aspera-cli 4.27.3 → 4.27.5

data/lib/aspera/agent/direct.rb

@@ -107,8 +107,6 @@ module Aspera
         @sessions = []
         # mutex protects global data accessed by threads
         @mutex = Mutex.new
-        @pre_calc_sent = false
-        @pre_calc_last_size = nil
         # Check on all management messages if that file exists, and if so, read commands from it
         @command_file = File.join(config_dir || '.', "send_#{$PROCESS_ID}")
       end
@@ -164,6 +162,11 @@ module Aspera
           error:             nil,               # exception if failed
           io:                nil,               # management port server socket
           token_regenerator: token_regenerator, # regenerate bearer token with oauth
+          progress_id:       nil,               # session identifier for progress, one per `ascp` process, same on resume
+          size_sent:         false,             # `true` when total size was notified (PreTransferBytes)
+          last_size:         nil,               # last notified transferred size
+          skipped:           0,                 # size of whole files already at destination
+          last_skipped:      nil,               # last notified size not transferred (already at destination)
           # env vars and args for ascp (from transfer spec)
           exec_spec:         Transfer::Parameters.new(transfer_spec, **@tr_opts).ascp_args
         }
@@ -210,7 +213,6 @@ module Aspera
           session[:thread].join
           result.push(session[:error] || :success)
         end
-        notify_progress(:end)
         Log.log.debug('all transfers joined')
         # since all are finished and we return the result, clear statuses
         @sessions.clear
@@ -347,7 +349,7 @@ module Aspera
             # store session identifier
             session[:id] = event['SessionId'] if event['Type'].eql?('INIT')
             @management_cb&.call(event)
-            process_progress(event)
+            process_progress(session, event)
             next unless File.exist?(@command_file)
             begin
               commands = JSON.parse(File.read(@command_file))
@@ -373,7 +375,9 @@ module Aspera
               env['ASPERA_SCP_TOKEN'] = session[:token_regenerator].refreshed_transfer_token
             end
             raise Transfer::Error.new(last_event['Description'], code: last_event['Code'].to_i)
-          else Aspera.error_unexpected_value(last_event['Type'], :error) { 'last event type' }
+          else
+            # e.g. process was killed: like a lost connection (code 16), so that transfer is resumed
+            raise Transfer::Error.new("#{exec} ended without final status (last event: #{last_event['Type']})", code: 16)
           end
         rescue SystemCallError => e
           # Process.spawn failed, or socket error
@@ -418,39 +422,63 @@ module Aspera
       attr_reader :sessions
 
