@skrr-ai/cli 0.1.68 → 0.1.70

package/dist/commands/agents/chat.js

@@ -374,6 +374,8 @@ class AgentsChat extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(AgentsChat);
+        if (flags.quick && flags.task)
+            this.error('--task requires a runtime session; remove --quick to bind this turn.', { exit: 2 });
         if (flags.json && !flags['no-stream'] && !flags.quick) {
             this.error('--json is only supported with --no-stream or --quick; use --jsonl for streaming.', {
                 exit: 2,
@@ -413,6 +415,7 @@ class AgentsChat extends base_command_1.BaseCommand {
             }
         }
         // OSK-2946 — resolve the explicit binding, or warn that there isn't one.
+        let boundTaskId;
         let taskContextBlock = null;
         if (flags.task) {
             let task;
@@ -423,6 +426,7 @@ class AgentsChat extends base_command_1.BaseCommand {
                 this.handleApiError(err);
             }
             const taskId = String(task.id ?? flags.task);
+            boundTaskId = taskId;
             taskContextBlock = [
                 'You are working on a specific skrr task. This is your canonical scope:',
                 `  task id:         ${taskId}`,
@@ -441,8 +445,8 @@ class AgentsChat extends base_command_1.BaseCommand {
                 `  skrr tasks complete ${taskId} --summary "<what you did>" --deliverables "<refs>"`,
                 '',
                 'This is a chat turn, not a managed task run: the task is NOT checked out and its ' +
-                    'status is not managed for you. Do not go looking for an implicit task context — ' +
-                    'there is none; use the id above.',
+                    'status is not managed for you. The runtime session is bound to this task for ' +
+                    'task context and artifact uploads; use the canonical id above.',
             ].join('\n');
             if (!flags.jsonl) {
                 this.log(`Bound to task ${task.identifier ?? taskId} (chat turn — task not checked out)`);
@@ -515,6 +519,7 @@ class AgentsChat extends base_command_1.BaseCommand {
         try {
             started = await data_provider_1.dataService.startAgenticChat({
                 agentId: args.agentId,
+                taskId: boundTaskId,
                 text: contextParts ? `${contextParts}\n\n${prompt}` : prompt,
                 conversationId: threadConversationId,
                 workspaceId: process.env.OVERSKY_WORKSPACE_ID,

package/dist/commands/agents/releases/rollback.js

@@ -13,8 +13,7 @@ class AgentsReleasesRollback extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(AgentsReleasesRollback);
-        // Through handleApiError so a refusal says why — in particular
-        // STEP_UP_REQUIRED (OSK-12275), whose remedy is `step-up`, not a retry.
+        // Through handleApiError so a release or permission refusal says why.
         let result;
         try {
             result = await data_provider_1.dataService.rollbackAgentRelease({

