@skrr-ai/cli 0.1.88 → 0.1.90

package/dist/commands/machines/computer-adoption.d.ts

@@ -1,8 +1,9 @@
 import { BaseCommand } from '../../base-command';
 /**
  * `skrr machines computer-adoption` — the share of daemons still on the old
- * event families, which is the number retiring `browser:liveview:*` and
- * `agent:terminal:*` waits on (OSK-13578). Admin only on the server: it
+ * event families, the number retiring `browser:liveview:*` and
+ * `agent:terminal:*` waited on (OSK-13578). They are retired (OSK-13509), so it
+ * now counts who the retirement stranded. Admin only on the server: it
  * describes the fleet, not the caller.
  */
 export default class MachinesComputerAdoption extends BaseCommand {

package/dist/commands/machines/computer-adoption.js

@@ -5,12 +5,13 @@ const base_command_1 = require("../../base-command");
 const computer_adoption_1 = require("../../lib/computer-adoption");
 /**
  * `skrr machines computer-adoption` — the share of daemons still on the old
- * event families, which is the number retiring `browser:liveview:*` and
- * `agent:terminal:*` waits on (OSK-13578). Admin only on the server: it
+ * event families, the number retiring `browser:liveview:*` and
+ * `agent:terminal:*` waited on (OSK-13578). They are retired (OSK-13509), so it
+ * now counts who the retirement stranded. Admin only on the server: it
  * describes the fleet, not the caller.
  */
 class MachinesComputerAdoption extends base_command_1.BaseCommand {
-    static description = 'Show how many daemons are still on the old browser live view / agent terminal event families instead of the computer protocol, and whether the retirement criterion is met (admin only)';
+    static description = 'Show how many daemons are still on the old browser live view / agent terminal event families (now retired) instead of the computer protocol, and the retirement criterion (admin only)';
     static examples = [
         '<%= config.bin %> machines computer-adoption',
         '<%= config.bin %> machines computer-adoption --json',

package/dist/commands/machines/dedicated/agent-browser.d.ts

@@ -0,0 +1,25 @@
+import { DedicatedLeaseCommand } from '../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated agent-browser` — do the agents on this machine get a
+ * browser? (OSK-13809)
+ *
+ * A new Dedicated Runtime gives its agents a browser by default; a machine
+ * created before that decision keeps what it had. This is the one switch for
+ * both directions, per machine: `--off` takes it away and it stays away across
+ * restarts, image updates and replacements; `--on` gives it to a machine that
+ * did not have it. Either change is written to the machine's audit record.
+ * With neither flag it prints the current setting.
+ */
+export default class DedicatedMachinesAgentBrowser extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        on: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        off: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/agent-browser.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const dedicated_machines_1 = require("../../../lib/dedicated-machines");
+/**
+ * `skrr machines dedicated agent-browser` — do the agents on this machine get a
+ * browser? (OSK-13809)
+ *
+ * A new Dedicated Runtime gives its agents a browser by default; a machine
+ * created before that decision keeps what it had. This is the one switch for
+ * both directions, per machine: `--off` takes it away and it stays away across
+ * restarts, image updates and replacements; `--on` gives it to a machine that
+ * did not have it. Either change is written to the machine's audit record.
+ * With neither flag it prints the current setting.
+ */
+class DedicatedMachinesAgentBrowser extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Show or change whether the agents on a Dedicated Runtime get a browser. On by default for new machines; --off turns it off for this machine and it stays off.';
+    static examples = [
+        '<%= config.bin %> machines dedicated agent-browser <lease-id>',
+        '<%= config.bin %> machines dedicated agent-browser <lease-id> --off',
+        '<%= config.bin %> machines dedicated agent-browser <lease-id> --on --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        on: core_1.Flags.boolean({
+            description: "Give this machine's agents a browser. Recorded in the machine's audit record.",
+            exclusive: ['off'],
+        }),
+        off: core_1.Flags.boolean({
+            description: "Take the browser away from this machine's agents. Stays off until you turn it on. Recorded in the machine's audit record.",
+            exclusive: ['on'],
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesAgentBrowser);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const scope = this.scopeFrom(flags);
+        const wantsChange = flags.on || flags.off;
+        const response = await this.callDedicated(() => wantsChange
+            ? (0, dedicated_machines_1.setDedicatedRuntimeAgentBrowser)(leaseId, Boolean(flags.on), scope)
+            : (0, dedicated_machines_1.getDedicatedRuntimeAgentBrowser)(leaseId, scope));
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        this.log(`Agent browser on ${response.leaseId || leaseId}: ${(0, dedicated_machines_1.describeDedicatedAgentBrowser)(response, leaseId)}`);
+        if (wantsChange && response.changed === false) {
+            this.log('  Already set that way; nothing changed.');
+        }
+        else if (wantsChange && response.effectiveOnNextReconnect && response.offered === null) {
+            // The line above already names the restart when a daemon is connected.
+            this.log(`  Applies when the machine's daemon next reconnects; \`skrr machines dedicated restart ${leaseId}\` makes that now.`);
+        }
+    }
+}
+exports.default = DedicatedMachinesAgentBrowser;