       # Notify progress to callback
-      # @param event [Hash] management port event
-      def process_progress(event)
-        session_id = event['SessionId']
+      # @param session [Hash] This session information, progress state is stored in it
+      # @param event   [Hash] management port event
+      def process_progress(session, event)
+        # Not the `ascp` session id: must be the same when session is resumed
+        progress_id = session[:progress_id] ||= SecureRandom.uuid
         case event['Type']
         when 'INIT'
-          @pre_calc_sent = false
-          @pre_calc_last_size = nil
-          notify_progress(:session_start, session_id: session_id)
+          session[:size_sent] = false
+          session[:last_size] = nil
+          session[:skipped] = 0
+          session[:last_skipped] = nil
+          notify_progress(:session_start, session_id: progress_id)
         when 'NOTIFICATION' # sent from remote
           if event.key?('PreTransferBytes')
-            @pre_calc_sent = true
-            notify_progress(:session_size, session_id: session_id, info: event['PreTransferBytes'])
+            session[:size_sent] = true
+            notify_progress(:session_size, session_id: progress_id, info: event['PreTransferBytes'])
           end
         when 'STATS' # during transfer
-          @pre_calc_last_size = event['TransferBytes'].to_i + event['StartByte'].to_i
-          notify_progress(:transfer, session_id: session_id, info: @pre_calc_last_size)
+          notify_transferred(session, event)
+        when 'STOP' # one file is completed
+          size = event['Size'].to_i
+          # Whole file already at destination (resume): not transferred, and not in `FileBytes`.
+          # Note: in multi-session, each session notifies all such files: progress bar limits progress to size of session.
+          session[:skipped] += size if size.positive? && event['StartByte'].to_i.eql?(size)
+          notify_transferred(session, event)
         when 'DONE', 'ERROR' # end of session
-          total_size = event['TransferBytes'].to_i + event['StartByte'].to_i
-          notify_progress(:session_size, session_id: session_id, info: total_size) if !@pre_calc_sent && !total_size.zero?
-          notify_progress(:transfer, session_id: session_id, info: total_size) if @pre_calc_last_size != total_size
-          notify_progress(:session_end, session_id: session_id)
+          notify_transferred(session, event)
+          total_size = session[:last_size] + session[:last_skipped]
+          notify_progress(:session_size, session_id: progress_id, info: total_size) if !session[:size_sent] && !total_size.zero?
+          notify_progress(:session_end, session_id: progress_id)
           # cspell:disable
         when 'SESSION'
         when 'ARGSTOP'
         when 'FILEERROR'
           Log.log.error { "#{event['Type']} #{event['Description']}" }
-        when 'STOP'
           # cspell:enable
-          # stop event when one file is completed
         else
           Log.log.debug { "Unknown event type for progress: #{event['Type']}" }
         end
       end
+
+      # Notify transferred size, and size not transferred because already at destination (resume), if changed
+      # @param session [Hash] This session information, progress state is stored in it
+      # @param event   [Hash] management port event, with `TransferBytes` and `FileBytes`
+      def notify_transferred(session, event)
+        transferred = event['TransferBytes'].to_i
+        # `FileBytes` also includes the part of files already at destination.
+        # Note: `StartByte` is not used: in multi-session, it is the offset of the part of file transferred by the session.
+        skipped = session[:skipped] + [event['FileBytes'].to_i - transferred, 0].max
+        if session[:last_skipped] != skipped
+          session[:last_skipped] = skipped
+          notify_progress(:skip, session_id: session[:progress_id], info: skipped)
+        end
+        return if session[:last_size].eql?(transferred)
+        session[:last_size] = transferred
+        notify_progress(:transfer, session_id: session[:progress_id], info: transferred)
+      end
     end
   end
 end

data/lib/aspera/agent/node.rb

@@ -38,6 +38,9 @@ module Aspera
             result['ended_at'] = Time.now.utc.iso8601
           when 'failed'
             result.merge!('status' => 'failed', 'ended_at' => Time.now.utc.iso8601, 'error' => data['error_desc'].to_s)
+          when 'canceled'
+            result['status'] = 'cancelled'
+            result['ended_at'] = Time.now.utc.iso8601
           else
             result['status'] = 'running'
           end
@@ -109,7 +112,7 @@ module Aspera
           # status is empty sometimes with status 200...
           transfer_data = node_api_.read("ops/transfers/#{@transfer_id}") || {'status' => 'unknown'} rescue {'status' => 'waiting(api error)'}
           case transfer_data['status']
-          when 'waiting', 'partially_completed', 'unknown', 'waiting(read error)', 'waiting(api error)'
+          when 'waiting', 'partially_completed', 'paused', 'unknown', 'waiting(read error)', 'waiting(api error)'
             notify_progress(:sessions_init, info: transfer_data['status'])
           when 'running'
             if !session_started
@@ -129,13 +132,11 @@ module Aspera
           when 'completed'
             notify_progress(:transfer, session_id: @transfer_id, info: bytes_expected) if bytes_expected
             notify_progress(:session_end, session_id: @transfer_id)
-            notify_progress(:end)
             break
-          when 'failed'
+          when 'failed', 'canceled'
             notify_progress(:session_end, session_id: @transfer_id)
-            notify_progress(:end)
             # Bug in HSTS ? transfer is marked failed, but there is no reason
-            break if transfer_data['error_code'].eql?(0) && transfer_data['error_desc'].empty?
+            break if transfer_data['status'].eql?('failed') && transfer_data['error_code'].eql?(0) && transfer_data['error_desc'].empty?
             raise Transfer::Error, "status: #{transfer_data['status']}. code: #{transfer_data['error_code']}. description: #{transfer_data['error_desc']}"
           else Aspera.error_unexpected_value(transfer_data['status']) { "transfer_data -> #{transfer_data}" }
           end

