@skrr-ai/cli 0.1.87 → 0.1.88

package/dist/commands/agents/chat.js

@@ -538,7 +538,13 @@ class AgentsChat extends base_command_1.BaseCommand {
         // Only the LOOKUP starts here: the default is committed just before the
         // turn, so those reads still go out without a workspace header, as before.
         // `--quick` never consulted it. Never rejects.
-        const homeWorkspace = flags.quick
+        //
+        // OSK-13599 — and a server already observed to choose the agent's home
+        // workspace itself is not asked at all: that read existed only to pick the
+        // header, and it is a full round trip before every turn. Only the SERVER's
+        // capability is remembered, never the agent's workspace (agents move).
+        const serverChoosesWorkspace = !flags.quick && (0, agent_home_workspace_1.serverAppliesAgentHomeDefault)(this.config?.cacheDir, this.cliConfig.baseURL);
+        const homeWorkspace = flags.quick || serverChoosesWorkspace
             ? null
             : (0, agent_home_workspace_1.lookupAgentHomeWorkspaceDefault)(args.agentId, (agentId) => data_provider_1.dataService.getAgentById({ agent_id: agentId }));
         let threadConversationId = flags.conversation;
@@ -679,6 +685,18 @@ class AgentsChat extends base_command_1.BaseCommand {
             // model is not supported."). The reader had to guess (OSK-4897).
             this.handleApiError(err);
         }
+        // OSK-13599 — the acceptance names the workspace the turn runs in. Adopt it
+        // for the rest of this turn (the stream's header, the message reads that
+        // reconcile its end, envelope replay) exactly as the pre-flight read's
+        // answer used to be adopted; a workspace the caller chose still wins, and
+        // an autonomous process still never takes one. It also tells us whether
+        // this server chooses the workspace itself, for the next turn.
+        const workspaceDefault = (0, agent_home_workspace_1.recordAgentHomeDefaultObservation)(this.config?.cacheDir, this.cliConfig.baseURL, started);
+        if (serverChoosesWorkspace && workspaceDefault === 'unsupported') {
+            this.warn('This server no longer chooses the agent’s home workspace, so this turn ran without ' +
+                'one. The next turn will select it again; pass --workspace to choose one now.');
+        }
+        (0, agent_home_workspace_1.commitAgentHomeWorkspaceDefault)(typeof started.workspaceId === 'string' && started.workspaceId ? started.workspaceId : null);
         if (!started.sessionId) {
             this.error('Agentic chat was accepted without a session ID; cannot attach the stream.', {
                 exit: 1,
@@ -696,6 +714,14 @@ class AgentsChat extends base_command_1.BaseCommand {
                 conversationId: started.conversationId,
                 ...(flags['thread-root'] ? { threadRootMessageId: flags['thread-root'] } : {}),
                 responseMessageId: started.responseMessageId,
+                // OSK-13599 — where the turn runs and who chose it, when the server
+                // says (`request` | `agent_home`); absent against an older server.
+                ...(workspaceDefault === 'supported'
+                    ? {
+                        workspaceId: started.workspaceId ?? null,
+                        workspaceSource: started.workspaceSource ?? null,
+                    }
+                    : {}),
                 agentId: args.agentId,
                 url: (0, web_url_1.agentUrlFrom)(this.cliConfig.baseURL, { id: args.agentId }),
             });

