@skrr-ai/cli 0.1.87 → 0.1.88

package/dist/lib/label-scope.js

@@ -11,7 +11,7 @@
  * id the server can infer (it falls back to the caller).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.labelScopeFlags = exports.HEX_COLOR_RE = exports.LABEL_APPLICABLE = exports.LABEL_SCOPES_INFERRED = exports.LABEL_SCOPES_REQUIRING_ID = exports.LABEL_SCOPES = void 0;
+exports.allowDuplicateNameFlags = exports.labelScopeFlags = exports.HEX_COLOR_RE = exports.LABEL_APPLICABLE = exports.LABEL_SCOPES_INFERRED = exports.LABEL_SCOPES_REQUIRING_ID = exports.LABEL_SCOPES = void 0;
 exports.normalizeLabelColor = normalizeLabelColor;
 exports.resolveLabelScope = resolveLabelScope;
 exports.resolveApplicableTo = resolveApplicableTo;
@@ -56,6 +56,20 @@ exports.labelScopeFlags = {
         description: `Scope owner ID — required for ${joinScopes(scopesRequiringId())}. Omit for ${joinScopes(exports.LABEL_SCOPES_INFERRED)} (defaults to you).`,
     }),
 };
+/**
+ * `--allow-duplicate-name`, shared by every command that can put a live name
+ * into a scope (create, rename, restore).
+ *
+ * The SERVER owns the rule (`LabelService.assertNameFreeInOtherScope`): a name
+ * another label you can use already carries is refused with
+ * `409 duplicate_name_other_scope`, and the refusal names that label. The CLI
+ * only relays the override, so every surface — web, MCP, CLI — gets one answer.
+ */
+exports.allowDuplicateNameFlags = {
+    'allow-duplicate-name': core_1.Flags.boolean({
+        description: 'Proceed even though another label you can use (your user scope, or a workspace you belong to) already has this name. Refused by default: two labels with one name make `--label <name>` ambiguous.',
+    }),
+};
 /**
  * Validate the scope pair. Throws a plain `Error` so callers can surface it
  * through `this.error(..., { exit: 1 })` with the rest of their flag checks.

package/dist/lib/machine-audit.d.ts

@@ -0,0 +1,34 @@
+import { COMPUTER_AUDIT_KINDS, type ComputerAuditPage } from '@skrr-ai/data-provider';
+/**
+ * machine-audit.ts — request client for `GET /api/machines/:machineId/audit`
+ * (design §9, D8/D10; OSK-13607): who did what on a machine, after the
+ * daemon's live Activity window has rolled off.
+ *
+ * The owner reads it always; a grantee at any tier reads it too, without the
+ * `grant_*` events (those name the other people the machine is shared with).
+ * Vocabulary and the page shape are owned by `@skrr-ai/data-provider`.
+ *
+ * ## Inline path literal
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading this
+ * string; a helper that assembled the URL would read as unreachable.
+ */
+export { COMPUTER_AUDIT_KINDS };
+export type { ComputerAuditPage };
+export interface MachineAuditQuery {
+    kinds?: string[];
+    actorUserId?: string;
+    /** ISO time or epoch ms — occurredAt >= since. */
+    since?: string | number;
+    /** ISO time or epoch ms — occurredAt < until. */
+    until?: string | number;
+    cursor?: string;
+    limit?: number;
+}
+/**
+ * A `--since` / `--until` value as an ISO time: an absolute time as typed
+ * (`2026-09-24`, `2026-09-24T10:00:00Z`), or an age such as `90m`, `12h`,
+ * `7d`, `2w` counted back from `now`. Throws on anything else, naming the flag.
+ */
+export declare function parseAuditTime(value: string, flagName: string, now?: number): string;
+export declare function listMachineAudit(machineId: string, query?: MachineAuditQuery): Promise<ComputerAuditPage>;