data/lib/aspera/agent/transferd.rb

@@ -140,6 +140,8 @@ module Aspera
 
       # Actual endpoint the daemon is listening on (resolved after connect, e.g. when port 0 was used)
       attr_reader :daemon_endpoint
+      # gRPC client of the daemon
+      attr_reader :transfer_client
 
       # :reek:UnusedParameters token_regenerator
       def start_transfer(transfer_spec, token_regenerator: nil)
@@ -181,11 +183,9 @@ module Aspera
           when :COMPLETED
             notify_progress(:transfer, session_id: @transfer_id, info: bytes_expected) if bytes_expected
             notify_progress(:session_end, session_id: @transfer_id)
-            notify_progress(:end)
             break
           when :FAILED, :CANCELED
             notify_progress(:session_end, session_id: @transfer_id)
-            notify_progress(:end)
             raise Transfer::Error, JSON.parse(response.message)['Description']
           when :QUEUED, :UNKNOWN_STATUS, :PAUSED, :ORPHANED
             notify_progress(:sessions_init, info: response.status.to_s.downcase)

data/lib/aspera/api/faspex.rb

@@ -138,6 +138,7 @@ module Aspera
           SENT_MAILBOX_TYPES.include?(box) || box == 'ALL' ? :sent : :received
         end
       end
+      # @return [Hash, nil] public link context decoded from URL (keys: resource, type, id, passcode, package_id, email), or nil if not a public link
       attr_reader :pub_link_context
 
       # @param url            [String] Faspex URL, can be a public link
@@ -163,6 +164,7 @@ module Aspera
         passphrase: nil
       )
         auth = :public_link if self.class.public_link?(url)
+        # @type [Hash, nil]
         @pub_link_context = nil
         super(**
           case auth

data/lib/aspera/api/httpgw.rb

@@ -254,12 +254,11 @@ module Aspera
         # session no more used
         @ws_io = nil
         http_session&.finish
-        @notify_cb&.call(:end)
       end
 
       def download(transfer_spec)
         transfer_spec['source_root'] ||= '/'
-        default_file_name = transfer_spec['paths'].first['source']
+        default_file_name = transfer_spec['paths'].first&.fetch('source')
         source_is_folder = %w[. /].include?(default_file_name)
         default_file_name = 'http_download' if source_is_folder
         transfer_spec['zip_required'] ||= source_is_folder || transfer_spec['paths'].length > 1

data/lib/aspera/api/node.rb

@@ -457,7 +457,7 @@ module Aspera
         create(
           'files/download_setup',
           {transfer_requests: [{transfer_request: {paths: [{source: '/'}]}}]}
-        )['transfer_specs'].first['transfer_spec']
+        )['transfer_specs'].first&.fetch('transfer_spec')
       end
 
       # Get generic part of transfer spec with transport parameters only
@@ -617,8 +617,8 @@ module Aspera
       # Method called in loop for each entry for `resolve_api_fid`
       # @return [Boolean] `true` to continue digging, `false` to stop processing: set state[:result] if found
       def process_api_fid(entry, path, state)
-        # Stop digging here if not in right path
-        return false unless entry['name'].eql?(state[:path].first)
+        # Stop digging here if already found, or if not the next path element directly under the consumed path (not a sibling)
+        return false if state[:path].empty? || !path.eql?(File.join(PATH_SEPARATOR, *state[:consumed], state[:path].first))
         # Ok it matches, so we remove the match, and continue digging
         state[:consumed].push(state[:path].shift)
         path_fully_consumed = state[:path].empty?