package/dist/commands/agents/visibility.js

@@ -36,7 +36,9 @@ function parseReleaseDependencies(entries) {
     for (const entry of entries) {
         const match = /^(skill|action):([^@]+)@(store_release_[A-Za-z0-9_-]+)$/.exec(entry);
         if (!match) {
-            return { error: `--dependency expects skill:<id>@<store-release-id> or action:<id>@<store-release-id>, got "${entry}".` };
+            return {
+                error: `--dependency expects skill:<id>@<store-release-id> or action:<id>@<store-release-id>, got "${entry}".`,
+            };
         }
         dependencies.push({
             entityType: match[1],
@@ -47,10 +49,9 @@ function parseReleaseDependencies(entries) {
     return { dependencies };
 }
 class AgentsVisibility extends base_command_1.BaseCommand {
-    static description = 'Set the visibility of an agent (accounts with 2FA need recent step-up for public publishing)';
+    static description = 'Set the visibility of an agent';
     static examples = [
         '<%= config.bin %> agents visibility <agent-id> --public',
-        '<%= config.bin %> step-up # required before public publishing when 2FA is enabled',
         '<%= config.bin %> agents visibility <agent-id> --private',
         '<%= config.bin %> agents visibility <agent-id> --public --json',
         '<%= config.bin %> agents visibility <agent-id> --public --capability-rationale "network:*=Looks up flight prices on the web"',
@@ -111,7 +112,9 @@ class AgentsVisibility extends base_command_1.BaseCommand {
         if (dependencyError)
             this.error(dependencyError, { exit: 1 });
         if (dependencies && !isPublic) {
-            this.error('--dependency declares pins on a public release; pass it with --public.', { exit: 1 });
+            this.error('--dependency declares pins on a public release; pass it with --public.', {
+                exit: 1,
+            });
         }
         if (capabilityRationales && !isPublic) {
             this.error('--capability-rationale applies only when publishing with --public.', {
@@ -125,29 +128,6 @@ class AgentsVisibility extends base_command_1.BaseCommand {
                 exit: 1,
             });
         }
-        // A public release reaches buyers. Accounts with 2FA need a recent
-        // second-factor proof; accounts without 2FA can publish from a verified
-        // sign-in session. Read that state before the publish write so the
-        // remedy is visible in the normal CLI flow instead of only after a 403.
-        // The server remains authoritative: this is user guidance, not a bypass.
-        if (isPublic) {
-            let stepUp;
-            try {
-                stepUp = await data_provider_1.dataService.getStepUpStatus(data_provider_1.STORE_PUBLISH_STEP_UP_PURPOSE);
-            }
-            catch (err) {
-                this.handleApiError(err);
-            }
-            if (!stepUp.active) {
-                const bin = this.config.bin;
-                if (!stepUp.sessionBound) {
-                    this.error(`This credential is not tied to a sign-in session. Run \`${bin} login\` before publishing, then \`${bin} step-up\` if your account has 2FA enabled.`, { code: 'STEP_UP_SESSION_UNBOUND', exit: 2 });
-                }
-                if (stepUp.methods.length > 0) {
-                    this.error(`Public publishing needs a recent two-factor verification. Run \`${bin} step-up\`, then retry this command.`, { code: 'STEP_UP_PROOF_REQUIRED', exit: 2 });
-                }
-            }
-        }
         let result;
         try {
             result = await data_provider_1.dataService.setAgentVisibility({

package/dist/commands/harnesses/leases/billing.d.ts

@@ -17,8 +17,9 @@ export default class HarnessesLeasesBilling extends BaseCommand {
         lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
+        'no-spending-limit': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
-        'spending-limit-cents': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'spending-limit-cents': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/harnesses/leases/billing.js

@@ -33,25 +33,30 @@ class HarnessesLeasesBilling extends base_command_1.BaseCommand {
         lease: core_1.Args.string({ ignoreStdin: true, description: 'Lease ID', required: true }),
     };
     static flags = {
+        'no-spending-limit': core_1.Flags.boolean({ description: 'Remove a Dedicated Runtime cap. Other hosted products refuse this.', exclusive: ['spending-limit-cents'] }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         'spending-limit-cents': core_1.Flags.integer({
             description: 'New monthly cap in cents. Refused below what the month has already spent or is projected to. Who pays for a lease is set at create and cannot be changed.',
-            required: true,
+            exclusive: ['no-spending-limit'],
             min: 1,
         }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(HarnessesLeasesBilling);
+        if (flags['spending-limit-cents'] === undefined && !flags['no-spending-limit']) {
+            this.error('Choose --spending-limit-cents or --no-spending-limit.', { exit: 2 });
+        }
         try {
             const response = await (0, harnesses_1.setHarnessLeaseBilling)(args.lease, {
-                spendingLimitCents: flags['spending-limit-cents'],
+                spendingLimitCents: flags['no-spending-limit'] ? null : flags['spending-limit-cents'],
             });
             if (flags.json) {
                 this.log(JSON.stringify(response, null, 2));
                 return;
             }
-            this.log(`${args.lease} monthly spending cap set to $${(flags['spending-limit-cents'] / 100).toFixed(2)}.`);
+            this.log(flags['no-spending-limit'] ? `${args.lease} has no monthly spending cap.` :
+                `${args.lease} monthly spending cap set to $${(flags['spending-limit-cents'] / 100).toFixed(2)}.`);
         }
         catch (err) {
             this.handleApiError(err);

package/dist/commands/machines/dedicated/create.d.ts

@@ -13,6 +13,7 @@ export default class DedicatedMachinesCreate extends DedicatedLeaseCommand {
         'retention-class': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'backup-profile': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'spending-limit-cents': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'no-spending-limit': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         repository: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'request-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/machines/dedicated/create.js