package/dist/lib/machine-audit.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPUTER_AUDIT_KINDS = void 0;
+exports.parseAuditTime = parseAuditTime;
+exports.listMachineAudit = listMachineAudit;
+const data_provider_1 = require("@skrr-ai/data-provider");
+Object.defineProperty(exports, "COMPUTER_AUDIT_KINDS", { enumerable: true, get: function () { return data_provider_1.COMPUTER_AUDIT_KINDS; } });
+const api_fetch_1 = require("./api-fetch");
+const DURATION_MS = {
+    s: 1000,
+    m: 60_000,
+    h: 3_600_000,
+    d: 86_400_000,
+    w: 7 * 86_400_000,
+};
+/**
+ * A `--since` / `--until` value as an ISO time: an absolute time as typed
+ * (`2026-09-24`, `2026-09-24T10:00:00Z`), or an age such as `90m`, `12h`,
+ * `7d`, `2w` counted back from `now`. Throws on anything else, naming the flag.
+ */
+function parseAuditTime(value, flagName, now = Date.now()) {
+    const trimmed = value.trim();
+    const age = trimmed.match(/^(\d+)([smhdw])$/i);
+    if (age) {
+        return new Date(now - Number(age[1]) * DURATION_MS[age[2].toLowerCase()]).toISOString();
+    }
+    const absolute = new Date(trimmed);
+    if (!trimmed || Number.isNaN(absolute.getTime())) {
+        throw new Error(`Invalid ${flagName} value: ${value}. Use a time such as 2026-09-24 or an age such as 7d.`);
+    }
+    return absolute.toISOString();
+}
+async function listMachineAudit(machineId, query = {}) {
+    const params = new URLSearchParams();
+    for (const kind of query.kinds ?? [])
+        params.append('kind', kind);
+    if (query.actorUserId)
+        params.set('actor', query.actorUserId);
+    if (query.since != null)
+        params.set('since', String(query.since));
+    if (query.until != null)
+        params.set('until', String(query.until));
+    if (query.cursor)
+        params.set('cursor', query.cursor);
+    if (query.limit != null)
+        params.set('limit', String(query.limit));
+    const qs = params.toString();
+    const suffix = qs ? `?${qs}` : '';
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/audit` + suffix);
+}

package/dist/lib/machine-grants.d.ts

@@ -0,0 +1,70 @@
+/**
+ * machine-grants.ts — request client for `/api/machines/:machineId/grants`
+ * (design §9, D10; OSK-13558): who the owner shares a machine with.
+ *
+ * A grant gives one person, on one machine, one of two fixed tiers — `watch`
+ * (see every surface and its activity; no input, no file browsing) or
+ * `operate` (everything watch has, plus control and file read/write). `power`,
+ * closing other people's surfaces and grant management stay with the owner,
+ * which is why every verb here resolves machine OWNERSHIP server-side rather
+ * than checking a grant. The grantee may be any user, inside the owner's
+ * workspace or not.
+ *
+ * ## Inline path literals
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading these
+ * strings. A helper that assembles the URL is opaque to it, so the endpoint
+ * would read as unreachable and get allow-listed — a check going green on an
+ * assertion it never made.
+ */
+export declare const MACHINE_GRANT_TIERS: readonly ["watch", "operate"];
+export type MachineGrantTier = (typeof MACHINE_GRANT_TIERS)[number];
+/** One grant, as `ComputerGrantService.publicGrant` emits it. */
+export interface MachineGrant {
+    grantId: string;
+    machineId: string;
+    ownerUserId: string;
+    granteeUserId: string;
+    tier: MachineGrantTier;
+    createdAt?: number;
+    updatedAt?: number;
+}
+export interface MachineGrantList {
+    version: number;
+    grants: MachineGrant[];
+}
+export interface MachineGrantMutation {
+    grant: MachineGrant;
+    version: number;
+    /** POST only: false when the person already held this exact grant. */
+    created?: boolean;
+    /** PATCH only: false when the grant already held this tier. */
+    changed?: boolean;
+}
+export interface MachineGrantRevocation {
+    revoked: MachineGrant;
+    version: number;
+}
+export declare function listMachineGrants(machineId: string): Promise<MachineGrantList>;
+export declare function shareMachine(machineId: string, granteeUserId: string, tier: MachineGrantTier): Promise<MachineGrantMutation>;
+export declare function changeMachineGrant(machineId: string, granteeUserId: string, tier: MachineGrantTier): Promise<MachineGrantMutation>;
+export declare function unshareMachine(machineId: string, granteeUserId: string): Promise<MachineGrantRevocation>;
+export interface SharedMachine {
+    machineId: string;
+    name: string | null;
+    owner: {
+        userId: string;
+        name: string;
+        username?: string;
+        avatar?: string;
+    } | null;
+    tier: MachineGrantTier;
+    grantedAt?: number;
+    power?: {
+        phase: string;
+    } | null;
+}
+export interface SharedMachineList {
+    machines: SharedMachine[];
+}
+export declare function listSharedMachines(): Promise<SharedMachineList>;