data/lib/aspera/ascp/installation.rb

@@ -311,8 +311,8 @@ module Aspera
           archive_io.write(File.binread(UriReader.file_path(url)))
         else
           Rest::Client.new(base_url: url, redirect_max: 3).call(operation: 'GET', save_to: archive_io)
-          archive_io.rewind
         end
+        archive_io.rewind
         extract_archive_files(url, archive_io) do |entry_name, entry_stream, link_target|
           dest_folder = if block_given?
             yield(entry_name)

data/lib/aspera/cli/async_transfer_store.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'aspera/log'
+require 'aspera/secret_hider'
 require 'json'
 require 'securerandom'
 
@@ -59,14 +60,14 @@ module Aspera
       end
 
       # Persist (create or update) an async transfer entry.
-      # Keys whose name starts with '_' are in-process references (e.g. '_agent_ref')
-      # and are intentionally excluded from the JSON serialization — at every nesting level.
+      # Keys whose name starts with '_' are in-process references (e.g. '_agent_ref'), and secrets (e.g. agent `password`)
+      # are not written on disk: they are intentionally excluded from the JSON serialization — at every nesting level.
       # @param job_id [String] the ascli-generated UUID
       # @param data   [Hash]   fields to store (will be JSON-serialised)
       def write(job_id, data)
         Aspera.assert_type(job_id, String) { 'job_id' }
         Aspera.assert_type(data, Hash) { 'data' }
-        @persistency.put(store_key(job_id), JSON.generate(strip_internal_keys(data)))
+        @persistency.put(store_key(job_id), JSON.generate(persistable(data)))
         nil
       end
 
@@ -105,17 +106,17 @@ module Aspera
         "#{CATEGORY}#{job_id}"
       end
 
-      # Recursively remove keys whose name starts with '_' from a Hash.
-      # Such keys hold in-process Ruby object references (e.g. '_agent_ref') that
-      # cannot be serialized to JSON and must never reach the file system.
-      def strip_internal_keys(value)
+      # Recursively remove from a Hash the keys that must never reach the file system:
+      # - keys whose name starts with '_': in-process Ruby object references (e.g. '_agent_ref') that cannot be serialized to JSON
+      # - secrets (e.g. 'password'): taken from current options when the transfer is queried
+      def persistable(value)
         case value
         when Hash
           value.each_with_object({}) do |(k, v), h|
-            h[k] = strip_internal_keys(v) unless k.to_s.start_with?('_')
+            h[k] = persistable(v) unless k.to_s.start_with?('_') || SecretHider.instance.secret?(k, v)
           end
         when Array
-          value.map { |v| strip_internal_keys(v) }
+          value.map { |v| persistable(v) }
         else
           value
         end

data/lib/aspera/cli/bootstrapper.rb

@@ -139,9 +139,11 @@ module Aspera
 
       # Declare + parse :progress_bar: sets context.progress_bar
       def setup_progress_bar
-        @context.options.declare(:progress_bar, description: 'Display progress bar', allowed: Type::BOOLEAN, default: Environment.terminal?)
+        @context.options.declare(:progress_bar, description: 'Display progress bar', allowed: Type::BOOLEAN, default: $stderr.tty?)
         @context.options.parse_options!
         @context.progress_bar = TransferProgress.new if @context.options.get_option(:progress_bar)
+        # Log lines do not overwrite the progress bar
+        Log.instance.status_line = @context.progress_bar
       end
 