package/dist/commands/computer/index.d.ts

@@ -0,0 +1,19 @@
+import { Command } from '@oclif/core';
+/**
+ * `skrr computer allow|deny|status` — the machine-local consent for the
+ * computer's new surfaces (§18/D11): the file surface and a person's own
+ * browser windows. Off by default; the daemon announces the answer as
+ * capabilities so the shell can say "this machine has not allowed the
+ * computer" instead of failing later.
+ */
+export default class Computer extends Command {
+    static description: string;
+    static args: {
+        action: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/computer/index.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const computer_consent_1 = require("../../lib/computer-consent");
+/**
+ * `skrr computer allow|deny|status` — the machine-local consent for the
+ * computer's new surfaces (§18/D11): the file surface and a person's own
+ * browser windows. Off by default; the daemon announces the answer as
+ * capabilities so the shell can say "this machine has not allowed the
+ * computer" instead of failing later.
+ */
+class Computer extends core_1.Command {
+    static description = 'Allow, deny, or show whether the computer may reach this machine — ' +
+        'its file surface and your own browser windows (off by default)';
+    static args = {
+        action: core_1.Args.string({
+            description: 'allow, deny, or status',
+            required: true,
+            options: ['allow', 'deny', 'status'],
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    static examples = [
+        '<%= config.bin %> computer status',
+        '<%= config.bin %> computer allow',
+        '<%= config.bin %> computer deny',
+        '<%= config.bin %> computer status --json',
+    ];
+    async run() {
+        const { args, flags } = await this.parse(Computer);
+        await (0, computer_consent_1.forwardComputerConsent)(this, [args.action, ...(flags.json ? ['--json'] : [])]);
+    }
+}
+exports.default = Computer;

package/dist/commands/labels/create.d.ts

@@ -3,6 +3,7 @@ export default class LabelsCreate extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        'allow-duplicate-name': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         color: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/labels/create.js

@@ -30,6 +30,7 @@ class LabelsCreate extends base_command_1.BaseCommand {
         'group-exclusive': core_1.Flags.boolean({
             description: 'Make this label an exclusive group: at most one of ITS children may be attached to an entity at a time. Attaching a second child auto-detaches the first.',
         }),
+        ...label_scope_1.allowDuplicateNameFlags,
     };
     async run() {
         this.requireAuth();
@@ -58,6 +59,7 @@ class LabelsCreate extends base_command_1.BaseCommand {
                 ...(applicableTo ? { applicableTo } : {}),
                 ...(flags.parent ? { parentId: flags.parent } : {}),
                 ...(flags['group-exclusive'] ? { groupExclusive: true } : {}),
+                ...(flags['allow-duplicate-name'] ? { allowDuplicateName: true } : {}),
             });
         }
         catch (err) {

package/dist/commands/labels/restore.d.ts

@@ -6,6 +6,7 @@ export default class LabelsRestore extends BaseCommand {
         id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
+        'allow-duplicate-name': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;

package/dist/commands/labels/restore.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
+const label_scope_1 = require("../../lib/label-scope");
 class LabelsRestore extends base_command_1.BaseCommand {
     static description = 'Restore an archived label';
     static examples = [
@@ -14,16 +15,18 @@ class LabelsRestore extends base_command_1.BaseCommand {
     };
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        ...label_scope_1.allowDuplicateNameFlags,
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(LabelsRestore);
         // A live label with the same name may have been created while this one was
-        // archived; the server answers 409 `duplicate_name` in that case, which
-        // `handleApiError` surfaces verbatim.
+        // archived; the server answers 409 `duplicate_name` (same scope) or
+        // `duplicate_name_other_scope` in that case, which `handleApiError`
+        // surfaces verbatim.
         let result;
         try {
-            result = await data_provider_1.dataService.restoreLabel(args.id);
+            result = await data_provider_1.dataService.restoreLabel(args.id, flags['allow-duplicate-name'] ? { allowDuplicateName: true } : {});
         }
         catch (err) {
             this.handleApiError(err);

package/dist/commands/labels/update.d.ts

@@ -6,6 +6,7 @@ export default class LabelsUpdate extends BaseCommand {
         id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
+        'allow-duplicate-name': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         name: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         color: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/labels/update.js

