@skrr-ai/cli 0.1.8

package/dist/commands/grants/create.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const grants_1 = require("../../lib/grants");
+/**
+ * `skrr grants create` — give an agent a credential.
+ *
+ * Before Grants there was no per-agent secret storage anywhere: `pluginAuth` is
+ * keyed without an agentId, `key` is LLM-provider keys, and
+ * `agentComposioConnection` stores only a connected-account id. The only paths
+ * were pasting a plaintext key into agent memory or relying on a laptop being
+ * awake.
+ *
+ * The value is stored encrypted and cannot be read back — keep your own copy.
+ */
+class GrantsCreate extends base_command_1.BaseCommand {
+    static description = 'Create a credential grant for an agent or commitment';
+    static examples = [
+        '<%= config.bin %> grants create --agent <agent-id> --provider aws --label "AWS read-only" --env AWS_ACCESS_KEY_ID=AKIA... --env AWS_SECRET_ACCESS_KEY=...',
+        '<%= config.bin %> grants create --commitment <commitment-id> --provider stripe --label Billing --env STRIPE_API_KEY=sk_live_... --daemon',
+    ];
+    static args = {};
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        agent: core_1.Flags.string({ description: 'Agent ID this grant is issued to' }),
+        commitment: core_1.Flags.string({
+            description: 'Commitment ID this grant is issued to (tighter blast radius than an agent)',
+        }),
+        provider: core_1.Flags.string({ description: 'Provider slug (e.g. aws, stripe)', required: true }),
+        label: core_1.Flags.string({ description: 'Human label', required: true }),
+        description: core_1.Flags.string({ description: 'Optional description' }),
+        env: core_1.Flags.string({
+            description: 'Credential as NAME=VALUE (repeatable)',
+            multiple: true,
+            required: true,
+        }),
+        daemon: core_1.Flags.boolean({
+            description: 'Also allow this grant on the daemon (your own machine)',
+            default: false,
+        }),
+        'no-sandbox': core_1.Flags.boolean({
+            description: 'Disallow use in the cloud sandbox',
+            default: false,
+        }),
+        expires: core_1.Flags.string({ description: 'Expiry as an ISO-8601 instant' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(GrantsCreate);
+        if (!flags.agent && !flags.commitment) {
+            this.error('Specify --agent or --commitment: a grant must name the principal that holds it.');
+        }
+        if (flags.agent && flags.commitment) {
+            this.error('Specify only one of --agent / --commitment.');
+        }
+        let env;
+        try {
+            env = (0, grants_1.parseEnvPairs)(flags.env);
+        }
+        catch (err) {
+            this.error(err.message);
+        }
+        const grant = await grants_1.grantApi.create({
+            principal: flags.agent
+                ? { kind: 'agent', agentId: flags.agent }
+                : { kind: 'commitment', commitmentId: flags.commitment },
+            provider: flags.provider,
+            label: flags.label,
+            description: flags.description,
+            credential: { kind: 'env', env },
+            runtime: { sandbox: !flags['no-sandbox'], daemon: flags.daemon },
+            expiresAt: flags.expires,
+        });
+        if (flags.json) {
+            this.log(JSON.stringify(grant, null, 2));
+            return;
+        }
+        this.log(`Stored grant ${grant.id} (${grant.label}).`);
+        this.log(`  variables: ${grant.credential?.envKeys.join(', ') || '—'}`);
+        this.log('  Values are encrypted and cannot be read back.');
+    }
+}
+exports.default = GrantsCreate;

package/dist/commands/grants/delete.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base-command';
+/** `skrr grants delete` — soft delete; the row stays auditable. */
+export default class GrantsDelete extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        grantId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/grants/delete.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const grants_1 = require("../../lib/grants");
+/** `skrr grants delete` — soft delete; the row stays auditable. */
+class GrantsDelete extends base_command_1.BaseCommand {
+    static description = 'Delete a credential grant (soft delete)';
+    static examples = ['<%= config.bin %> grants delete <grant-id>'];
+    static args = {
+        grantId: core_1.Args.string({ ignoreStdin: true, description: 'Grant ID', required: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(GrantsDelete);
+        const out = await grants_1.grantApi.remove(args.grantId);
+        if (flags.json) {
+            this.log(JSON.stringify(out, null, 2));
+            return;
+        }
+        this.log(`Deleted grant ${args.grantId}.`);
+    }
+}
+exports.default = GrantsDelete;