package/dist/commands/machines/dedicated/exec.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveDedicatedExecCommand = resolveDedicatedExecCommand;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../../base-command");
+const api_fetch_1 = require("../../../lib/api-fetch");
 const shell_quote_1 = require("../../../lib/shell-quote");
 const hosted_machines_1 = require("../../../lib/hosted-machines");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
@@ -144,23 +145,68 @@ class DedicatedMachinesExec extends base_command_1.BaseCommand {
         if (timeoutMs !== undefined && timeoutMs > dedicated_machines_1.DEDICATED_EXEC_MAX_TIMEOUT_MS) {
             this.error(`--timeout is at most ${dedicated_machines_1.DEDICATED_EXEC_MAX_TIMEOUT_MS / 60000}m. For longer work, start it in the background (nohup … &) or give it to an agent.`, { exit: 2 });
         }
+        // A stopped machine that this command woke answers "starting" until it is ready. That is a normal
+        // moment, not a failure: say so once, wait it out (bounded), and run the command.
+        const WAKE_CODE_STARTING = 'DEDICATED_RUNTIME_STARTING';
+        const WAKE_WAIT_BOUND_MS = 180_000;
+        const wakeStartedAt = Date.now();
+        let announcedWake = false;
         let result;
-        try {
-            result = await (0, dedicated_exec_1.runDedicatedExec)(id, { command, ...(flags.cwd ? { cwd: flags.cwd } : {}), ...(timeoutMs ? { timeoutMs } : {}) }, { workspaceId: flags.workspace, ...(requestId ? { requestId } : {}) });
-        }
-        catch (err) {
-            if (err instanceof dedicated_exec_1.DedicatedExecContactLostError ||
-                err instanceof dedicated_exec_1.DedicatedExecStartUnconfirmedError ||
-                err instanceof dedicated_exec_1.DedicatedExecIdempotencyUnsupportedError) {
-                this.error(err.message, { exit: 1, code: err.code });
+        for (;;) {
+            try {
+                result = await (0, dedicated_exec_1.runDedicatedExec)(id, {
+                    command,
+                    ...(flags.cwd ? { cwd: flags.cwd } : {}),
+                    ...(timeoutMs ? { timeoutMs } : {}),
+                }, { workspaceId: flags.workspace, ...(requestId ? { requestId } : {}) });
+                break;
             }
-            // Keep the API status, request id and explicit retry decision together.
-            if ((0, base_command_1.apiRefusal)(err).body?.retryable === true)
+            catch (err) {
+                const refusal = (0, base_command_1.apiRefusal)(err);
+                if (refusal.code === WAKE_CODE_STARTING) {
+                    if (Date.now() - wakeStartedAt > WAKE_WAIT_BOUND_MS) {
+                        this.error(`${id} is still starting after ${Math.round(WAKE_WAIT_BOUND_MS / 1000)}s. Nothing was run. Check it with \`${this.config.bin} machines dedicated show ${id}\` and run the command again.`, { exit: 1, code: WAKE_CODE_STARTING });
+                    }
+                    if (!announcedWake && !flags.json) {
+                        // The API masks a 503's `message`; the sentence lives in details.wake.detail.
+                        const wake = refusal.body?.details
+                            ?.wake;
+                        const sentence = typeof wake?.detail === 'string' && wake.detail ? wake.detail : `${id} is starting.`;
+                        process.stderr.write(`${sentence} Waiting for it, then running your command…\n`);
+                        announcedWake = true;
+                    }
+                    const retryAfter = Number(refusal.body?.retryAfterSeconds);
+                    const waitMs = Math.min(Math.max(Number.isFinite(retryAfter) ? retryAfter * 1000 : 5000, 2000), 10_000);
+                    await new Promise((resolve) => setTimeout(resolve, waitMs));
+                    continue;
+                }
+                if (err instanceof dedicated_exec_1.DedicatedExecContactLostError ||
+                    err instanceof dedicated_exec_1.DedicatedExecStartUnconfirmedError ||
+                    err instanceof dedicated_exec_1.DedicatedExecIdempotencyUnsupportedError) {
+                    this.error(err.message, { exit: 1, code: err.code });
+                }
+                // The other wake outcomes (stopping, refused, timed out) carry their sentence as `message` and no
+                // `error`, which the generic handler does not read ("An unexpected error occurred"). Print it, and
+                // keep the status and the retry decision with it.
+                if (refusal.code?.startsWith('DEDICATED_RUNTIME_') &&
+                    refusal.message &&
+                    !refusal.body?.error) {
+                    this.failWithCliError({
+                        message: refusal.message,
+                        code: refusal.code,
+                        status: err instanceof api_fetch_1.ApiFetchError ? err.status : undefined,
+                        exit: 1,
+                        retryable: refusal.body?.retryable === true,
+                    });
+                }
+                // Keep the API status, request id and explicit retry decision together.
+                if ((0, base_command_1.apiRefusal)(err).body?.retryable === true)
+                    this.handleApiError(err);
+                const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
+                if (message)
+                    this.error(message, { exit: 1, code: (0, dedicated_machines_1.dedicatedRuntimeApiErrorCode)(err) });
                 this.handleApiError(err);
-            const message = (0, dedicated_machines_1.formatDedicatedRuntimeApiError)(err);
-            if (message)
-                this.error(message, { exit: 1, code: (0, dedicated_machines_1.dedicatedRuntimeApiErrorCode)(err) });
-            this.handleApiError(err);
+            }
         }
         if (flags.json) {
             this.log(JSON.stringify(result, null, 2));