       # Declare + parse :fpac / :proxy_credentials: sets up PAC executor

data/lib/aspera/cli/command_registry.rb

@@ -20,6 +20,7 @@ module Aspera
     #   own_children_of(path)   - Hash{Symbol => CommandSpec} of direct children declared on the node, without mounted ones
     #   arguments_at(path)      - Array of ArgumentSpec read by the node at path (mount arguments first)
     #   leaf_paths              - Array of all leaf paths (follows mounts, or stops at mount nodes)
+    #   command_path(words)     - command path designated by command line words (aliases, arguments)
     #   all_paths               - Array of all locally registered full paths
     #   any?                    - true if at least one spec has been registered
     #   validate!               - cross-spec consistency checks; raises on violation
@@ -138,6 +139,33 @@ module Aspera
         end
       end
 
+      # Command path designated by words of a command line: sub-commands (or their aliases),
+      # each possibly followed by its positional arguments, e.g. `packages receive ALL` designates `packages receive`.
+      # Words after a leaf command are its arguments.
+      # @param words [Array<Symbol>] words following the plugin name
+      # @return [Array(Array<Symbol>, Symbol)] command path, and the first word that is neither a sub-command
+      #   nor an expected argument (`nil` if none)
+      def command_path(words)
+        path = []
+        # Number of positional arguments still accepted by the node at path
+        args_left = 0
+        words.each do |word|
+          children = children_of(path)
+          break if children.empty?
+          id = children.key?(word) ? word : children.find { |_, c| Array(c.aliases).include?(word) }&.first
+          if id
+            path += [id]
+            arguments = arguments_at(path)
+            args_left = arguments.any?(&:multiple) ? Float::INFINITY : arguments.length
+          elsif args_left.positive?
+            args_left -= 1
+          else
+            return [path, word]
+          end
+        end
+        [path, nil]
+      end
+
       # @return [Array<Array<Symbol>>] all locally registered full paths
       def all_paths
         @specs.keys
@@ -168,29 +196,42 @@ module Aspera
       end
 
       # Cross-spec consistency checks.
-      # @param plugin_class [Class, nil] when given, also verify that implicit action methods exist
+      # @param plugin_class [Class, nil] when given, also verify that methods referenced by Symbol
+      #   (implicit and explicit actions, `setup:`, `condition:`, `lookup:`, mount `instance:`) exist
       # @raise [ArgumentError] on any violation
       # @return [self]
       def validate!(plugin_class: nil)
-        # Rule: every non-root parent path that appears in the children index must have
-        # a registered CommandSpec. A missing parent means commands_under(:x) was used
-        # without a matching command :x declaration.
-        @children_index.each_key do |parent_path|
-          next if parent_path.empty? # root is never a CommandSpec
-          unless @specs.key?(parent_path)
+        @children_index.each do |parent_path, children|
+          # Rule: every non-root parent path that appears in the children index must have
+          # a registered CommandSpec. A missing parent means commands_under(:x) was used
+          # without a matching command :x declaration.
+          unless parent_path.empty? || @specs.key?(parent_path)
             raise ArgumentError,
               "commands_under(#{parent_path.map(&:inspect).join(', ')}) used but #{parent_path.last.inspect} has no command declaration"
           end
+          # Rule: an alias designates a single command, and does not hide a sibling command
+          aliases = children.values.flat_map { |c| Array(c.aliases) }
+          conflicts = aliases.select { |a| children.key?(a) || aliases.count(a) > 1 }.uniq
+          raise ArgumentError, "#{parent_path.inspect}: alias conflicts with a sibling command or alias: #{conflicts.inspect}" unless conflicts.empty?
         end
 