package/dist/commands/grants/list.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr grants list` — scoped capability envelopes.
+ *
+ * Values are never shown: the server has no read-back endpoint. What you see is
+ * the variable NAMES the grant carries, which is the audit surface.
+ */
+export default class GrantsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        agent: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        commitment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        provider: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/grants/list.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const grants_1 = require("../../lib/grants");
+const triggers_1 = require("../../lib/triggers");
+/**
+ * `skrr grants list` — scoped capability envelopes.
+ *
+ * Values are never shown: the server has no read-back endpoint. What you see is
+ * the variable NAMES the grant carries, which is the audit surface.
+ */
+class GrantsList extends base_command_1.BaseCommand {
+    static description = 'List credential grants (scoped capability envelopes)';
+    static examples = [
+        '<%= config.bin %> grants list',
+        '<%= config.bin %> grants list --agent <agent-id>',
+        '<%= config.bin %> grants list --provider aws --json',
+    ];
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        agent: core_1.Flags.string({ description: 'Filter by agent ID' }),
+        commitment: core_1.Flags.string({ description: 'Filter by commitment ID' }),
+        provider: core_1.Flags.string({ description: 'Filter by provider (e.g. aws)' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(GrantsList);
+        const response = await grants_1.grantApi.list((0, triggers_1.withQuery)('/api/grants', {
+            agentId: flags.agent,
+            commitmentId: flags.commitment,
+            provider: flags.provider,
+        }));
+        if (flags.json) {
+            this.log(JSON.stringify(response.grants, null, 2));
+            return;
+        }
+        (0, grants_1.renderGrantList)(response.grants, (line) => this.log(line));
+    }
+}
+exports.default = GrantsList;

package/dist/commands/grants/revoke.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr grants revoke` — withdraw a capability.
+ *
+ * A WRITE, never a delete: a withdrawn credential stays auditable, and
+ * resolution filters on `revokedAt` so the effect is immediate.
+ */
+export default class GrantsRevoke extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        grantId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        restore: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/grants/revoke.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const grants_1 = require("../../lib/grants");
+/**
+ * `skrr grants revoke` — withdraw a capability.
+ *
+ * A WRITE, never a delete: a withdrawn credential stays auditable, and
+ * resolution filters on `revokedAt` so the effect is immediate.
+ */
+class GrantsRevoke extends base_command_1.BaseCommand {
+    static description = 'Revoke (or restore) a credential grant';
+    static examples = [
+        '<%= config.bin %> grants revoke <grant-id>',
+        '<%= config.bin %> grants revoke <grant-id> --restore',
+    ];
+    static args = {
+        grantId: core_1.Args.string({ ignoreStdin: true, description: 'Grant ID', required: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        restore: core_1.Flags.boolean({ description: 'Restore a previously revoked grant', default: false }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(GrantsRevoke);
+        const grant = await grants_1.grantApi.setRevoked(args.grantId, !flags.restore);
+        if (flags.json) {
+            this.log(JSON.stringify(grant, null, 2));
+            return;
+        }
+        this.log(`${flags.restore ? 'Restored' : 'Revoked'} grant ${grant.id} (${grant.label}).`);
+    }
+}
+exports.default = GrantsRevoke;