package/dist/lib/machine-grants.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MACHINE_GRANT_TIERS = void 0;
+exports.listMachineGrants = listMachineGrants;
+exports.shareMachine = shareMachine;
+exports.changeMachineGrant = changeMachineGrant;
+exports.unshareMachine = unshareMachine;
+exports.listSharedMachines = listSharedMachines;
+const api_fetch_1 = require("./api-fetch");
+/**
+ * machine-grants.ts — request client for `/api/machines/:machineId/grants`
+ * (design §9, D10; OSK-13558): who the owner shares a machine with.
+ *
+ * A grant gives one person, on one machine, one of two fixed tiers — `watch`
+ * (see every surface and its activity; no input, no file browsing) or
+ * `operate` (everything watch has, plus control and file read/write). `power`,
+ * closing other people's surfaces and grant management stay with the owner,
+ * which is why every verb here resolves machine OWNERSHIP server-side rather
+ * than checking a grant. The grantee may be any user, inside the owner's
+ * workspace or not.
+ *
+ * ## Inline path literals
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading these
+ * strings. A helper that assembles the URL is opaque to it, so the endpoint
+ * would read as unreachable and get allow-listed — a check going green on an
+ * assertion it never made.
+ */
+exports.MACHINE_GRANT_TIERS = ['watch', 'operate'];
+async function listMachineGrants(machineId) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/grants`);
+}
+async function shareMachine(machineId, granteeUserId, tier) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/grants`, {
+        method: 'POST',
+        body: { granteeUserId, tier },
+    });
+}
+async function changeMachineGrant(machineId, granteeUserId, tier) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/grants/${encodeURIComponent(granteeUserId)}`, { method: 'PATCH', body: { tier } });
+}
+async function unshareMachine(machineId, granteeUserId) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/grants/${encodeURIComponent(granteeUserId)}`, { method: 'DELETE' });
+}
+async function listSharedMachines() {
+    return (0, api_fetch_1.apiFetch)('/api/machines/shared-with-me');
+}

package/dist/lib/machine-services.d.ts

@@ -0,0 +1,64 @@
+/**
+ * machine-services.ts — request client for `/api/machines/:machineId/services`
+ * (design §20.5; 9-17, OSK-13579): a machine's declared services, the web
+ * services an agent or a person started on it, named so the computer can open
+ * them in its own browser.
+ *
+ * Not the same thing as `skrr machines dedicated service`: those are always-on
+ * WORKLOADS a Dedicated Runtime keeps running. A declared service is an
+ * address — a port on the machine's own loopback, and an optional path — on
+ * any computer, a personal machine's included. Declaring one starts nothing.
+ *
+ * Who may: the owner and an `operate` grantee declare and withdraw; a `watch`
+ * grantee may list. The server decides (`ComputerAccess`), and so does the
+ * machine's daemon, against the grant set it holds.
+ *
+ * ## Inline path literals
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading these
+ * strings, so each one is written out here rather than assembled by a helper.
+ */
+export declare const DECLARED_SERVICE_PROTOCOLS: readonly ["http", "https"];
+export type DeclaredServiceProtocol = (typeof DECLARED_SERVICE_PROTOCOLS)[number];
+export type DeclaredServiceActor = {
+    kind: 'agent';
+    agentId: string;
+    sessionId: string;
+    label: string;
+} | {
+    kind: 'human';
+    userId: string;
+    label: string;
+};
+/** One declared service, as the machine's manifest carries it. */
+export interface DeclaredService {
+    name: string;
+    port: number;
+    path: string;
+    protocol: DeclaredServiceProtocol;
+    declaredBy: DeclaredServiceActor;
+    declaredAt: number;
+}
+export interface DeclaredServicesResult {
+    services: DeclaredService[];
+    service?: DeclaredService;
+    replaced?: boolean;
+    withdrawn?: DeclaredService;
+}
+/** Where a service opens: always the machine's own loopback. */
+export declare function declaredServiceAddress(service: Pick<DeclaredService, 'port' | 'path' | 'protocol'>): string;
+export declare function listMachineServices(machineId: string): Promise<DeclaredServicesResult>;
+export declare function declareMachineService(machineId: string, service: {
+    name: string;
+    port: number;
+    path?: string;
+    protocol?: DeclaredServiceProtocol;
+}): Promise<DeclaredServicesResult>;
+export declare function withdrawMachineService(machineId: string, name: string): Promise<DeclaredServicesResult>;
+/**
+ * The machine id a services command addresses. A machine the person owns
+ * resolves from their inventory by any of its names; a machine shared WITH
+ * them is not in that inventory, so a full machine id (`lease:…`,
+ * `daemon:…`, `machine:…`) is taken as written — the server decides access.
+ */
+export declare function servicesMachineId(ref: string): Promise<string>;