         @specs.each_value do |spec|
           path = spec.full_path
 
+          validate_arguments(path, spec.arguments, plugin_class)
+          # Rule: methods called on the plugin instance exist
+          if plugin_class
+            {setup: spec.setup, condition: spec.condition}.each do |attribute, method_name|
+              raise ArgumentError, "#{path.inspect}: no method #{method_name} on #{plugin_class} for #{attribute}:" unless method_name.nil? || instance_method?(plugin_class, method_name)
+            end
+          end
+
           if (mount = spec.mount)
             # Rule: a mount needs an instance method, no action, and must point to existing target nodes
             raise ArgumentError, "#{path.inspect}: mount requires instance:" if mount.instance.nil?
             # Mount arguments precede the arguments of the mounted command: they cannot be optional
             raise ArgumentError, "#{path.inspect}: mount arguments must be mandatory" unless mount.arguments.all?(&:mandatory)
+            validate_arguments(path, mount.arguments, plugin_class)
             raise ArgumentError, "#{path.inspect}: mount and action: are exclusive" if spec.action
             raise ArgumentError, "#{path.inspect}: mount at #{mount.at.inspect} not found in #{mount.plugin}" unless mount.at.empty? || mount.registry[mount.at]
             target_ids = mount.registry.children_of(mount.at).keys
@@ -229,6 +270,27 @@ module Aspera
         plugin_class.method_defined?(name) || plugin_class.private_method_defined?(name)
       end
 
+      # Consistency of the positional arguments of a node, in reading order.
+      # @param path         [Array<Symbol>]       node path, for error messages
+      # @param arg_specs    [Array<ArgumentSpec>] arguments of the node (or of its mount)
+      # @param plugin_class [Class, nil]          when given, verify that `lookup:` methods exist
+      # @raise [ArgumentError] on any violation
+      def validate_arguments(path, arg_specs, plugin_class)
+        previous = nil
+        Array(arg_specs).each do |arg|
+          where = "#{path.inspect}: argument #{arg.name}"
+          # Rule: an argument following an optional one, or one that takes all remaining arguments, is never read reliably
+          raise ArgumentError, "#{where}: mandatory after optional #{previous.name}" if previous && arg.mandatory && !previous.mandatory
+          raise ArgumentError, "#{where}: after #{previous.name}, which takes all remaining arguments" if previous&.multiple.eql?(true)
+          unless arg.lookup.nil?
+            # Rule: the percent-selector lookup is only used for identifiers
+            raise ArgumentError, "#{where}: lookup: requires type: :identifier" unless arg.type.eql?(:identifier)
+            raise ArgumentError, "#{where}: no method #{arg.lookup} on #{plugin_class} for lookup:" if arg.lookup.is_a?(Symbol) && plugin_class && !instance_method?(plugin_class, arg.lookup)
+          end
+          previous = arg
+        end
+      end
+
       # @param path [Array<Symbol>] non-empty path in this registry's namespace
       # @return [Array<ArgumentSpec>] arguments of the mount exposing the last segment of path, if any
       def mount_arguments(path)

data/lib/aspera/cli/command_spec.rb

@@ -23,7 +23,7 @@ module Aspera
     #                                                     Proc/lambda → called via instance_exec(field, value, **ctx, &lookup).
     #                                                     Style: use Symbol for named methods; ->(){} for 1-liners; lambda do…end for 2–3 statements.
     # @!attribute allowed     [Array<Symbol>, nil]        Allowed Symbol values; when set, type is forced to Symbol and accept_list is applied
-    # @!attribute interactive [Boolean]                   When true, sets ask_missing_mandatory before resolving so interactive prompting is triggered when no CLI args are provided
+    # @!attribute interactive [Boolean]                   When true, prompts for this argument (only) when no CLI args are provided
     ArgumentSpec = Struct.new(
       :name,
       :description,

data/lib/aspera/cli/extended_value.rb

@@ -77,7 +77,7 @@ module Aspera
           case mode
           when '' then $stdin.read
           when 'bin' then $stdin.binmode.read
-          when 'chomp' then $stdin.chomp
+          when 'chomp' then $stdin.read.chomp
           else raise BadArgument, "`stdin` supports only: '', 'bin' or 'chomp'"
           end
         end
@@ -118,10 +118,11 @@ module Aspera
       end
 