package/dist/commands/machines/dedicated/index.js

@@ -33,6 +33,7 @@ class DedicatedMachines extends core_1.Command {
         '<%= config.bin %> machines dedicated snapshot <lease-id> --wait',
         '<%= config.bin %> machines dedicated grow <lease-id> --storage-gb 200',
         '<%= config.bin %> machines dedicated spending-limit <lease-id> --cents 30000',
+        '<%= config.bin %> machines dedicated power set <lease-id> --policy manual',
         '<%= config.bin %> machines dedicated health-check <lease-id>',
         '<%= config.bin %> machines dedicated incident-close <lease-id>',
         '<%= config.bin %> machines dedicated service create <lease-id> --name worker -- node dist/worker.js',
@@ -41,6 +42,7 @@ class DedicatedMachines extends core_1.Command {
     ];
     async run() {
         const rows = [
+            ['power', 'when the machine may stop and start by itself (set)'],
             ['catalog', 'sizes, storage bounds and prices create accepts'],
             ['create', 'request a Dedicated Runtime'],
             ['list', 'list Dedicated Runtime leases'],

package/dist/commands/machines/dedicated/power/explain.d.ts

@@ -0,0 +1,13 @@
+import { DedicatedLeaseCommand } from '../../../../lib/dedicated-lease-command';
+/** `skrr machines dedicated power explain` — the latest PowerDecision, with the fix last. */
+export default class DedicatedMachinesPowerExplain extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/power/explain.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../../lib/dedicated-lease-command");
+const dedicated_power_1 = require("../../../../lib/dedicated-power");
+/** `skrr machines dedicated power explain` — the latest PowerDecision, with the fix last. */
+class DedicatedMachinesPowerExplain extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Explain why a Dedicated Runtime stayed on, stopped or woke: the latest decision, its gate and reason, and what you can do next. Read-only.';
+    static examples = [
+        '<%= config.bin %> machines dedicated power explain <lease-id>',
+        '<%= config.bin %> machines dedicated power explain self --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesPowerExplain);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const summary = await this.callDedicated(() => (0, dedicated_power_1.getDedicatedPowerSummary)(leaseId, this.scopeFrom(flags)));
+        if (flags.json) {
+            this.log(JSON.stringify(summary, null, 2));
+            return;
+        }
+        for (const line of (0, dedicated_power_1.describePowerExplanation)(summary))
+            this.log(line);
+    }
+}
+exports.default = DedicatedMachinesPowerExplain;

package/dist/commands/machines/dedicated/power/index.d.ts

@@ -0,0 +1,10 @@
+import { Command } from '@oclif/core';
+/**
+ * `skrr machines dedicated power` — when a Dedicated Runtime may stop and start
+ * on its own. `set` is the standing policy; more verbs arrive with the power card.
+ */
+export default class DedicatedMachinesPower extends Command {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/power/index.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+/**
+ * `skrr machines dedicated power` — when a Dedicated Runtime may stop and start
+ * on its own. `set` is the standing policy; more verbs arrive with the power card.
+ */
+class DedicatedMachinesPower extends core_1.Command {
+    static description = 'Power policy of a Dedicated Runtime — when it may stop and start on its own. Files are preserved across stops.\n\nSubcommands:\n  show        state, policy, holders, usage, next wake\n  explain     why it stayed on, stopped or woke, and the fix\n  set         always_on | on_demand | manual (+ --idle-after, --budget-hours)\n  keep-awake  --for <duration> | --until <iso> | --clear';
+    static examples = [
+        '<%= config.bin %> machines dedicated power set <lease-id> --policy manual',
+        '<%= config.bin %> machines dedicated power set <lease-id> --policy on_demand --idle-after 60',
+    ];
+    async run() {
+        this.log('skrr machines dedicated power commands:');
+        this.log('  skrr machines dedicated power show      state, policy, holders, usage, next wake');
+        this.log('  skrr machines dedicated power explain   why it stayed on, stopped or woke, and the fix');
+        this.log('  skrr machines dedicated power set   always_on | on_demand | manual (+ --idle-after)');
+        this.log('  skrr machines dedicated power keep-awake   --for <duration> | --until <iso> | --clear');
+        this.log('');
+        this.log('Every command takes a lease id (or `self` on the machine) and --json.');
+    }
+}
+exports.default = DedicatedMachinesPower;