@@ -36,6 +36,7 @@ class LabelsUpdate extends base_command_1.BaseCommand {
         'expected-version': core_1.Flags.integer({
             description: 'Optimistic-concurrency guard — fails with 409 if the label changed since you read it',
         }),
+        ...label_scope_1.allowDuplicateNameFlags,
     };
     async run() {
         this.requireAuth();
@@ -78,6 +79,7 @@ class LabelsUpdate extends base_command_1.BaseCommand {
                 ...(flags['expected-version'] !== undefined
                     ? { expectedVersion: flags['expected-version'] }
                     : {}),
+                ...(flags['allow-duplicate-name'] ? { allowDuplicateName: true } : {}),
             });
         }
         catch (err) {

package/dist/commands/machines/computer-adoption.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr machines computer-adoption` — the share of daemons still on the old
+ * event families, which is the number retiring `browser:liveview:*` and
+ * `agent:terminal:*` waits on (OSK-13578). Admin only on the server: it
+ * describes the fleet, not the caller.
+ */
+export default class MachinesComputerAdoption extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/computer-adoption.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const computer_adoption_1 = require("../../lib/computer-adoption");
+/**
+ * `skrr machines computer-adoption` — the share of daemons still on the old
+ * event families, which is the number retiring `browser:liveview:*` and
+ * `agent:terminal:*` waits on (OSK-13578). Admin only on the server: it
+ * describes the fleet, not the caller.
+ */
+class MachinesComputerAdoption extends base_command_1.BaseCommand {
+    static description = 'Show how many daemons are still on the old browser live view / agent terminal event families instead of the computer protocol, and whether the retirement criterion is met (admin only)';
+    static examples = [
+        '<%= config.bin %> machines computer-adoption',
+        '<%= config.bin %> machines computer-adoption --json',
+    ];
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(MachinesComputerAdoption);
+        const read = await (0, computer_adoption_1.getComputerAdoption)();
+        if (flags.json) {
+            this.log(JSON.stringify(read, null, 2));
+            return;
+        }
+        for (const line of (0, computer_adoption_1.computerAdoptionLines)(read))
+            this.log(line);
+    }
+}
+exports.default = MachinesComputerAdoption;