package/dist/commands/grants/rotate.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr grants rotate` — replace a credential wholesale.
+ *
+ * Replacement, never a merge: a partial update could leave half of a previous
+ * key pair alive alongside the new one.
+ */
+export default class GrantsRotate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        grantId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        env: import("@oclif/core/lib/interfaces").OptionFlag<string[], import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/grants/rotate.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const grants_1 = require("../../lib/grants");
+/**
+ * `skrr grants rotate` — replace a credential wholesale.
+ *
+ * Replacement, never a merge: a partial update could leave half of a previous
+ * key pair alive alongside the new one.
+ */
+class GrantsRotate extends base_command_1.BaseCommand {
+    static description = 'Rotate the credential on an existing grant';
+    static examples = [
+        '<%= config.bin %> grants rotate <grant-id> --env AWS_ACCESS_KEY_ID=AKIA... --env AWS_SECRET_ACCESS_KEY=...',
+    ];
+    static args = {
+        grantId: core_1.Args.string({ ignoreStdin: true, description: 'Grant ID', required: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        env: core_1.Flags.string({
+            description: 'New credential as NAME=VALUE (repeatable)',
+            multiple: true,
+            required: true,
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(GrantsRotate);
+        let env;
+        try {
+            env = (0, grants_1.parseEnvPairs)(flags.env);
+        }
+        catch (err) {
+            this.error(err.message);
+        }
+        const grant = await grants_1.grantApi.rotate(args.grantId, { kind: 'env', env });
+        if (flags.json) {
+            this.log(JSON.stringify(grant, null, 2));
+            return;
+        }
+        this.log(`Rotated grant ${grant.id}.`);
+        this.log(`  variables: ${grant.credential?.envKeys.join(', ') || '—'}`);
+    }
+}
+exports.default = GrantsRotate;

package/dist/commands/harnesses/alias.d.ts

@@ -0,0 +1,21 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Your own display name for an harness.
+ *
+ * Distinct from `harnesses update --name`, which renames it for everyone it is
+ * shared with. An alias is presentation state scoped to you — useful when a
+ * colleague lends you a machine called "MacBook Pro" and so is yours.
+ */
+export default class HarnessesAlias extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        harness: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        clear: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/harnesses/alias.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const harnesses_1 = require("../../lib/harnesses");
+/**
+ * Your own display name for an harness.
+ *
+ * Distinct from `harnesses update --name`, which renames it for everyone it is
+ * shared with. An alias is presentation state scoped to you — useful when a
+ * colleague lends you a machine called "MacBook Pro" and so is yours.
+ */
+class HarnessesAlias extends base_command_1.BaseCommand {
+    static description = 'Set YOUR display name for a harness (does not rename it for others)';
+    static examples = [
+        '<%= config.bin %> harnesses alias <harness-id> "Ana\'s build box"',
+        '<%= config.bin %> harnesses alias <harness-id> --clear',
+    ];
+    static args = {
+        harness: core_1.Args.string({ ignoreStdin: true, description: 'Harness ID', required: true }),
+        name: core_1.Args.string({ ignoreStdin: true, description: 'Your display name for it' }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        clear: core_1.Flags.boolean({ description: "Remove your alias and show the harness's own name" }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(HarnessesAlias);
+        if (!flags.clear && !args.name) {
+            this.error('Give a name, or pass --clear to remove your alias.', { exit: 1 });
+            return;
+        }
+        try {
+            // `null` is the documented clear signal, distinct from an absent field.
+            const response = await (0, harnesses_1.setHarnessAlias)(args.harness, flags.clear ? null : args.name);
+            if (flags.json) {
+                this.log(JSON.stringify(response, null, 2));
+                return;
+            }
+            this.log(flags.clear
+                ? `Cleared your alias for ${args.harness}.`
+                : `Now showing ${args.harness} as "${args.name}".`);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = HarnessesAlias;