package/dist/commands/machines/dedicated/power/keep-awake.d.ts

@@ -0,0 +1,20 @@
+import { DedicatedLeaseCommand } from '../../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated power keep-awake` — a temporary override that forbids
+ * AUTOMATIC stop. It is not a policy, it expires by itself, and it never starts a
+ * machine (on a stopped machine it means "do not auto-stop once running").
+ */
+export default class DedicatedMachinesPowerKeepAwake extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        for: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        until: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        clear: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/power/keep-awake.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../../lib/dedicated-lease-command");
+const dedicated_keep_awake_1 = require("../../../../lib/dedicated-keep-awake");
+/**
+ * `skrr machines dedicated power keep-awake` — a temporary override that forbids
+ * AUTOMATIC stop. It is not a policy, it expires by itself, and it never starts a
+ * machine (on a stopped machine it means "do not auto-stop once running").
+ */
+class DedicatedMachinesPowerKeepAwake extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Keep a Dedicated Runtime from stopping on its own for a while: --for 2h, --until <iso> or --clear. It expires by itself, never starts the machine and does not change the power policy. Files are preserved across stops.';
+    static examples = [
+        '<%= config.bin %> machines dedicated power keep-awake <lease-id> --for 2h',
+        '<%= config.bin %> machines dedicated power keep-awake <lease-id> --until 2026-10-10T18:00:00Z',
+        '<%= config.bin %> machines dedicated power keep-awake <lease-id> --clear --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        for: core_1.Flags.string({
+            description: 'How long, such as 90m, 2h or 3d (5 minutes to 7 days). A bare number is minutes.',
+            exclusive: ['until', 'clear'],
+        }),
+        until: core_1.Flags.string({
+            description: 'Keep awake until this ISO 8601 date (5 minutes to 7 days from now).',
+            exclusive: ['for', 'clear'],
+        }),
+        clear: core_1.Flags.boolean({
+            description: 'Cancel keep-awake so the machine follows its power policy again.',
+            exclusive: ['for', 'until'],
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesPowerKeepAwake);
+        if (!flags.for && !flags.until && !flags.clear) {
+            this.error('Choose --for <duration>, --until <iso-date> or --clear.', { exit: 2 });
+        }
+        let request = null;
+        try {
+            if (flags.for)
+                request = { forMinutes: (0, dedicated_keep_awake_1.parseKeepAwakeDuration)(flags.for) };
+            else if (flags.until)
+                request = { until: (0, dedicated_keep_awake_1.parseKeepAwakeUntil)(flags.until) };
+        }
+        catch (err) {
+            this.error(err.message, { exit: 2 });
+        }
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const scope = this.scopeFrom(flags);
+        const response = await this.callDedicated(() => request
+            ? (0, dedicated_keep_awake_1.setDedicatedKeepAwake)(leaseId, request, scope)
+            : (0, dedicated_keep_awake_1.clearDedicatedKeepAwake)(leaseId, scope));
+        if (flags.json) {
+            this.log(JSON.stringify({ ok: true, ...response }, null, 2));
+            return;
+        }
+        this.log(`Dedicated Runtime ${response.leaseId} ${(0, dedicated_keep_awake_1.describeKeepAwake)(response.keepAwake)}.`);
+        this.log('Nothing was started or stopped.');
+    }
+}
+exports.default = DedicatedMachinesPowerKeepAwake;