package/dist/commands/machines/dedicated/archive.d.ts

@@ -0,0 +1,26 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated archive` — download a folder from the machine as a
+ * tar file.
+ *
+ * The machine builds one staged archive of the folder (prepare), the CLI reads
+ * it in chunks (read) and frees it (release — always, including on a failed or
+ * cancelled download). The local file is written beside its destination and
+ * renamed into place, the same discipline `cp` keeps, so a cancelled download
+ * never leaves a partial `<name>.tar` — only the machine's staged copy, which
+ * release then removes.
+ */
+export default class DedicatedMachinesArchive extends DedicatedLeaseCommand {
+    static summary: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        path: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        destination: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/archive.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+const dedicated_copy_1 = require("../../../lib/dedicated-copy");
+const computer_files_1 = require("../../../lib/computer-files");
+const LIMIT_MIB = dedicated_machines_1.DEDICATED_FILE_MAX_BYTES / (1024 * 1024);
+/**
+ * `skrr machines dedicated archive` — download a folder from the machine as a
+ * tar file.
+ *
+ * The machine builds one staged archive of the folder (prepare), the CLI reads
+ * it in chunks (read) and frees it (release — always, including on a failed or
+ * cancelled download). The local file is written beside its destination and
+ * renamed into place, the same discipline `cp` keeps, so a cancelled download
+ * never leaves a partial `<name>.tar` — only the machine's staged copy, which
+ * release then removes.
+ */
+class DedicatedMachinesArchive extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static summary = 'Download a folder from a Dedicated Runtime machine as a tar file';
+    static description = [
+        `Downloads one folder as a single tar archive of at most ${LIMIT_MIB} MiB and 10,000 entries. ` +
+            'A destination left off, or one that names a directory, receives <name>.tar.',
+        'The staged archive is the folder as it stood when the command ran — the tree may keep ' +
+            'changing, the archive does not. Symlinks are stored as links and never followed out of ' +
+            'the folder.',
+        'A Ctrl-C removes the local partial and releases the staged copy on the machine (exit 130; ' +
+            '143 for SIGTERM, 129 when the terminal closes). Progress is shown on a terminal, but not ' +
+            'with --json or under CI.',
+    ].join('\n\n');
+    static examples = [
+        '<%= config.bin %> machines dedicated archive rtl_abc123 repos/app',
+        '<%= config.bin %> machines dedicated archive rtl_abc123 repos/app ./backups/',
+        '<%= config.bin %> machines dedicated archive rtl_abc123 repos/app ./app-snapshot.tar --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+        path: core_1.Args.string({
+            description: 'Folder on the machine, relative to /workspace (inside repos/ or user-data/)',
+            required: true,
+            ignoreStdin: true,
+        }),
+        destination: core_1.Args.string({
+            description: 'Local file, or a directory to receive <name>.tar (default: ./<name>.tar)',
+            required: false,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesArchive);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const scope = this.scopeFrom(flags);
+        const progress = !flags.json && process.stderr.isTTY && !(0, dedicated_copy_1.isContinuousIntegration)()
+            ? (0, dedicated_copy_1.createCopyProgress)({
+                label: 'Downloading',
+                write: (text) => process.stderr.write(text),
+            })
+            : null;
+        // Same interrupt contract as `cp`: the first signal asks the download to
+        // stop; the partial is removed and the staged archive released.
+        const interrupt = (0, dedicated_copy_1.listenForCopyInterrupt)();
+        let result;
+        try {
+            // Once: prepare, every chunk and the release present this generation.
+            const generation = await (0, computer_files_1.resolveDedicatedFileGeneration)(leaseId, scope);
+            result = await (0, computer_files_1.downloadComputerFileArchive)(leaseId, args.path, args.destination, generation, scope, {
+                signal: interrupt.signal,
+                onProgress: progress?.update,
+            });
+        }
+        catch (thrown) {
+            progress?.clear();
+            const interruptedBy = interrupt.interruptedBy();
+            const err = interruptedBy ? new dedicated_copy_1.DedicatedCopyCancelledError(interruptedBy) : thrown;
+            if (err instanceof dedicated_copy_1.DedicatedCopyCancelledError) {
+                this.error(`${err.message} Nothing was written for ${args.path}; the staged archive on the machine is released.`, { exit: err.exitCode, code: err.code });
+            }
+            const refusal = (0, base_command_1.apiRefusal)(err);
+            if (refusal.body?.retryable === true)
+                this.handleApiError(err);
+            const failure = (0, computer_files_1.describeComputerFileFailure)(err, { bin: this.config.bin, leaseId });
+            if (failure)
+                this.failWithCliError({ ...failure, exit: 1 });
+            if (err instanceof Error && typeof err.status !== 'number') {
+                this.error(err.message, { exit: 1, code: 'DEDICATED_RUNTIME_FILE_TRANSFER_FAILED' });
+            }
+            this.handleApiError(err);
+        }
+        finally {
+            interrupt.dispose();
+        }
+        progress?.clear();
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        this.log(`Downloaded ${result.name}.${result.format} (${result.entries} entries, ${result.size} bytes) → ${result.destination}`);
+        if (!result.archiveReleased) {
+            this.warn('The staged archive could not be released; the machine removes it within the hour.');
+        }
+    }
+}
+exports.default = DedicatedMachinesArchive;

package/dist/commands/machines/dedicated/audit.d.ts

@@ -0,0 +1,25 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+import { type ComputerAuditPage } from '../../../lib/machine-audit';
+type AuditEvent = ComputerAuditPage['events'][number];
+/** The actor as ids: the audit record stores no display name. */
+export declare function describeAuditActor(actor: AuditEvent['actor']): string;
+/** What the event touched, as the record says it — a surface, a path, a reason. */
+export declare function describeAuditEvent(event: AuditEvent): string;
+export default class DedicatedMachinesAudit extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        kind: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        actor: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        since: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        until: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        cursor: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+export {};

