinesExec extends base_command_1.BaseCommand {
             response = await (0, hosted_machines_1.execHostedMachine)(id, body, { workspaceId: flags.workspace });
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/list.js

@@ -28,7 +28,7 @@ class HostedMachinesList extends base_command_1.BaseCommand {
             response = await (0, hosted_machines_1.listHostedMachines)({ workspaceId: flags.workspace, limit: flags.limit });
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/pause.js

@@ -28,7 +28,7 @@ class HostedMachinesPause extends base_command_1.BaseCommand {
             response = await (0, hosted_machines_1.pauseHostedMachine)(args.id, { workspaceId: flags.workspace });
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/pull.js

@@ -85,7 +85,7 @@ class HostedMachinesPull extends base_command_1.BaseCommand {
             }, { workspaceId: flags.workspace });
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message) {
                 this.failWithCliError({
                     message,

package/dist/commands/machines/hosted/resume.js

@@ -48,7 +48,7 @@ class HostedMachinesResume extends base_command_1.BaseCommand {
             }
         }
         catch (err) {
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/start.js

@@ -128,7 +128,7 @@ class HostedMachinesStart extends base_command_1.BaseCommand {
             // than offering none.
             const strandedId = (0, hosted_machines_1.hostedMachineId)(session);
             if (strandedId) {
-                const cause = (0, hosted_machines_1.formatHostedMachineApiError)(err) ||
+                const cause = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin }) ||
                     err?.message ||
                     'Hosted Machine setup failed.';
                 this.failWithCliError({
@@ -143,7 +143,7 @@ class HostedMachinesStart extends base_command_1.BaseCommand {
                     retryable: false,
                 });
             }
-            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+            const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
             if (message)
                 this.error(message, { exit: 1 });
             this.handleApiError(err);

package/dist/commands/machines/hosted/status.js

@@ -42,7 +42,7 @@ class HostedMachinesStatus extends base_command_1.BaseCommand {
                 response = await (0, hosted_machines_1.getHostedMachine)(args.id, { workspaceId: flags.workspace });
             }
             catch (err) {
-                const message = (0, hosted_machines_1.formatHostedMachineApiError)(err);
+                const message = (0, hosted_machines_1.formatHostedMachineApiError)(err, { bin: this.config.bin });
                 if (message)
                     this.error(message, { exit: 1 });
                 this.handleApiError(err);
@@ -78,6 +78,7 @@ class HostedMachinesStatus extends base_command_1.BaseCommand {
         this.log(`Machine lease: ${session.machineLeaseId || '-'}`);
         this.log(`Repos: ${(0, hosted_machines_1.hostedMachineRepoSummary)(session)}`);
         this.log(`Preview: ${session.previewUrl || '-'}`);
+        this.log(`Isolation: ${(0, hosted_machines_1.hostedMachineIsolationSummary)(session)}`);
         if (session.idleTimeoutMs)
             this.log(`Idle timeout: ${session.idleTimeoutMs}ms`);
         const error = (0, hosted_machines_1.hostedMachineErrorSummary)(session);

package/dist/commands/outbox/list.d.ts

@@ -1,6 +1,17 @@
 import { BaseCommand } from '../../base-command';
+import { type OutboxEntry } from '../../lib/outbox';
+/**
+ * Why one entry was queued, in words (OSK-12121). The queue holds more than
+ * outage casualties — a 401 is queued too, so authored content survives a lapsed
+ * sign-in — and a list that described every entry as "the API was unavailable"
+ * sent a signed-out reader to wait for an outage that was not happening.
+ */
+export declare function queuedBecause(entry: Pick<OutboxEntry, 'reason'>): {
+    label: string;
+    kind: 'auth' | 'throttled' | 'unavailable' | 'other';
+};
 export declare function outboxListSnapshot(profile?: string): {
-    queued: import("../../lib/outbox").OutboxEntry[];
+    queued: OutboxEntry[];
     incident: import("../../lib/outbox").IncidentState | null;
     incidentActive: boolean;
 };