package/dist/commands/machines/dedicated/power/set.d.ts

@@ -0,0 +1,23 @@
+import { DedicatedLeaseCommand } from '../../../../lib/dedicated-lease-command';
+/**
+ * `skrr machines dedicated power set` — the standing power policy.
+ *
+ * Changing the policy starts and stops nothing; it records what the platform may
+ * do on its own from now on. Machines that never had a policy set stay
+ * `always_on`.
+ */
+export default class DedicatedMachinesPowerSet extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        policy: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'idle-after': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'budget-hours': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'no-budget': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/power/set.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const dedicated_lease_command_1 = require("../../../../lib/dedicated-lease-command");
+const dedicated_power_1 = require("../../../../lib/dedicated-power");
+/**
+ * `skrr machines dedicated power set` — the standing power policy.
+ *
+ * Changing the policy starts and stops nothing; it records what the platform may
+ * do on its own from now on. Machines that never had a policy set stay
+ * `always_on`.
+ */
+class DedicatedMachinesPowerSet extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Set when a Dedicated Runtime may stop and start on its own: always_on, on_demand or manual. Changing the policy starts and stops nothing. Files are preserved across stops.';
+    static examples = [
+        '<%= config.bin %> machines dedicated power set <lease-id> --policy manual',
+        '<%= config.bin %> machines dedicated power set <lease-id> --policy on_demand --idle-after 60',
+        '<%= config.bin %> machines dedicated power set <lease-id> --budget-hours 200',
+        '<%= config.bin %> machines dedicated power set <lease-id> --no-budget',
+        '<%= config.bin %> machines dedicated power set self --policy always_on --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        policy: core_1.Flags.string({
+            description: 'always_on: never stops by itself (default). on_demand: stops when idle, starts when work arrives. manual: only you start and stop it.',
+            options: [...data_provider_1.DEDICATED_POWER_POLICIES],
+        }),
+        'idle-after': core_1.Flags.integer({
+            description: `Minutes idle before an on_demand machine stops (${data_provider_1.DEDICATED_POWER_IDLE_AFTER_MINUTES_MIN}-${data_provider_1.DEDICATED_POWER_IDLE_AFTER_MINUTES_MAX}). on_demand only.`,
+            min: data_provider_1.DEDICATED_POWER_IDLE_AFTER_MINUTES_MIN,
+            max: data_provider_1.DEDICATED_POWER_IDLE_AFTER_MINUTES_MAX,
+        }),
+        'budget-hours': core_1.Flags.string({
+            description: `Hard monthly compute-hour budget (greater than 0, at most ${data_provider_1.DEDICATED_POWER_BUDGET_HOURS_MAX}). At the budget, automatic starts are refused until the month resets or you raise it. A running machine is never stopped by it, and your own start is never blocked.`,
+            exclusive: ['no-budget'],
+        }),
+        'no-budget': core_1.Flags.boolean({