package/dist/commands/machines/dedicated/audit.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeAuditActor = describeAuditActor;
+exports.describeAuditEvent = describeAuditEvent;
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const format_1 = require("../../../lib/format");
+const machine_audit_1 = require("../../../lib/machine-audit");
+/** The actor as ids: the audit record stores no display name. */
+function describeAuditActor(actor) {
+    return actor.kind === 'human' ? `person ${actor.userId}` : `agent ${actor.agentId}`;
+}
+/** What the event touched, as the record says it — a surface, a path, a reason. */
+function describeAuditEvent(event) {
+    const parts = [];
+    if (event.summary)
+        parts.push(event.summary);
+    else {
+        const detail = event.detail ?? {};
+        const path = typeof detail.path === 'string' ? detail.path : undefined;
+        const reason = typeof detail.reason === 'string' ? detail.reason : undefined;
+        if (path)
+            parts.push(typeof detail.toPath === 'string' ? `${path} -> ${detail.toPath}` : path);
+        if (reason)
+            parts.push(reason);
+    }
+    if (event.surfaceId)
+        parts.push(`[${event.surfaceKind ?? 'surface'} ${event.surfaceId}]`);
+    return parts.join(' ') || '-';
+}
+class DedicatedMachinesAudit extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = "Read a machine's audit record — who changed control, wrote files, opened, closed or shared a surface, changed a grant or used power — long after the live Activity window has rolled off";
+    static examples = [
+        '<%= config.bin %> machines dedicated audit <lease-id>',
+        '<%= config.bin %> machines dedicated audit <lease-id> --kind control_changed --since 14d --until 7d',
+        '<%= config.bin %> machines dedicated audit <lease-id> --actor <user-id> --json',
+        '<%= config.bin %> machines dedicated audit <lease-id> --cursor <next-cursor>',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            ignoreStdin: true,
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        kind: core_1.Flags.string({
+            description: `Only this kind; repeat for several (${machine_audit_1.COMPUTER_AUDIT_KINDS.join(', ')})`,
+            multiple: true,
+            options: [...machine_audit_1.COMPUTER_AUDIT_KINDS],
+        }),
+        actor: core_1.Flags.string({ description: 'Only events this person (user id) did' }),
+        since: core_1.Flags.string({
+            description: 'Only events at or after this time: 2026-09-24, an ISO time, or an age like 7d',
+        }),
+        until: core_1.Flags.string({
+            description: 'Only events before this time: 2026-09-24, an ISO time, or an age like 7d',
+        }),
+        limit: core_1.Flags.integer({ description: 'Events per page (1-200)', default: 50, min: 1, max: 200 }),
+        cursor: core_1.Flags.string({ description: 'Continue from the `next` cursor of a previous page' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesAudit);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        let since;
+        let until;
+        try {
+            since = flags.since ? (0, machine_audit_1.parseAuditTime)(flags.since, '--since') : undefined;
+            until = flags.until ? (0, machine_audit_1.parseAuditTime)(flags.until, '--until') : undefined;
+        }
+        catch (err) {
+            this.error(err instanceof Error ? err.message : String(err), { exit: 2 });
+        }
+        const page = await this.callDedicated(() => (0, machine_audit_1.listMachineAudit)(`lease:${leaseId}`, {
+            kinds: flags.kind,
+            actorUserId: flags.actor,
+            since,
+            until,
+            cursor: flags.cursor,
+            limit: flags.limit,
+        }));
+        if (flags.json) {
+            this.log(JSON.stringify(page, null, 2));
+            return;
+        }
+        const events = page?.events ?? [];
+        if (events.length === 0) {
+            // An empty page is "nothing matched", never "nothing happened": the
+            // record is kept 400 days and a grantee is not shown grant changes.
+            this.log(flags.kind || flags.actor || flags.since || flags.until
+                ? 'No audit events match those filters.'
+                : 'No audit events recorded for this machine.');
+            return;
+        }
+        (0, format_1.renderTable)(events.map((event) => ({
+            when: (0, format_1.localStamp)(event.occurredAt),
+            actor: (0, format_1.formatCell)(describeAuditActor(event.actor)),
+            kind: (0, format_1.formatCell)(event.kind),
+            what: (0, format_1.formatCell)(describeAuditEvent(event)),
+        })), [
+            { key: 'when', header: `WHEN (${(0, format_1.localZone)()})` },
+            { key: 'actor', header: 'ACTOR', verbatim: true },
+            { key: 'kind', header: 'KIND' },
+            { key: 'what', header: 'WHAT', verbatim: true },
+        ], (line) => this.log(line));
+        if (page?.nextCursor) {
+            this.log(`More (older) events: re-run with --cursor ${page.nextCursor}`);
+        }
+    }
+}
+exports.default = DedicatedMachinesAudit;