package/dist/lib/machine-services.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DECLARED_SERVICE_PROTOCOLS = void 0;
+exports.declaredServiceAddress = declaredServiceAddress;
+exports.listMachineServices = listMachineServices;
+exports.declareMachineService = declareMachineService;
+exports.withdrawMachineService = withdrawMachineService;
+exports.servicesMachineId = servicesMachineId;
+const api_fetch_1 = require("./api-fetch");
+const machines_1 = require("./machines");
+/**
+ * machine-services.ts — request client for `/api/machines/:machineId/services`
+ * (design §20.5; 9-17, OSK-13579): a machine's declared services, the web
+ * services an agent or a person started on it, named so the computer can open
+ * them in its own browser.
+ *
+ * Not the same thing as `skrr machines dedicated service`: those are always-on
+ * WORKLOADS a Dedicated Runtime keeps running. A declared service is an
+ * address — a port on the machine's own loopback, and an optional path — on
+ * any computer, a personal machine's included. Declaring one starts nothing.
+ *
+ * Who may: the owner and an `operate` grantee declare and withdraw; a `watch`
+ * grantee may list. The server decides (`ComputerAccess`), and so does the
+ * machine's daemon, against the grant set it holds.
+ *
+ * ## Inline path literals
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading these
+ * strings, so each one is written out here rather than assembled by a helper.
+ */
+exports.DECLARED_SERVICE_PROTOCOLS = ['http', 'https'];
+/** Where a service opens: always the machine's own loopback. */
+function declaredServiceAddress(service) {
+    return `${service.protocol}://localhost:${service.port}${service.path}`;
+}
+async function listMachineServices(machineId) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/services`);
+}
+async function declareMachineService(machineId, service) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/services`, { method: 'POST', body: { service } });
+}
+async function withdrawMachineService(machineId, name) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/services/${encodeURIComponent(name)}`, { method: 'DELETE' });
+}
+/**
+ * The machine id a services command addresses. A machine the person owns
+ * resolves from their inventory by any of its names; a machine shared WITH
+ * them is not in that inventory, so a full machine id (`lease:…`,
+ * `daemon:…`, `machine:…`) is taken as written — the server decides access.
+ */
+async function servicesMachineId(ref) {
+    try {
+        return (0, machines_1.resolveMachineRef)(await (0, machines_1.listMachines)(), ref).id;
+    }
+    catch (error) {
+        if (/^(lease|daemon|machine|stable-daemon):\S+$/.test(ref))
+            return ref;
+        throw error;
+    }
+}

package/dist/lib/task-view-render.d.ts

@@ -19,6 +19,8 @@ export interface TaskViewFilters {
     priorities?: string[];
     assignees?: string[];
     labels?: string[];
+    /** How `labels` combine; absent means `any`. */
+    labelMatch?: string;
     goalIds?: string[];
     projectIds?: string[];
     cycleIds?: string[];

package/dist/lib/task-view-render.js

@@ -113,7 +113,7 @@ function describeTaskView(view) {
         ['status types', f.statusTypes],
         ['priorities', f.priorities],
         ['assignees', f.assignees],
-        ['labels', f.labels],
+        [f.labelMatch === 'all' ? 'labels (all)' : 'labels (any)', f.labels],
         ['goals', f.goalIds],
         ['projects', f.projectIds],
         ['cycles', f.cycleIds],