+            description: 'Remove the monthly compute-hour budget (no limit).',
+            exclusive: ['budget-hours'],
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesPowerSet);
+        let budget;
+        if (flags['no-budget'])
+            budget = null;
+        else if (flags['budget-hours'] !== undefined) {
+            const raw = flags['budget-hours'].trim();
+            budget = /^\d+(\.\d+)?$/.test(raw) ? Number(raw) : Number.NaN;
+            if (!(budget > 0) || budget > data_provider_1.DEDICATED_POWER_BUDGET_HOURS_MAX) {
+                this.error(`--budget-hours must be a number greater than 0 and at most ${data_provider_1.DEDICATED_POWER_BUDGET_HOURS_MAX}. Use --no-budget to remove the budget.`, { exit: 2 });
+            }
+        }
+        if (flags.policy === undefined && flags['idle-after'] === undefined && budget === undefined) {
+            this.error('Nothing to change. Pass --policy <always_on|on_demand|manual>, --idle-after <minutes> (on_demand only), or --budget-hours <n> / --no-budget.', { exit: 2 });
+        }
+        if (flags['idle-after'] !== undefined &&
+            flags.policy !== undefined &&
+            flags.policy !== 'on_demand') {
+            this.error('--idle-after applies to --policy on_demand only.', { exit: 2 });
+        }
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const outcome = await this.callDedicated(() => (0, dedicated_power_1.setDedicatedPowerPolicy)(leaseId, {
+            ...(flags.policy ? { policy: flags.policy } : {}),
+            ...(flags['idle-after'] !== undefined ? { idleAfterMinutes: flags['idle-after'] } : {}),
+            ...(budget !== undefined ? { budgetHoursPerMonth: budget } : {}),
+        }, this.scopeFrom(flags)));
+        if (!outcome.ok) {
+            const { refusal } = outcome;
+            if (flags.json) {
+                this.log(JSON.stringify({ ok: false, ...refusal }, null, 2));
+            }
+            else {
+                this.log(`on_demand is not available for ${leaseId}: ${refusal.reason}`);
+                this.log(`  ${refusal.detail}`);
+                this.log(`  Fix: ${refusal.fix}`);
+                this.log('  The power policy was not changed.');
+            }
+            this.exit(1);
+        }
+        const { response } = outcome;
+        if (flags.json) {
+            this.log(JSON.stringify({ ok: true, ...response }, null, 2));
+            return;
+        }
+        const verb = response.changed ? 'set to' : 'already';
+        // Whether anything will actually stop the machine depends on the platform, not on this write: ask, so
+        // the sentence below is true. Best effort: a failed read leaves the neutral wording.
+        const autoStopMode = await (0, dedicated_power_1.getDedicatedPowerSummary)(leaseId, this.scopeFrom(flags))
+            .then((summary) => summary.autoStopMode)
+            .catch(() => undefined);
+        this.log(`Dedicated Runtime ${response.leaseId} power policy ${verb} ${(0, dedicated_power_1.describePowerPolicy)(response.power, autoStopMode)}.`);
+        this.log((0, dedicated_power_1.describeBudget)(response.power));
+        this.log('Nothing was started or stopped.');
+    }
+}
+exports.default = DedicatedMachinesPowerSet;