package/dist/commands/machines/dedicated/computer.d.ts

@@ -0,0 +1,23 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated computer` — open the machine's computer: its
+ * terminals, browser and files as one desktop of windows (design §11, §17).
+ *
+ * The page is `/machines/<machineId>/computer`, where the machine id is the
+ * inventory's `lease:<leaseId>`. The command prints that URL (always, on
+ * stdout) and opens it unless stdout is not a terminal or --json was passed —
+ * the same open contract `projects open` and the other entity opens keep.
+ */
+export default class DedicatedMachinesComputer extends DedicatedLeaseCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        web: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        app: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/computer.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const entity_open_1 = require("../../../lib/entity-open");
+const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+/**
+ * `skrr machines dedicated computer` — open the machine's computer: its
+ * terminals, browser and files as one desktop of windows (design §11, §17).
+ *
+ * The page is `/machines/<machineId>/computer`, where the machine id is the
+ * inventory's `lease:<leaseId>`. The command prints that URL (always, on
+ * stdout) and opens it unless stdout is not a terminal or --json was passed —
+ * the same open contract `projects open` and the other entity opens keep.
+ */
+class DedicatedMachinesComputer extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static summary = 'Open a Dedicated Runtime machine’s computer in the browser or skrr Desktop';
+    static examples = [
+        '<%= config.bin %> machines dedicated computer rtl_abc123',
+        '<%= config.bin %> machines dedicated computer rtl_abc123 --app',
+        '<%= config.bin %> machines dedicated computer rtl_abc123 --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        web: core_1.Flags.boolean({ char: 'w', description: 'Open in the browser (default)' }),
+        app: core_1.Flags.boolean({ char: 'a', description: 'Open in skrr Desktop (macOS)' }),
+        json: core_1.Flags.boolean({ description: 'Print the canonical URL as JSON without opening it' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesComputer);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        // The lease read doubles as the existence check: an id that resolves to
+        // nothing is refused before a browser opens on a dead page.
+        const response = await this.callDedicated(() => (0, dedicated_machines_1.getDedicatedRuntime)(leaseId, this.scopeFrom(flags)));
+        if (!response?.lease) {
+            this.error('Dedicated Runtime lease not found.', { exit: 1 });
+        }
+        const url = (0, dedicated_machines_1.dedicatedComputerUrl)(this.cliConfig.baseURL, leaseId);
+        if (!url) {
+            this.error(`No computer page exists for ${leaseId}.`, { exit: 1 });
+        }
+        const result = await (0, entity_open_1.openEntity)({
+            baseURL: this.cliConfig.baseURL,
+            entity: { url },
+            urlFor: () => null,
+            target: flags.app ? 'app' : 'web',
+            json: Boolean(flags.json),
+        });
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const where = result.target === 'app' ? 'skrr Desktop' : 'browser';
+        this.log(result.opened ? `Opened ${where}: ${result.url}` : result.url);
+    }
+}
+exports.default = DedicatedMachinesComputer;

package/dist/commands/machines/dedicated/cp.d.ts

@@ -17,6 +17,8 @@ export default class DedicatedMachinesCp extends BaseCommand {
     };
     static flags: {
         workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        overwrite: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'if-tag': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;