package/dist/commands/harnesses/forget.d.ts

@@ -0,0 +1,20 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Forget an harness — `forget`, not `delete`.
+ *
+ * The row goes; the machine does not. A local harness whose daemon is still
+ * running re-registers on its next connection, so `delete` would promise
+ * something this verb cannot deliver.
+ */
+export default class HarnessesForget extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        harness: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/harnesses/forget.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const harnesses_1 = require("../../lib/harnesses");
+/**
+ * Forget an harness — `forget`, not `delete`.
+ *
+ * The row goes; the machine does not. A local harness whose daemon is still
+ * running re-registers on its next connection, so `delete` would promise
+ * something this verb cannot deliver.
+ */
+class HarnessesForget extends base_command_1.BaseCommand {
+    static description = 'Forget a harness (the row, not the machine — a live daemon re-registers)';
+    static examples = [
+        '<%= config.bin %> harnesses forget <harness-id>',
+        '<%= config.bin %> harnesses forget <harness-id> --yes',
+    ];
+    static args = {
+        harness: core_1.Args.string({ ignoreStdin: true, description: 'Harness ID', required: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        yes: core_1.Flags.boolean({ description: 'Skip the confirmation' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(HarnessesForget);
+        // Name it before removing it. An id alone does not tell the operator which
+        // of their machines they are about to drop from the fleet.
+        if (!flags.yes) {
+            let label = args.harness;
+            try {
+                const current = await (0, harnesses_1.getHarness)(args.harness);
+                label = current?.harness?.name || args.harness;
+            }
+            catch {
+                /* fall back to the id — the confirmation still has to happen */
+            }
+            const ok = await this.confirm(`Forget harness "${label}"? Agents pinned to it lose their pin.`);
+            if (!ok) {
+                this.log('Cancelled.');
+                return;
+            }
+        }
+        try {
+            const response = await (0, harnesses_1.forgetHarness)(args.harness);
+            if (flags.json) {
+                this.log(JSON.stringify(response, null, 2));
+                return;
+            }
+            this.log(`Forgot ${args.harness}.`);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = HarnessesForget;

package/dist/commands/harnesses/grants/add.d.ts

@@ -0,0 +1,28 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Lend a harness to a workspace.
+ *
+ * Only the harness's OWNER can run this — the server authorizes on ownership,
+ * not on a workspace role, because whether a laptop may be lent out is a
+ * question about physical custody rather than an org chart.
+ */
+export default class HarnessesGrantsAdd extends BaseCommand {
+    static aliases: string[];
+    static description: string;
+    static examples: string[];
+    static args: {
+        harness: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        role: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        agent: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'max-concurrent': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'window-start': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'window-end': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'window-timezone': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        note: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/harnesses/grants/add.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const runtime_grants_1 = require("../../../lib/runtime-grants");
+/**
+ * Lend a harness to a workspace.
+ *
+ * Only the harness's OWNER can run this — the server authorizes on ownership,
+ * not on a workspace role, because whether a laptop may be lent out is a
+ * question about physical custody rather than an org chart.
+ */
+class HarnessesGrantsAdd extends base_command_1.BaseCommand {
+    static aliases = ['harnesses:grants:add'];
+    static description = 'Lend a harness to a workspace';
+    static examples = [
+        '<%= config.bin %> harnesses grants add <harness-id> --workspace <workspace-id>',
+        '<%= config.bin %> harnesses grants add <harness-id> --workspace <ws> --role admin --role owner',
+        '<%= config.bin %> harnesses grants add <harness-id> --workspace <ws> --agent <agent-id> --note "CI box"',
+    ];
+    static args = {
+        harness: core_1.Args.string({ ignoreStdin: true, description: 'Harness ID', required: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        workspace: core_1.Flags.string({ description: 'Workspace to lend it to', required: true }),
+        // Every narrowing flag is OPTIONAL and additive. Omitting them all lends the
+        // harness to the whole workspace, which is the shape people expect from
+        // "share this machine with my team".
+        role: core_1.Flags.string({
+            description: 'Restrict to a workspace role (repeatable). Omit for every member.',
+            multiple: true,
+            options: ['owner', 'admin', 'member'],
+        }),
+        agent: core_1.Flags.string({
+            description: 'Restrict to an agent id (repeatable). Omit for every agent.',
+            multiple: true,
+        }),
+        'max-concurrent': core_1.Flags.integer({ description: 'Cap concurrent sessions on this harness' }),
+        'window-start': core_1.Flags.string({ description: 'Permitted window start (HH:MM)' }),
+        'window-end': core_1.Flags.string({ description: 'Permitted window end (HH:MM)' }),
+        'window-timezone': core_1.Flags.string({ description: 'Timezone for the permitted window' }),
+        note: core_1.Flags.string({ description: 'Why this harness is lent out' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(HarnessesGrantsAdd);
+        const policy = {};
+        if (flags.role?.length)
+            policy.roles = flags.role;
+        if (flags.agent?.length)
+            policy.agentIds = flags.agent;
+        if (flags['max-concurrent'])
+            policy.maxConcurrent = flags['max-concurrent'];
+        if (flags['window-start'] && flags['window-end']) {
+            policy.window = {
+                enabled: true,
+                start: flags['window-start'],
+                end: flags['window-end'],
+                timezone: flags['window-timezone'],
+            };
+        }
+        let grant;
+        try {
+            grant = await (0, runtime_grants_1.createHarnessGrant)(args.harness, {
+                workspaceId: flags.workspace,
+                policy,
+                note: flags.note,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(grant, null, 2));
+            return;
+        }
+        this.log(`Lent harness ${args.harness} to workspace ${grant.workspaceId}`);
+        this.log(`  grant:  ${grant.id}`);
+        this.log(`  policy: ${(0, runtime_grants_1.describeGrantPolicy)(grant.policy)}`);
+        this.log('');
+        this.log('Revoke at any time with:');
+        this.log(`  skrr harnesses grants revoke ${args.harness} ${grant.id}`);
+    }
+}
+exports.default = HarnessesGrantsAdd;