package/dist/commands/machines/dedicated/power/show.d.ts

@@ -0,0 +1,13 @@
+import { DedicatedLeaseCommand } from '../../../../lib/dedicated-lease-command';
+/** `skrr machines dedicated power show` — the read-only power card. */
+export default class DedicatedMachinesPowerShow extends DedicatedLeaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        lease: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/machines/dedicated/power/show.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const dedicated_lease_command_1 = require("../../../../lib/dedicated-lease-command");
+const dedicated_power_1 = require("../../../../lib/dedicated-power");
+/** `skrr machines dedicated power show` — the read-only power card. */
+class DedicatedMachinesPowerShow extends dedicated_lease_command_1.DedicatedLeaseCommand {
+    static description = 'Show a Dedicated Runtime power state: policy, why it is on or off, who is holding it, this month hours and cost, and the next expected wake. Read-only.';
+    static examples = [
+        '<%= config.bin %> machines dedicated power show <lease-id>',
+        '<%= config.bin %> machines dedicated power show self --json',
+    ];
+    static args = {
+        lease: core_1.Args.string({
+            description: dedicated_lease_command_1.DEDICATED_LEASE_ARG_DESCRIPTION,
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(DedicatedMachinesPowerShow);
+        const leaseId = await this.resolveLeaseArg(args.lease);
+        const summary = await this.callDedicated(() => (0, dedicated_power_1.getDedicatedPowerSummary)(leaseId, this.scopeFrom(flags)));
+        if (flags.json) {
+            this.log(JSON.stringify(summary, null, 2));
+            return;
+        }
+        for (const line of (0, dedicated_power_1.describePowerSummary)(summary))
+            this.log(line);
+    }
+}
+exports.default = DedicatedMachinesPowerShow;

package/dist/commands/machines/dedicated/show.js

@@ -6,7 +6,7 @@ const daemon_installer_1 = require("../../../lib/daemon-installer");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
 const harnesses_1 = require("../../../lib/harnesses");
 class DedicatedMachinesShow extends dedicated_lease_command_1.DedicatedLeaseCommand {
-    static description = 'Show one Dedicated Runtime lease: state, size, workspace, spend against the cap, health, deletion clock and the engines its daemon registered';
+    static description = 'Show one Dedicated Runtime lease: state, size, workspace, spend against the cap, health, deletion clock, whether its agents get a browser, and the engines its daemon registered';
     static examples = [
         '<%= config.bin %> machines dedicated show <lease-id>',
         '<%= config.bin %> machines dedicated show <lease-id> --json',
@@ -47,6 +47,17 @@ class DedicatedMachinesShow extends dedicated_lease_command_1.DedicatedLeaseComm
         // which is what `skrrd update --check` on the machine reports (OSK-12153).
         // Best-effort: an unreachable feed is said, never read as "none newer".
         const latestDaemonRelease = lease.health?.image ? await readLatestDaemonRelease() : null;
+        // Whether the agents on this machine get a browser (OSK-13809). Its own
+        // route, because the setting lives on the machine's allow-list, not the
+        // lease. Best-effort like the reads above, and an unreadable answer is
+        // printed as unknown, never as off.
+        let agentBrowser;
+        try {
+            agentBrowser = await (0, dedicated_machines_1.getDedicatedRuntimeAgentBrowser)(leaseId, this.scopeFrom(flags));
+        }
+        catch (err) {
+            agentBrowser = { error: err?.message || 'unreadable' };
+        }
         if (flags.json) {
             const engines = (0, dedicated_machines_1.dedicatedLeaseHarnesses)(lease, harnesses).map((harness) => ({
                 harnessId: harness._id,
@@ -57,11 +68,15 @@ class DedicatedMachinesShow extends dedicated_lease_command_1.DedicatedLeaseComm
             this.log(JSON.stringify({
                 ...response,
                 harnesses: engines,
+                agentBrowser,
                 ...(latestDaemonRelease ? { latestDaemonRelease } : {}),
             }, null, 2));
             return;
         }
-        for (const line of (0, dedicated_machines_1.describeDedicatedLease)(lease, harnesses, { latestDaemonRelease })) {
+        for (const line of (0, dedicated_machines_1.describeDedicatedLease)(lease, harnesses, {
+            latestDaemonRelease,
+            agentBrowser,
+        })) {
             this.log(line);
         }
     }