       # Update the Regex to match an extended value based on @handlers
+      # Anchored on the whole value (`\A`, `\z`), not on lines: a multi-line value is extended only if it starts with a modifier.
       def update_regex
         handler_regex = "#{MARKER_START}(#{modifiers.join('|')})#{MARKER_END}"
-        @regex_single = Regexp.new("^#{handler_regex}(.*)$", Regexp::MULTILINE)
-        @regex_extend = Regexp.new("^(.*)#{handler_regex}([^#{MARKER_IN_END}]*)#{MARKER_IN_END}(.*)$", Regexp::MULTILINE)
+        @regex_single = Regexp.new("\\A#{handler_regex}(.*)\\z", Regexp::MULTILINE)
+        @regex_extend = Regexp.new("\\A(.*)#{handler_regex}([^#{MARKER_IN_END}]*)#{MARKER_IN_END}(.*)\\z", Regexp::MULTILINE)
       end
 
       public

data/lib/aspera/cli/formatter.rb

@@ -51,6 +51,8 @@ module Aspera
       option :multi_single, description: '(Table) Control how object list is displayed as single table, or multiple objects',                 allowed: %i[no yes single], default: :no,                 deprecation: {last: '4.27.0', message: 'use --out.table.pivot'}
       option :show_secrets, description: 'Show secrets on command output',                                                                    allowed: Type::BOOLEAN, default: false,                   deprecation: {last: '4.27.0', message: 'use --out.secrets'}
       option :image,        schema: Schema::Registry::IMAGE_OPTIONS, deprecation: {last: '4.27.0', message: 'use --out.img'}
+      # All formatter options are handled by `option_handler`, executed on the formatter instance
+      option_specs.each_value { |spec| spec.on_set = ->(value) { option_handler(spec.name, value) } }
 
       class << self
         # Replace special values with a readable version on terminal
@@ -146,15 +148,14 @@ module Aspera
         end
       end
 
-      # Bind all formatter options to this instance using `on_set`.
+      # Declare formatter options on the parser, with `on_set` callbacks executed on this instance.
       # Called from Runner after Formatter.new.
-      # @param options [Aspera::Cli::Parser]
+      # @param parser [Aspera::Cli::Parser]
       # @return [nil]
-      def bind_options(options)
-        @parser = options
-        %i[out display format output fields select table_style flat_hash multi_single show_secrets image].each do |opt|
-          options.on_set(opt, ->(value) { option_handler(opt, value) })
-        end
+      def declare_options(parser)
+        # Used by `option_handler` to dispatch `--out` sub-options
+        @parser = parser
+        self.class.declare_options(parser, target: self)
         nil
       end
 
@@ -195,7 +196,8 @@ module Aspera
         # special handling of some options
         case option_symbol
         when :format
-          @options[:display] = value.eql?(:table) ? :info : :data
+          # The default output level depends on the format, unless the level is set explicitly (e.g. `--out.level`)
+          @options[:display] = value.eql?(:table) ? :info : :data if @parser.nil? || @parser.option_def(:display).source.eql?(:default)
         when :output
           $stdout = if value.eql?('-')
             STDOUT # rubocop:disable Style/GlobalStdStream