package/dist/commands/harnesses/grants/list.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../../base-command';
+export default class HarnessesGrantsList extends BaseCommand {
+    static aliases: string[];
+    static description: string;
+    static examples: string[];
+    static args: {
+        harness: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'include-revoked': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/harnesses/grants/list.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const format_1 = require("../../../lib/format");
+const runtime_grants_1 = require("../../../lib/runtime-grants");
+class HarnessesGrantsList extends base_command_1.BaseCommand {
+    static aliases = ['harnesses:grants:list'];
+    static description = 'List the workspaces a harness is lent to';
+    static examples = [
+        '<%= config.bin %> harnesses grants list <harness-id>',
+        '<%= config.bin %> harnesses grants list <harness-id> --include-revoked',
+        '<%= config.bin %> harnesses grants list <harness-id> --json',
+    ];
+    static args = {
+        harness: core_1.Args.string({ ignoreStdin: true, description: 'Harness ID', required: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        'include-revoked': core_1.Flags.boolean({
+            description: 'Include revoked grants (kept as a forensic record)',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(HarnessesGrantsList);
+        let grants;
+        try {
+            grants = await (0, runtime_grants_1.listHarnessGrants)(args.harness, { includeRevoked: flags['include-revoked'] });
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(grants, null, 2));
+            return;
+        }
+        if (grants.length === 0) {
+            // Say what the empty state MEANS, not just that it is empty: an ungranted
+            // harness is the default, not a misconfiguration.
+            this.log('This harness is not lent to any workspace — only its owner can use it.');
+            return;
+        }
+        (0, format_1.renderTable)(grants.map((grant) => ({
+            id: grant.id,
+            workspace: grant.workspaceId,
+            policy: (0, runtime_grants_1.describeGrantPolicy)(grant.policy),
+            status: grant.revokedAt ? `revoked ${grant.revokedAt}` : 'live',
+            note: grant.note || '-',
+        })), [
+            { key: 'id', header: 'GRANT' },
+            { key: 'workspace', header: 'WORKSPACE' },
+            { key: 'policy', header: 'POLICY' },
+            { key: 'status', header: 'STATUS' },
+            { key: 'note', header: 'NOTE', maxWidth: 32 },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = HarnessesGrantsList;