package/dist/lib/views/vocabulary.d.ts

@@ -5,4 +5,4 @@
  * a re-export, not a second CLI vocabulary: adding a saved-view capability is
  * one data-provider registration followed by renderer work on each surface.
  */
-export { SPACE_RENDERABLE_VIEW_TYPES, TASK_VIEW_DEFAULT_GROUP_BY, TASK_VIEW_DEFAULT_TYPE, TASK_RENDERABLE_VIEW_TYPES, VIEW_GROUP_BY_REGISTRY, VIEW_GROUP_BY_VALUES, VIEW_QUICK_FILTER_REGISTRY, VIEW_QUICK_FILTERS, VIEW_SORT_DIRECTIONS, VIEW_SORT_KEY_REGISTRY, VIEW_SORT_KEYS, VIEW_TYPE_REGISTRY, VIEW_TYPES, viewTypesForSurface, } from '@skrr-ai/data-provider';
+export { SPACE_RENDERABLE_VIEW_TYPES, TASK_VIEW_DEFAULT_GROUP_BY, TASK_VIEW_DEFAULT_TYPE, TASK_RENDERABLE_VIEW_TYPES, VIEW_GROUP_BY_REGISTRY, VIEW_GROUP_BY_VALUES, VIEW_LABEL_MATCH_VALUES, VIEW_QUICK_FILTER_REGISTRY, VIEW_QUICK_FILTERS, VIEW_SORT_DIRECTIONS, VIEW_SORT_KEY_REGISTRY, VIEW_SORT_KEYS, VIEW_TYPE_REGISTRY, VIEW_TYPES, viewTypesForSurface, } from '@skrr-ai/data-provider';

package/dist/lib/views/vocabulary.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.viewTypesForSurface = exports.VIEW_TYPES = exports.VIEW_TYPE_REGISTRY = exports.VIEW_SORT_KEYS = exports.VIEW_SORT_KEY_REGISTRY = exports.VIEW_SORT_DIRECTIONS = exports.VIEW_QUICK_FILTERS = exports.VIEW_QUICK_FILTER_REGISTRY = exports.VIEW_GROUP_BY_VALUES = exports.VIEW_GROUP_BY_REGISTRY = exports.TASK_RENDERABLE_VIEW_TYPES = exports.TASK_VIEW_DEFAULT_TYPE = exports.TASK_VIEW_DEFAULT_GROUP_BY = exports.SPACE_RENDERABLE_VIEW_TYPES = void 0;
+exports.viewTypesForSurface = exports.VIEW_TYPES = exports.VIEW_TYPE_REGISTRY = exports.VIEW_SORT_KEYS = exports.VIEW_SORT_KEY_REGISTRY = exports.VIEW_SORT_DIRECTIONS = exports.VIEW_QUICK_FILTERS = exports.VIEW_QUICK_FILTER_REGISTRY = exports.VIEW_LABEL_MATCH_VALUES = exports.VIEW_GROUP_BY_VALUES = exports.VIEW_GROUP_BY_REGISTRY = exports.TASK_RENDERABLE_VIEW_TYPES = exports.TASK_VIEW_DEFAULT_TYPE = exports.TASK_VIEW_DEFAULT_GROUP_BY = exports.SPACE_RENDERABLE_VIEW_TYPES = void 0;
 /**
  * CLI parity re-export for persisted task views.
  *
@@ -15,6 +15,7 @@ Object.defineProperty(exports, "TASK_VIEW_DEFAULT_TYPE", { enumerable: true, get
 Object.defineProperty(exports, "TASK_RENDERABLE_VIEW_TYPES", { enumerable: true, get: function () { return data_provider_1.TASK_RENDERABLE_VIEW_TYPES; } });
 Object.defineProperty(exports, "VIEW_GROUP_BY_REGISTRY", { enumerable: true, get: function () { return data_provider_1.VIEW_GROUP_BY_REGISTRY; } });
 Object.defineProperty(exports, "VIEW_GROUP_BY_VALUES", { enumerable: true, get: function () { return data_provider_1.VIEW_GROUP_BY_VALUES; } });
+Object.defineProperty(exports, "VIEW_LABEL_MATCH_VALUES", { enumerable: true, get: function () { return data_provider_1.VIEW_LABEL_MATCH_VALUES; } });
 Object.defineProperty(exports, "VIEW_QUICK_FILTER_REGISTRY", { enumerable: true, get: function () { return data_provider_1.VIEW_QUICK_FILTER_REGISTRY; } });
 Object.defineProperty(exports, "VIEW_QUICK_FILTERS", { enumerable: true, get: function () { return data_provider_1.VIEW_QUICK_FILTERS; } });
 Object.defineProperty(exports, "VIEW_SORT_DIRECTIONS", { enumerable: true, get: function () { return data_provider_1.VIEW_SORT_DIRECTIONS; } });