data/lib/aspera/cli/http.rb

@@ -26,12 +26,13 @@ module Aspera
 
       private_constant :CERT_EXT, :SELF_SIGNED_CERT
 
-      option :insecure,           description: 'HTTP/S: Do not validate any certificate',                   allowed: Type::BOOLEAN, default: false
-      option :ignore_certificate, description: 'HTTP/S: Do not validate certificate for these URLs',        allowed: [Array, NilClass]
-      option :warn_insecure,      description: 'HTTP/S: Issue a warning if certificate is ignored',         allowed: Type::BOOLEAN, default: true
-      option :cert_stores,        description: 'HTTP/S: List of folder with trusted certificates',          allowed: Type::STRING_ARRAY
-      option :http_options,       schema: Schema::Registry::HTTP_OPTIONS
-      option :http_proxy,         description: 'HTTP/S: URL for proxy with optional credentials'
+      # `on_set` callbacks are methods of the instance given as `target:` to `declare_options`
+      option :insecure,           description: 'HTTP/S: Do not validate any certificate',                   allowed: Type::BOOLEAN, default: false, on_set: :insecure=
+      option :ignore_certificate, description: 'HTTP/S: Do not validate certificate for these URLs',        allowed: [Array, NilClass],             on_set: :ignore_cert_host_port=
+      option :warn_insecure,      description: 'HTTP/S: Issue a warning if certificate is ignored',         allowed: Type::BOOLEAN, default: true,  on_set: :warn_insecure=
+      option :cert_stores,        description: 'HTTP/S: List of folder with trusted certificates',          allowed: Type::STRING_ARRAY,            on_set: :trusted_cert_locations=
+      option :http_options,       schema: Schema::Registry::HTTP_OPTIONS,                                                                           on_set: :http_options=
+      option :http_proxy,         description: 'HTTP/S: URL for proxy with optional credentials',                                                   on_set: :http_proxy=
 
       def initialize
         @insecure              = false
@@ -46,19 +47,6 @@ module Aspera
       attr_accessor :insecure, :warn_insecure
       attr_reader   :ignore_cert_host_port, :http_options
 
-      # Bind all HTTP options to this instance using `on_set`.
-      # Called from Config#initialize immediately after Http.new.
-      # @param options [Aspera::Cli::Parser]
-      # @return [nil]
-      def bind_options(options)
-        options.on_set(:insecure,           method(:insecure=))
-        options.on_set(:ignore_certificate, method(:ignore_cert_host_port=))
-        options.on_set(:warn_insecure,      method(:warn_insecure=))
-        options.on_set(:cert_stores,        method(:trusted_cert_locations=))
-        options.on_set(:http_options,       method(:http_options=))
-        options.on_set(:http_proxy,         method(:http_proxy=))
-      end
-
       # Setter for http_options: dispatch each key to its target singleton immediately.
       # Keys matching Rest::Parameters setters go to Rest::Parameters, 'ssl_options' goes to SSL,
       # keys matching OAuth::Factory.instance.parameters go to OAuth, and the rest are kept
@@ -148,7 +136,7 @@ module Aspera
           if path.eql?(SpecialValues::DEF)
             @certificate_store.set_default_paths
             paths_to_add = [OpenSSL::X509::DEFAULT_CERT_DIR]
-            paths_to_add.push(OpenSSL::X509::DEFAULT_CERT_FILE) unless defined?(JRUBY_VERSION)
+            paths_to_add.push(ENV.fetch(OpenSSL::X509::DEFAULT_CERT_FILE_ENV, OpenSSL::X509::DEFAULT_CERT_FILE)) unless defined?(JRUBY_VERSION)
             paths_to_add.select! { |f| File.exist?(f) }
           elsif File.file?(path)
             @certificate_store.add_file(path)

data/lib/aspera/cli/option_types.rb

@@ -54,7 +54,7 @@ module Aspera
     end
 
     # Type specifiers for the `allowed:` parameter of option declarations.
-    # Public API: STRING_ARRAY, SYMBOL_ARRAY, INTEGER, BOOLEAN, NONE.
+    # Public API: STRING_ARRAY, SYMBOL_ARRAY, INTEGER, FLOAT, BOOLEAN, NONE.
     # Internal (do not pass as `allowed:`):
     #   ENUM   - derived internally when `allowed:` is an Array<Symbol> (enum list)
     #   STRING - the implicit default; equivalent to omitting `allowed:` entirely
@@ -65,6 +65,8 @@ module Aspera
       SYMBOL_ARRAY = [Array, Symbol].freeze
       # Option value is coerced to Integer
       INTEGER = [Integer].freeze
+      # Option value is coerced to Float
+      FLOAT = [Float].freeze
       # Option value is a Boolean
       BOOLEAN = BoolValue::TYPES
       # Option has no value — it is a flag switch (e.g. `-N`, `--help`)