@@ -41,13 +41,14 @@ class DedicatedMachinesCreate extends dedicated_lease_command_1.DedicatedLeaseCo
         'backup-profile': core_1.Flags.string({
             description: 'crash-consistent (AWS Backup) or application-consistent (guest fsfreeze while the daemon is reachable; scheduled DLM when that plan is enabled). Defaults to the product catalog value.',
         }),
-        // Not required, and no client-side value either. Every lease has a cap:
-        // when create names none, the server applies the product's default cap,
-        // the "default monthly cap" `machines dedicated catalog` shows. Marking the
-        // flag required contradicted that catalog line (OSK-8691), and restating
-        // the default here would be the `--storage-gb` bug above.
         'spending-limit-cents': core_1.Flags.integer({
-            description: "Monthly spending cap in cents. Omit it to take the product's default cap (see `machines dedicated catalog`); change it later with `machines dedicated spending-limit`.",
+            description: 'Optional monthly spending cap in cents. New machines default to no cap; restore inherits the source cap.',
+            min: 1,
+            exclusive: ['no-spending-limit'],
+        }),
+        'no-spending-limit': core_1.Flags.boolean({
+            description: 'Run without a monthly spending cap. Compute and retained storage still bill.',
+            exclusive: ['spending-limit-cents'],
         }),
         repository: core_1.Flags.string({
             description: 'Default GitHub repository (owner/repo) for git credentials on the machine. Requires the GitHub App installed for it; a clone of another repository the App covers still works.',
@@ -81,7 +82,7 @@ class DedicatedMachinesCreate extends dedicated_lease_command_1.DedicatedLeaseCo
             requestId,
             displayName: flags.name,
             sizePreset,
-            monthlySpendingLimitCents: flags['spending-limit-cents'],
+            monthlySpendingLimitCents: flags['no-spending-limit'] ? null : flags['spending-limit-cents'],
             regionClass: flags['region-class'],
             storageGb: flags['storage-gb'],
             retentionClass: flags['retention-class'],
@@ -100,7 +101,7 @@ class DedicatedMachinesCreate extends dedicated_lease_command_1.DedicatedLeaseCo
                 sizePreset,
                 storageGb: flags['storage-gb'],
                 retentionClass: flags['retention-class'],
-                spendingLimitCents: flags['spending-limit-cents'],
+                spendingLimitCents: flags['no-spending-limit'] ? null : flags['spending-limit-cents'],
             });
             if (flags['dry-run']) {
                 if (flags.json) {

package/dist/commands/machines/dedicated/restore.d.ts

@@ -25,6 +25,7 @@ export default class DedicatedMachinesRestore extends DedicatedLeaseCommand {
         interval: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         name: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'spending-limit-cents': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'no-spending-limit': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'request-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };

package/dist/commands/machines/dedicated/restore.js

@@ -36,8 +36,13 @@ class DedicatedMachinesRestore extends dedicated_lease_command_1.DedicatedLeaseC
             description: 'Display name for the new machine (defaults to the deleted one, "(restored)")',
         }),
         'spending-limit-cents': core_1.Flags.integer({
-            description: "Monthly spending cap for the new machine (defaults to the deleted machine's)",
+            description: 'Optional monthly spending cap in cents. New machines default to no cap; restore inherits the source cap.',
             min: 1,
+            exclusive: ['no-spending-limit'],
+        }),
+        'no-spending-limit': core_1.Flags.boolean({
+            description: 'Run without a monthly spending cap. Compute and retained storage still bill.',
+            exclusive: ['spending-limit-cents'],
         }),
         'request-id': core_1.Flags.string({
             description: 'Idempotency key. Reuse it to safely retry the same restore.',
@@ -53,6 +58,7 @@ class DedicatedMachinesRestore extends dedicated_lease_command_1.DedicatedLeaseC
             ...this.scopeFrom(flags),
             requestId,
             ...(flags.name ? { displayName: flags.name } : {}),
+            ...(flags['no-spending-limit'] ? { monthlySpendingLimitCents: null } : {}),
             ...(flags['spending-limit-cents'] !== undefined
                 ? { monthlySpendingLimitCents: flags['spending-limit-cents'] }
                 : {}),