package/dist/commands/outbox/list.js

@@ -1,11 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.queuedBecause = queuedBecause;
 exports.outboxListSnapshot = outboxListSnapshot;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const keychain_1 = require("../../lib/keychain");
 const format_1 = require("../../lib/format");
 const outbox_1 = require("../../lib/outbox");
+/**
+ * Why one entry was queued, in words (OSK-12121). The queue holds more than
+ * outage casualties — a 401 is queued too, so authored content survives a lapsed
+ * sign-in — and a list that described every entry as "the API was unavailable"
+ * sent a signed-out reader to wait for an outage that was not happening.
+ */
+function queuedBecause(entry) {
+    const status = entry.reason?.status;
+    if (status === 401)
+        return { label: 'sign-in refused (401)', kind: 'auth' };
+    if (status === 429)
+        return { label: 'throttled (429)', kind: 'throttled' };
+    if ((typeof status === 'number' && status >= 500) || (0, outbox_1.isOutageFailure)(entry.reason)) {
+        return { label: status ? `unavailable (${status})` : 'unreachable', kind: 'unavailable' };
+    }
+    return { label: status ? `HTTP ${status}` : 'unknown', kind: 'other' };
+}
 function outboxListSnapshot(profile) {
     const queued = (0, outbox_1.listWrites)(profile);
     const incident = (0, outbox_1.readIncident)(profile);
@@ -24,7 +42,7 @@ function outboxListSnapshot(profile) {
  * where they find out.
  */
 class OutboxList extends base_command_1.BaseCommand {
-    static description = 'Show writes queued locally because the API was unavailable';
+    static description = 'Show writes queued locally because the server could not take them: an outage, throttling, or a lapsed sign-in';
     static examples = [
         '<%= config.bin %> outbox list',
         '<%= config.bin %> outbox list --json',
@@ -46,7 +64,9 @@ class OutboxList extends base_command_1.BaseCommand {
                 `${incident.consecutive} consecutive failure(s).`);
             this.log('');
         }
-        else if (incident) {
+        else if (incident && entries.some((e) => queuedBecause(e).kind === 'unavailable')) {
+            // A past incident is context only for entries an outage put here. Beside
+            // a queue of sign-in refusals it reads as the explanation, and is not.
             this.log(`Last service incident: ${incident.baseURL} failed at ${incident.lastOutageAt}` +
                 `${incident.status ? ` (HTTP ${incident.status})` : ''}. ` +
                 'No current outage is confirmed.');
@@ -61,6 +81,7 @@ class OutboxList extends base_command_1.BaseCommand {
             queued: e.queuedAt,
             command: e.command,
             summary: e.summary,
+            why: queuedBecause(e).label,
             // Surface the attempt count only once it matters; a column of "0"s is
             // noise, but an entry nearing the cap needs a human.
             attempts: e.attempts > 0 ? `${e.attempts}/${outbox_1.MAX_REPLAY_ATTEMPTS}` : '-',
@@ -69,6 +90,7 @@ class OutboxList extends base_command_1.BaseCommand {
             { key: 'queued', header: 'QUEUED', maxWidth: 24 },
             { key: 'command', header: 'COMMAND', maxWidth: 24 },
             { key: 'summary', header: 'SUMMARY', maxWidth: 40 },
+            { key: 'why', header: 'WHY', maxWidth: 24 },
             { key: 'attempts', header: 'TRIES' },
         ], (line) => this.log(line));
         const exhausted = entries.filter((e) => e.attempts >= outbox_1.MAX_REPLAY_ATTEMPTS);
@@ -77,6 +99,13 @@ class OutboxList extends base_command_1.BaseCommand {
             this.log(`${exhausted.length} entry(ies) hit the ${outbox_1.MAX_REPLAY_ATTEMPTS}-attempt cap and will not be ` +
                 'retried automatically. Inspect the failure, then retry or drop them explicitly.');
         }
+        const authQueued = entries.filter((e) => queuedBecause(e).kind === 'auth').length;
+        if (authQueued > 0) {
+            this.log('');
+            this.log(`${authQueued} entry(ies) were queued because the server refused this sign-in, not because ` +
+                `it was down. Sign in with \`${this.config.bin} login\` first; a replay before that is ` +
+                'refused the same way.');
+        }
         this.log('');
         this.log(`Replay:  ${this.config.bin} outbox retry`);
         this.log(`Discard: ${this.config.bin} outbox drop <id>`);