package/dist/commands/machines/dedicated/spending-limit.d.ts

@@ -2,7 +2,7 @@ import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
 /**
  * `skrr machines dedicated spending-limit` — change the monthly cap after create.
  *
- * The cap is the ONE guardrail on a machine with no wall-clock TTL: when a
+ * An optional cap is a spending guardrail on a machine with no wall-clock TTL: when a
  * month's spend reaches it, the platform stops compute and keeps the workspace.
  * It could be set at create and changed from the web lease card, but not from
  * here — so an operator who hit it at 2am had to find a browser to raise it,
@@ -15,7 +15,8 @@ export default class DedicatedMachinesSpendingLimit extends DedicatedLeaseComman
         lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
-        cents: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        cents: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'no-spending-limit': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;

package/dist/commands/machines/dedicated/spending-limit.js

@@ -6,7 +6,7 @@ const dedicated_machines_1 = require("../../../lib/dedicated-machines");
 /**
  * `skrr machines dedicated spending-limit` — change the monthly cap after create.
  *
- * The cap is the ONE guardrail on a machine with no wall-clock TTL: when a
+ * An optional cap is a spending guardrail on a machine with no wall-clock TTL: when a
  * month's spend reaches it, the platform stops compute and keeps the workspace.
  * It could be set at create and changed from the web lease card, but not from
  * here — so an operator who hit it at 2am had to find a browser to raise it,
@@ -28,16 +28,20 @@ class DedicatedMachinesSpendingLimit extends dedicated_lease_command_1.Dedicated
     static flags = {
         cents: core_1.Flags.integer({
             description: 'New monthly cap in cents (30000 = $300). Refused below what this month has already spent or is projected to.',
-            required: true,
+            exclusive: ['no-spending-limit'],
             min: 1,
         }),
+        'no-spending-limit': core_1.Flags.boolean({ description: 'Remove the cap. Compute and storage still bill.', exclusive: ['cents'] }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(DedicatedMachinesSpendingLimit);
+        if (flags.cents === undefined && !flags['no-spending-limit']) {
+            this.error('Choose --cents or --no-spending-limit.', { exit: 2 });
+        }
         const leaseId = await this.resolveLeaseArg(args.lease);
-        const response = await this.callDedicated(() => (0, dedicated_machines_1.setDedicatedRuntimeSpendingLimit)(leaseId, flags.cents, this.scopeFrom(flags)));
+        const response = await this.callDedicated(() => (0, dedicated_machines_1.setDedicatedRuntimeSpendingLimit)(leaseId, flags['no-spending-limit'] ? null : flags.cents, this.scopeFrom(flags)));
         if (flags.json) {
             this.log(JSON.stringify(response, null, 2));
             return;

package/dist/commands/step-up.d.ts

@@ -1,11 +1,10 @@
 import { BaseCommand } from '../base-command';
 /**
- * `skrr step-up` — confirm it is you before publishing to the Store
+ * `skrr step-up` — confirm it is you for a gated Store administration action
  * (OSK-12275).
  *
- * Making a release public, rolling the public listing back, or publishing a
- * governed release all reach buyers, so the server refuses them from a login
- * that has not recently proved a second factor. This command proves one — the
+ * Governed release administration may ask for a recent second factor.
+ * Self-service Agent publishing and rollback do not. This command proves one — the
  * code from the account's authenticator app, or an unused backup code — and
  * the verification is bound to THIS login only, for a few minutes. A token
  * stolen from another device, or a browser session, is not covered by it.

package/dist/commands/step-up.js

@@ -6,18 +6,17 @@ const base_command_1 = require("../base-command");
 const prompt_1 = require("../lib/prompt");
 const step_up_1 = require("../lib/step-up");
 /**
- * `skrr step-up` — confirm it is you before publishing to the Store
+ * `skrr step-up` — confirm it is you for a gated Store administration action
  * (OSK-12275).
  *
- * Making a release public, rolling the public listing back, or publishing a
- * governed release all reach buyers, so the server refuses them from a login
- * that has not recently proved a second factor. This command proves one — the
+ * Governed release administration may ask for a recent second factor.
+ * Self-service Agent publishing and rollback do not. This command proves one — the
  * code from the account's authenticator app, or an unused backup code — and
  * the verification is bound to THIS login only, for a few minutes. A token
  * stolen from another device, or a browser session, is not covered by it.
  */
 class StepUp extends base_command_1.BaseCommand {
-    static description = 'Confirm it is you with an authenticator code before publishing to the Store';
+    static description = 'Confirm it is you with an authenticator code for gated Store administration';
     static examples = [
         '<%= config.bin %> step-up',
         '<%= config.bin %> step-up --otp 123456',
@@ -34,7 +33,7 @@ class StepUp extends base_command_1.BaseCommand {
             exclusive: ['otp', 'status'],
         }),
         status: core_1.Flags.boolean({
-            description: 'Show whether this login is verified for publishing, without verifying',
+            description: 'Show whether this login has a recent second-factor proof',
         }),
         json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
     };
@@ -56,15 +55,15 @@ class StepUp extends base_command_1.BaseCommand {
                 return;
             }
             this.log(status.active
-                ? `Verified for publishing from this login until ${(0, step_up_1.formatStepUpExpiry)(status.expiresAt)}.`
-                : `Not verified for publishing from this login. Run \`${bin} step-up\` to verify.`);
+                ? `Verified for gated Store actions from this login until ${(0, step_up_1.formatStepUpExpiry)(status.expiresAt)}.`
+                : `No recent second-factor proof for this login. Run \`${bin} step-up\` to verify.`);
             return;
         }
         if (!status.sessionBound) {
-            this.error(`This credential is not tied to a sign-in session, so it cannot be verified for publishing. Run \`${bin} login\`, then \`${bin} step-up\`.`, { code: 'STEP_UP_SESSION_UNBOUND', exit: 2 });
+            this.error(`This credential is not tied to a sign-in session, so it cannot record a second-factor proof. Run \`${bin} login\`, then \`${bin} step-up\`.`, { code: 'STEP_UP_SESSION_UNBOUND', exit: 2 });
         }
         if (status.methods.length === 0) {
-            this.error('Publishing to the Store needs two-factor authentication, and this account has none. ' +
+            this.error('A second-factor proof needs two-factor authentication, and this account has none. ' +
                 `Turn it on in the web app (Settings → Account → Two-factor authentication), then run \`${bin} step-up\`.`, { code: 'STEP_UP_TWO_FACTOR_REQUIRED', exit: 2 });
         }
         let token = flags.otp?.trim();
@@ -90,7 +89,7 @@ class StepUp extends base_command_1.BaseCommand {
             return;
         }
         const via = result.method === 'backup_code' ? 'a backup code' : 'your authenticator app';
-        this.log(`Verified with ${via}. Store publishing from this login is allowed until ${(0, step_up_1.formatStepUpExpiry)(result.expiresAt)}.`);
+        this.log(`Verified with ${via}. Gated Store actions from this login are allowed until ${(0, step_up_1.formatStepUpExpiry)(result.expiresAt)}.`);
     }
 }
 exports.default = StepUp;

package/dist/lib/dedicated-machines.d.ts

@@ -244,7 +244,7 @@ export interface CreateDedicatedRuntimeInput extends DedicatedRuntimeScope {
     storageGb?: number;
     retentionClass?: string;
     backupProfile?: 'crash-consistent' | 'application-consistent';
-    monthlySpendingLimitCents?: number;
+    monthlySpendingLimitCents?: number | null;
     repositoryRef?: string;
 }
 export interface DedicatedRuntimeResponse {
@@ -267,7 +267,7 @@ export declare function dedicatedRuntimeCreateInput(input: {
     requestId: string;
     displayName: string;
     sizePreset: string;
-    monthlySpendingLimitCents?: number;
+    monthlySpendingLimitCents?: number | null;
     regionClass?: string;
     storageGb?: number;
     retentionClass?: string;
@@ -345,7 +345,7 @@ export declare function growDedicatedRuntime(leaseId: string, storageGb: number,
  */
 export declare function restoreDeletedDedicatedRuntime(leaseId: string, options?: {
     displayName?: string;
-    monthlySpendingLimitCents?: number;
+    monthlySpendingLimitCents?: number | null;
     requestId?: string;
 } & DedicatedRuntimeScope): Promise<DedicatedRuntimeResponse>;
 /**
@@ -356,7 +356,7 @@ export declare function restoreDeletedDedicatedRuntime(leaseId: string, options?
  * already spent (or is projected to) is refused rather than stopping the machine
  * on the next reconciler pass.
  */
-export declare function setDedicatedRuntimeSpendingLimit(leaseId: string, spendingLimitCents: number, scope?: DedicatedRuntimeScope): Promise<DedicatedRuntimeResponse>;
+export declare function setDedicatedRuntimeSpendingLimit(leaseId: string, spendingLimitCents: number | null, scope?: DedicatedRuntimeScope): Promise<DedicatedRuntimeResponse>;
 export declare function closeDedicatedRuntimeIncidentHold(leaseId: string, options?: {
     requestId?: string;
 } & DedicatedRuntimeScope): Promise<DedicatedRuntimeResponse>;
@@ -687,7 +687,7 @@ export interface DedicatedCreateChoices {
     sizePreset: string;
     storageGb?: number;
     retentionClass?: string;
-    spendingLimitCents?: number;
+    spendingLimitCents?: number | null;
 }
 /**
  * What a create is about to buy, in the words and numbers the catalog uses.

package/dist/lib/dedicated-machines.js

@@ -569,15 +569,16 @@ function dedicatedSpendSummary(lease) {
     const billing = lease.billing;
     if (!billing)
         return '-';
-    const cap = billing.monthlySpendLimitCents ?? billing.spendingLimitCents;
+    const cap = billing.monthlySpendLimitCents !== undefined
+        ? billing.monthlySpendLimitCents : billing.spendingLimitCents;
     if (billing.spendStatusUnavailable) {
-        return `spend unavailable right now · cap ${formatUsdCents(cap)}`;
+        return `spend unavailable right now · ${cap === null ? 'no monthly cap' : `cap ${formatUsdCents(cap)}`}`;
     }
     const spent = billing.currentMonthSpendCents;
     const projected = billing.projectedCurrentMonthSpendCents;
     const parts = [
         `${formatUsdCents(spent)} this month for machines of this type`,
-        `${formatUsdCents(cap)} cap for this machine`,
+        cap === null ? 'no monthly cap' : `${formatUsdCents(cap)} cap for this machine`,
     ];
     if (typeof projected === 'number' && projected !== spent) {
         parts.push(`projected ${formatUsdCents(projected)}`);
@@ -1117,10 +1118,11 @@ function dedicatedCreateSummary(catalog, choices) {
         ? `${retentionClass}${choices.retentionClass === undefined ? ' (catalog default)' : ''}`
         : 'server default';
     const retains = retentionClass !== undefined && retentionClass !== 'none';
-    const capCents = choices.spendingLimitCents ?? catalog?.defaultMonthlySpendingLimitCents;
+    const capCents = choices.spendingLimitCents !== undefined
+        ? choices.spendingLimitCents : catalog?.defaultMonthlySpendingLimitCents;
     const cap = capCents !== undefined && capCents !== null
         ? `${formatUsdCents(capCents)} per month${choices.spendingLimitCents === undefined ? ' (catalog default)' : ''}`
-        : 'server default';
+        : capCents === null ? 'no cap — compute and retained storage still bill' : 'server default';
     return [
         `Create Dedicated Runtime "${choices.name}" — it bills while it runs:`,
         `  size         ${choices.sizePreset} — ${spec}`,

package/dist/lib/dedicated-service.js

@@ -416,6 +416,8 @@ function socketOptions(token) {
         path: '/ws/agentic',
         auth: {
             token,
+            // This proves origin only; the normal CLI token retains full execution authority.
+            ...(process.env.OVERSKY_SESSION_TOKEN ? { executionOriginToken: process.env.OVERSKY_SESSION_TOKEN } : {}),
             ...(0, data_provider_1.getClientIdentityAuth)(),
             clientPlatform: 'cli',
             clientOs: process.platform === 'darwin' ? 'macos' : process.platform,

package/dist/lib/file-mime.js

@@ -63,6 +63,10 @@ const MIME_TYPES = {
     '.jpg': 'image/jpeg',
     '.js': 'text/javascript',
     '.json': 'application/json',
+    // A stream of JSON values is text evidence, not one JSON document.
+    // Preserve the original bytes and filename rather than forcing an array.
+    '.jsonl': 'text/plain',
+    '.ndjson': 'text/plain',
     '.log': 'text/plain',
     '.m4a': 'audio/m4a',
     '.m4v': 'video/m4v',

package/dist/lib/harnesses.d.ts

@@ -134,6 +134,11 @@ export interface HarnessLease {
     billing?: {
         billableState?: string;
         monthlySpendLimitCents?: number | null;
+        /** Monthly total shared by all machines of this product in the billing account. */
+        spendScope?: {
+            kind: 'owner_product' | 'workspace_product';
+            machineProduct: string;
+        };
         currentMonthSpendCents?: number;
         openUsageEstimateCents?: number;
         projectedCurrentMonthSpendCents?: number;

package/dist/lib/step-up.d.ts

@@ -1,14 +1,12 @@
 /**
- * What the CLI says about step-up authentication before Store publishing
+ * What the CLI says about step-up authentication for gated Store actions
  * (OSK-12275).
  *
- * A public release reaches everyone who installs it, so the server refuses to
- * publish one, or to move the release buyers are served, on the strength of a
- * CLI token alone: it answers `STEP_UP_REQUIRED` until this same login has
- * proved a second factor through `skrr step-up`. The vocabulary (the code, the
+ * An explicitly gated Store action answers `STEP_UP_REQUIRED` until this login
+ * has proved a second factor through `skrr step-up`. The vocabulary (the code, the
  * reasons, the window) is `@skrr-ai/data-provider`'s; only the sentences live
  * here, because each reason has a different next step and a refusal that says
- * "forbidden" would leave a publisher guessing which one applies.
+ * "forbidden" would leave the caller guessing which one applies.
  */
 import type { TStepUpChallenge } from '@skrr-ai/data-provider';
 /**

package/dist/lib/step-up.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.describeStepUpRequired = describeStepUpRequired;
 exports.formatStepUpExpiry = formatStepUpExpiry;
-const NOTHING_CHANGED = 'Nothing was published or changed.';
+const NOTHING_CHANGED = 'Nothing changed.';
 function windowPhrase(windowSeconds) {
     const minutes = Math.max(1, Math.round((windowSeconds ?? 600) / 60));
     return `${minutes} minute${minutes === 1 ? '' : 's'}`;
@@ -17,18 +17,18 @@ function describeStepUpRequired(challenge, bin) {
     switch (challenge?.reason) {
         case 'two_factor_not_enabled':
             return [
-                `Publishing to the Store needs two-factor authentication, and this account has none. ${NOTHING_CHANGED}`,
+                `This action needs two-factor authentication, and this account has none. ${NOTHING_CHANGED}`,
                 'Turn it on in the web app (Settings → Account → Two-factor authentication),',
                 `then run \`${bin} step-up\` and run this command again within ${window}.`,
             ].join('\n');
         case 'credential_not_session_bound':
             return [
-                `This credential is not tied to a sign-in session, so it cannot be verified for publishing. ${NOTHING_CHANGED}`,
+                `This credential is not tied to a sign-in session, so it cannot record a second-factor proof. ${NOTHING_CHANGED}`,
                 `Run \`${bin} login\`, then \`${bin} step-up\`, and run this command again within ${window}.`,
             ].join('\n');
         default:
             return [
-                `Publishing needs a fresh identity check: a public release reaches everyone who installs it, so this login alone is not enough. ${NOTHING_CHANGED}`,
+                `This action needs a fresh identity check; this login alone is not enough. ${NOTHING_CHANGED}`,
                 `Run \`${bin} step-up\` and enter the code from your authenticator app, then run this command again within ${window}.`,
             ].join('\n');
     }