package/dist/commands/revoke-daemon.js

@@ -67,6 +67,8 @@ class RevokeDaemon extends base_command_1.BaseCommand {
             const host = resolvedDaemon?.machineUuid
                 ? resolvedDaemon.machineUuid.slice(0, 12)
                 : (resolvedDaemon?.os ?? 'unknown host');
+            this.log('Revoking a daemon also revokes every CLI sign-in it brokered — on its machine, ' +
+                `\`${this.config.bin} login\` without a browser signs in through the daemon.`);
             const confirmed = await this.confirm(`Revoke daemon "${name}" on ${host}? [y/N] `);
             if (!confirmed) {
                 this.log('Aborted.');
@@ -99,6 +101,13 @@ class RevokeDaemon extends base_command_1.BaseCommand {
         const daemonId = (res.daemon?.id ?? resolvedId).slice(0, 12);
         if (res.revoked) {
             this.log(`Revoked daemon ${daemonName} (${daemonId}).`);
+            if (res.callerSessionRevoked === true) {
+                // Said now, not discovered later as a refresh failure: the sign-in this
+                // command used was brokered by that daemon and died with it.
+                this.warn(`This also signed out ${this.config.bin} on this machine: its sign-in was brokered ` +
+                    `by that daemon and was revoked with it. Run \`${this.config.bin} daemon login\` to ` +
+                    `re-enroll the daemon, then \`${this.config.bin} login\` to sign the CLI in again.`);
+            }
             // exit 0 (default)
         }
         else if (res.alreadyRevoked) {

package/dist/commands/spaces/create.d.ts

@@ -19,6 +19,7 @@ export default class SpacesCreate extends BaseCommand {
         'group-chat': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         parent: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'inherit-access': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'working-directory': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/spaces/create.js

@@ -9,6 +9,7 @@ const label_ref_1 = require("../../lib/label-ref");
 const web_url_1 = require("../../lib/web-url");
 const prompt_1 = require("../../lib/prompt");
 const created_line_1 = require("../../lib/created-line");
+const tasks_1 = require("../../lib/tasks");
 class SpacesCreate extends base_command_1.BaseCommand {
     static description = 'Create a new space';
     static examples = [
@@ -51,6 +52,11 @@ class SpacesCreate extends base_command_1.BaseCommand {
             allowNo: true,
             description: 'Inherit members/permissions from the parent chain (default). Use --no-inherit-access to make a private subspace.',
         }),
+        'working-directory': core_1.Flags.string({
+            description: "Space-level working directory for this space's local Harness runs — an absolute " +
+                "path on the executing daemon's filesystem. The middle layer of task → space → " +
+                'agent: a per-task override wins, the agent default applies when neither is set.',
+        }),
     };
     async run() {
         this.requireAuth();
@@ -95,7 +101,18 @@ class SpacesCreate extends base_command_1.BaseCommand {
             groupChatId: flags['group-chat'],
             parentSpaceId: flags.parent,
             inheritAccess: flags['inherit-access'],
+            workingDirectory: (0, tasks_1.workingDirectoryFromFlag)(flags['working-directory']),
         });
+        // Post-merge, so --working-directory and --from-json are checked
+        // identically: a relative path is refused here rather than stored and
+        // silently fallen back from at run time on the daemon.
+        const workingDirectoryError = (0, tasks_1.workingDirectoryValidationError)(payload.workingDirectory);
+        if (workingDirectoryError) {
+            this.error(workingDirectoryError, { exit: 2 });
+        }
+        // 'none' on create means "no space default" — the field is absent anyway.
+        if (payload.workingDirectory === null)
+            delete payload.workingDirectory;
         if (!payload.title || typeof payload.title !== 'string') {
             this.error('A title is required. Pass --title "..." or include it in --from-json.', {
                 exit: 1,

package/dist/commands/spaces/show.js

@@ -57,6 +57,11 @@ class SpacesShow extends base_command_1.BaseCommand {
         this.log(`Leader:      ${s.leadAgentId ?? '-'}`);
         this.log(`Target Date: ${s.targetDate ?? '-'}`);
         this.log(`Goals:       ${Array.isArray(s.goalIds) ? s.goalIds.length : 0}`);
+        // Only when set — the space default is the middle layer of the
+        // task → space → agent cascade, and most spaces leave it unset.
+        if (typeof s.workingDirectory === 'string' && s.workingDirectory) {
+            this.log(`Directory:   ${s.workingDirectory}`);
+        }
         this.log(`Archived:    ${s.archivedAt ? 'yes' : 'no'}`);
         this.log(`Parent:      ${s.parentSpaceId ?? '(root)'}`);
         this.log(`Depth:       ${s.depth ?? 0}`);

package/dist/commands/spaces/update.d.ts

@@ -30,6 +30,7 @@ export default class SpacesUpdate extends BaseCommand {
         'auto-start-on-backlog-exit': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'triage-external-intake': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'default-task-template': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'working-directory': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }