@b3labs/b3iq-cli 0.0.0-stage → 0.1.0

package/dist/commands/ssh.js

@@ -0,0 +1,156 @@
+import { spawnSync } from "node:child_process";
+import { api } from "../lib/api.js";
+import { resolveMachineOrRental, pickMachineOrRental, machineLabel } from "../lib/machines.js";
+import { explainCloudflaredMissing, explainSshLane, explainNoDirectAddress, explainDirectSshNotEnabled } from "../lib/diagnosis.js";
+import { listedOrgLabel, resolveSettings } from "../lib/config.js";
+import { CliError, log, warn, isJSON, emit } from "../lib/output.js";
+import { SSH_USER, bastionRoute, cloudflaredRoute, directRoute, firstReachable, hasRemoteCommand, probeSsh, runSession, runSsh, wantsOwnSshLogging, } from "../lib/ssh-session.js";
+import { assertSshHost, assertSshPort, assertSshUser } from "../lib/ssh-target.js";
+export const TESTING_DIRECT_ADDR_ENV = "B3IQ_SSH_DIRECT_ADDR";
+export const TESTING_FORCE_FLAG_ENV = "B3IQ_SSH_DIRECT_FORCE";
+export function parseDirectAddrOverride(raw) {
+    const addresses = [];
+    let port = null;
+    for (const item of raw.split(",").map((part) => part.trim()).filter(Boolean)) {
+        const bracketed = /^\[([0-9A-Fa-f:.]+)\](?::(\d+))?$/.exec(item);
+        const hostPort = /^([^:\s]+):(\d+)$/.exec(item);
+        const [address, portText] = bracketed ? [bracketed[1], bracketed[2]] : hostPort ? [hostPort[1], hostPort[2]] : [item, undefined];
+        if (!address || /\s/.test(address))
+            throw new CliError(`Not an address: "${item}". Use ip, ip:port or [ipv6]:port.`, "usage", 1);
+        if (portText !== undefined) {
+            const value = Number(portText);
+            if (!Number.isInteger(value) || value < 1 || value > 65535)
+                throw new CliError(`Not a port: "${portText}".`, "usage", 1);
+            port ??= value;
+        }
+        addresses.push(address);
+    }
+    if (addresses.length === 0)
+        throw new CliError("--direct-addr / B3IQ_SSH_DIRECT_ADDR names no address.", "usage", 1);
+    return { addresses, port: port ?? 22 };
+}
+function guestTarget(label, rental) {
+    const guest = rental.guest;
+    if (!guest || guest.state !== "ready" || !guest.ssh_hostname || !guest.ssh_user) {
+        const state = guest ? ` (its virtual machine is ${guest.state})` : "";
+        throw new CliError(`Your rental of ${label} is not ready yet${state}. Try again once it is: \`b3iq machines guests ${rental.node_id}\` shows its state.`, "usage", 1);
+    }
+    return { host: assertSshHost(guest.ssh_hostname, "guest hostname"), user: assertSshUser(guest.ssh_user, "guest user"), bastion: null, direct: null, guestId: guest.guest_id };
+}
+async function chooseTarget(selector, interactive) {
+    const nothingNamed = !selector?.trim() && !resolveSettings().defaultMachine?.trim();
+    if (nothingNamed && interactive)
+        return pickMachineOrRental();
+    return resolveMachineOrRental(selector);
+}
+async function sshTarget(chosen) {
+    const node = chosen.node;
+    const label = machineLabel(node);
+    if (chosen.kind === "rental")
+        return { label, nodeId: node.node_id, orgId: chosen.orgId, ...guestTarget(label, chosen.rental) };
+    const detail = await api.node(node.node_id);
+    const ssh_lane = detail.ssh_lane;
+    if (!ssh_lane?.enabled || !ssh_lane.hostname) {
+        throw explainSshLane(node.node_id, Boolean(ssh_lane?.enabled), Boolean(ssh_lane?.hostname));
+    }
+    const bastion = detail.ssh_bastion
+        ? { host: assertSshHost(detail.ssh_bastion.host, "bastion hostname"), user: assertSshUser(detail.ssh_bastion.user, "bastion user") }
+        : null;
+    const reported = detail.ssh_direct;
+    const direct = reported && reported.addresses.length > 0
+        ? { addresses: reported.addresses.map((address) => assertSshHost(address, "direct address")), port: assertSshPort(reported.port, "direct port") }
+        : null;
+    return { label, nodeId: node.node_id, orgId: chosen.orgId, guestId: null, host: assertSshHost(ssh_lane.hostname), user: bastion ? bastion.user : SSH_USER, bastion, direct };
+}
+const tunnelRoute = (to, passthrough, keepalive) => to.bastion ? bastionRoute(to.bastion, to.host, passthrough, keepalive) : cloudflaredRoute(to.host, passthrough, to.user, keepalive);
+export const DIRECT_SSH_FEATURE = "cli_direct_ssh";
+async function directSshEnabled() {
+    try {
+        const { features } = await api.features(AbortSignal.timeout(4_000));
+        return Array.isArray(features) && features.includes(DIRECT_SSH_FEATURE);
+    }
+    catch {
+        return false;
+    }
+}
+const cloudflaredInstalled = () => spawnSync("cloudflared", ["--version"], { stdio: "ignore" }).status === 0;
+export async function sshMachine(selector, passthrough, options = { transport: "auto", reconnect: true }) {
+    const cannotTakeOverTheTerminal = isJSON() || !process.stdout.isTTY;
+    const forced = process.env[TESTING_FORCE_FLAG_ENV] === "1";
+    const flagRead = forced ? Promise.resolve(true) : directSshEnabled();
+    const to = await sshTarget(await chooseTarget(selector, !cannotTakeOverTheTerminal && Boolean(process.stdin.isTTY)));
+    const overrideAddr = options.directAddr ?? (process.env[TESTING_DIRECT_ADDR_ENV]?.trim() || undefined);
+    if (overrideAddr && to.guestId)
+        warn("TESTING OVERRIDE ignored: a rented guest is only reachable over its host's Cloudflare Tunnel.");
+    if (overrideAddr && !to.guestId) {
+        to.direct = parseDirectAddrOverride(overrideAddr);
+        warn(`TESTING OVERRIDE: trying ${to.direct.addresses.join(", ")} port ${to.direct.port} instead of the machine's reported ssh_direct.`);
+    }
+    if (forced)
+        warn(`TESTING OVERRIDE: ${TESTING_FORCE_FLAG_ENV}=1 treats ${DIRECT_SSH_FEATURE} as on without asking the API.`);
+    const flagged = await flagRead;
+    if (overrideAddr && !to.guestId && !flagged)
+        warn(`TESTING OVERRIDE ignored: ${DIRECT_SSH_FEATURE} is off for this account. Set ${TESTING_FORCE_FLAG_ENV}=1 to force it on for a test.`);
+    if (options.transport === "direct" && !flagged)
+        throw explainDirectSshNotEnabled(DIRECT_SSH_FEATURE);
+    if (options.transport === "direct" && !to.direct)
+        throw explainNoDirectAddress(to.nodeId, to.guestId !== null);
+    const directUser = SSH_USER;
+    const wantDirect = flagged && options.transport !== "tunnel" ? to.direct : null;
+    const tunnel = options.transport === "direct" ? null : tunnelRoute(to, passthrough, flagged);
+    const runOnce = wantsOwnSshLogging(passthrough);
+    if (cannotTakeOverTheTerminal) {
+        const address = wantDirect && (tunnel === null || !runOnce) ? await firstReachable(wantDirect) : null;
+        const primary = address ? directRoute(address, wantDirect.port, to.host, directUser, passthrough) : tunnel;
+        if (!primary)
+            throw explainNoDirectAddress(to.nodeId, false, wantDirect?.addresses.length ?? 0);
+        const fallback = primary === tunnel || runOnce ? null : tunnel;
+        emit({
+            machine: to.label,
+            node_id: to.nodeId,
+            organization_id: to.orgId,
+            ...(to.guestId ? { guest_id: to.guestId } : {}),
+            hostname: primary.host,
+            user: primary.user,
+            transport: primary.transport,
+            ssh_args: primary.args,
+            fallback: fallback ? { hostname: fallback.host, user: fallback.user, transport: fallback.transport, ssh_args: fallback.args } : null,
+        }, () => {
+            process.stdout.write(`ssh ${primary.args.map(shellQuote).join(" ")}\n`);
+            if (fallback)
+                process.stdout.write(`# only if that exits 255 before logging in: ssh ${fallback.args.map(shellQuote).join(" ")}\n`);
+        });
+        return;
+    }
+    let fallback = tunnel;
+    if (fallback?.transport === "cloudflared" && !cloudflaredInstalled()) {
+        if (!wantDirect)
+            throw explainCloudflaredMissing();
+        warn("cloudflared is not installed, so there is no Cloudflare Tunnel fallback if the direct path fails.");
+        fallback = null;
+    }
+    const logged = flagged && !runOnce;
+    const inOrg = to.orgId ? ` in organization ${listedOrgLabel(to.orgId)}` : "";
+    const plan = {
+        direct: wantDirect && (!runOnce || fallback === null) ? { endpoint: wantDirect, route: (address) => directRoute(address, wantDirect.port, to.host, directUser, passthrough) } : null,
+        fallback,
+        reconnect: flagged && options.reconnect && !hasRemoteCommand(passthrough),
+        target: `${to.label} (${to.host})${inOrg}`,
+    };
+    const tunnelName = fallback?.transport === "bastion" ? "bastion" : "Cloudflare Tunnel";
+    if (flagged && runOnce)
+        log(`Paths: ${plan.direct ? "direct" : tunnelName} only, once: ssh's own -v/-q/-y/-E/-S rule out a fallback.`);
+    else if (flagged)
+        log(`Paths: ${plan.direct ? `${plan.direct.endpoint.addresses.length} direct address${plan.direct.endpoint.addresses.length === 1 ? "" : "es"}` : "no direct address"}${fallback ? `, ${tunnelName} fallback` : ""}.`);
+    const code = await runSession(plan, {
+        probe: probeSsh,
+        run: runSsh,
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        now: () => Date.now(),
+        log,
+        warn,
+        die: (signal) => process.kill(process.pid, signal),
+    }, logged);
+    process.exit(code);
+}
+const shellQuote = (arg) => (/^[A-Za-z0-9_@%+=:,./-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`);

package/dist/index.js

@@ -0,0 +1,194 @@
+#!/usr/bin/env node
+import { parseArgs, boolFlag, strFlag } from "./lib/args.js";
+import { configureOutput, fail, CliError } from "./lib/output.js";
+import { machinesList, machinesGet, machinesGuests, machinesQualify } from "./commands/machines.js";
+import { pluginsList, pluginsInstall, pluginsRemove } from "./commands/plugins.js";
+import { commandsList, commandsGet } from "./commands/commands.js";
+import { modelsList, modelsInstall, modelsRemove, modelsContext } from "./commands/models.js";
+import { runtimesList, runtimesRestart, runtimesCheck, runtimesUpgrade, runtimesPolicy } from "./commands/runtimes.js";
+import { logsCmd } from "./commands/logs.js";
+import { sshMachine } from "./commands/ssh.js";
+import { login, logout, whoami, status, configCmd, doctor, help } from "./commands/misc.js";
+import { InferenceGateway, gatewayKey, savedGatewayKey, saveGatewayKey, clearGatewayKey } from "./lib/inference.js";
+import { prepareNativeAgent, launchNativeAgent, printNativeSetupResult, installCodexProfile } from "./commands/native-agents.js";
+import { installOpenCodeConfig, detectOpenCodeVersion } from "./commands/opencode.js";
+import { saveClaudeDesktopConnection, activateClaudeDesktopConnection, restoreClaudeDesktopConnection } from "./commands/claude-desktop.js";
+import { findCodexDesktop, saveCodexDesktop, installCodexDesktopLauncher, launchCodexDesktop } from "./commands/codex-desktop.js";
+import { readFile } from "node:fs/promises";
+import { VERSION } from "./lib/version.js";
+import { readSecretFromStdin } from "./lib/stdin.js";
+async function main() {
+    const raw = process.argv.slice(2);
+    const passthroughSeparator = raw.indexOf("--");
+    const ownArgs = passthroughSeparator >= 0 ? raw.slice(0, passthroughSeparator) : raw;
+    const passthrough = passthroughSeparator >= 0 ? raw.slice(passthroughSeparator + 1) : [];
+    const { positionals, flags } = parseArgs(ownArgs, new Set(["machine", "token", "limit", "model", "gateway-url", "output-dir", "client-version", "tokens", "desktop-app", "setup-name", "target-version", "mode", "hour-utc", "direct-addr"]));
+    configureOutput({ json: boolFlag(flags, "json"), pretty: boolFlag(flags, "pretty"), quiet: boolFlag(flags, "quiet") });
+    if (boolFlag(flags, "version"))
+        return void process.stdout.write(`${VERSION}\n`);
+    const [cmd, sub, ...rest] = positionals;
+    if (!cmd || boolFlag(flags, "help"))
+        return help();
+    switch (cmd) {
+        case "mcp": {
+            if (sub !== "media")
+                throw new CliError("Usage: b3iq mcp media", "usage");
+            const { runMediaMcp } = await import("./commands/media-mcp.js");
+            return runMediaMcp({ ...(boolFlag(flags, "saved-key") ? { key: await savedGatewayKey() } : {}), gateway: strFlag(flags, "gateway-url"), machine: strFlag(flags, "machine"), outputDir: strFlag(flags, "output-dir") });
+        }
+        case "inference": {
+            const options = { gateway: strFlag(flags, "gateway-url"), machine: strFlag(flags, "machine"), outputDir: strFlag(flags, "output-dir") };
+            if (sub === "models")
+                return void process.stdout.write(JSON.stringify(await new InferenceGateway(options).models()) + "\n");
+            if (sub === "credential") {
+                if (process.stdout.isTTY)
+                    throw new CliError("Credential output is only for a native client's private helper pipe.", "usage");
+                return void process.stdout.write(await (boolFlag(flags, "saved") ? savedGatewayKey() : gatewayKey()));
+            }
+            if (sub === "key-save") {
+                await saveGatewayKey(await readSecretFromStdin("dashboard API key"));
+                return void process.stderr.write("Dashboard API key saved privately.\n");
+            }
+            if (sub === "key-clear")
+                return clearGatewayKey();
+            if (sub === "restore") {
+                if (rest[0] !== "claude" || rest.length !== 1 || !boolFlag(flags, "desktop") || Object.keys(flags).some(key => !["desktop", "json", "pretty", "quiet"].includes(key)))
+                    throw new CliError("Usage: b3iq inference restore claude --desktop (with Claude closed).", "usage");
+                return void process.stdout.write(JSON.stringify(await restoreClaudeDesktopConnection()) + "\n");
+            }
+            const client = sub === "setup" ? rest[0] : sub;
+            if (client !== "codex" && client !== "claude" && client !== "opencode")
+                throw new CliError("Usage: b3iq inference models|setup <codex|claude|opencode>|codex|claude|opencode --model <served-id>", "usage");
+            const desktop = boolFlag(flags, "desktop"), install = boolFlag(flags, "install"), requestedVersion = strFlag(flags, "client-version");
+            if (flags["client-version"] === true)
+                throw new CliError("Provide --client-version 1 or 2.", "usage");
+            const activate = boolFlag(flags, "activate");
+            const setupName = strFlag(flags, "setup-name");
+            if ("setup-name" in flags && (client !== "codex" || sub !== "setup" || !desktop || !setupName || !/^[a-z0-9][a-z0-9_-]{0,63}$/.test(setupName)))
+                throw new CliError("--setup-name requires Codex desktop setup and 1–64 lowercase letters, digits, underscores or hyphens, starting with a letter or digit.", "usage");
+            if ("activate" in flags && ((client !== "claude" && client !== "codex") || sub !== "setup" || !desktop || !install))
+                throw new CliError("Explicit activation requires b3iq inference setup claude|codex --desktop --install --activate --model <id>.", "usage");
+            if ("desktop-app" in flags && (client !== "codex" || !desktop || !strFlag(flags, "desktop-app")))
+                throw new CliError("--desktop-app requires Codex desktop setup and an application path.", "usage");
+            if ("client-version" in flags && client !== "opencode")
+                throw new CliError("--client-version applies to OpenCode only.", "usage");
+            if (desktop && sub !== "setup" || install && (!desktop || sub !== "setup"))
+                throw new CliError("Desktop saving uses: b3iq inference setup codex|claude|opencode --desktop --install --model <id>.", "usage");
+            if (requestedVersion !== undefined && requestedVersion !== "1" && requestedVersion !== "2")
+                throw new CliError("OpenCode --client-version must be 1 or 2.", "usage");
+            const model = strFlag(flags, "model");
+            if (!model)
+                throw new CliError("Provide --model with an exact served model ID.", "usage");
+            const version = requestedVersion ? (requestedVersion === "1" ? 1 : 2)
+                : client === "opencode" && sub !== "setup" ? await detectOpenCodeVersion() : 2;
+            const codexApp = client === "codex" && desktop ? await findCodexDesktop(strFlag(flags, "desktop-app")) : undefined;
+            const prepared = await prepareNativeAgent(client, model, options, undefined, { version, desktop, setupName });
+            if (codexApp) {
+                prepared.codexDesktop = await saveCodexDesktop(prepared.config, prepared.dir, codexApp);
+                prepared.installedConfig = `${prepared.codexDesktop.engine_home}/config.toml`;
+                if (install)
+                    await installCodexDesktopLauncher(prepared.codexDesktop);
+                if (activate)
+                    await launchCodexDesktop(prepared.codexDesktop);
+            }
+            if (install && client === "claude") {
+                const saved = await saveClaudeDesktopConnection(prepared.claudeDesktop);
+                prepared.claudeDesktop.saved = saved;
+                prepared.installedConfig = saved.path;
+                prepared.backup = saved.backup;
+                if (activate)
+                    await activateClaudeDesktopConnection(prepared.claudeDesktop);
+            }
+            if (install && client === "opencode") {
+                const installed = await installOpenCodeConfig(JSON.parse(await readFile(prepared.config, "utf8")), prepared.openCodeVersion, prepared.env.B3IQ_GATEWAY_API_KEY);
+                prepared.installedConfig = installed.config;
+                prepared.backup = installed.backup;
+            }
+            if (sub === "setup") {
+                if (client === "codex" && !desktop)
+                    await installCodexProfile(prepared);
+                return printNativeSetupResult(client, prepared, activate);
+            }
+            return launchNativeAgent(client, prepared, passthrough);
+        }
+        case "login": {
+            if ("token" in flags || sub) {
+                throw new CliError("An API key on the command line lands in shell history. Pipe it instead: `b3iq login --token-stdin < key.txt`, or set B3IQ_TOKEN.", "usage");
+            }
+            return login(boolFlag(flags, "token-stdin") ? await readSecretFromStdin("API key") : undefined);
+        }
+        case "logout":
+            return logout(boolFlag(flags, "revoke"));
+        case "whoami":
+            return whoami();
+        case "status":
+            return status();
+        case "doctor":
+            return doctor();
+        case "config":
+            return configCmd([sub, ...rest].filter((v) => typeof v === "string"));
+        case "machines":
+            if (sub === "list" || sub === undefined)
+                return machinesList();
+            if (sub === "get")
+                return machinesGet(rest[0]);
+            if (sub === "qualify")
+                return machinesQualify(rest[0], !boolFlag(flags, "no-wait"));
+            if (sub === "guests")
+                return machinesGuests(rest[0]);
+            throw new CliError(`Unknown: machines ${sub}. Try: list, get <machine>, qualify <machine>, guests <machine>.`, "usage", 1);
+        case "plugins":
+            if (sub === "list" || sub === undefined)
+                return pluginsList(strFlag(flags, "machine"));
+            if (sub === "install")
+                return pluginsInstall(rest[0], strFlag(flags, "machine"), !boolFlag(flags, "no-wait"));
+            if (sub === "remove" || sub === "uninstall")
+                return pluginsRemove(rest[0], strFlag(flags, "machine"), !boolFlag(flags, "no-wait"));
+            throw new CliError(`Unknown: plugins ${sub}. Try: list, install <plugin>, remove <plugin>.`, "usage", 1);
+        case "commands":
+            if (sub === "list" || sub === undefined)
+                return commandsList(strFlag(flags, "machine"), strFlag(flags, "limit"));
+            if (sub === "get")
+                return commandsGet(rest[0], strFlag(flags, "machine"));
+            throw new CliError(`Unknown: commands ${sub}. Try: list, get <command-id>.`, "usage", 1);
+        case "models":
+            if (sub === "list" || sub === undefined)
+                return modelsList(strFlag(flags, "machine"));
+            if (sub === "install")
+                return modelsInstall(rest[0], strFlag(flags, "machine"), !boolFlag(flags, "no-wait"));
+            if (sub === "context") {
+                if (rest.length !== 1 || flags.machine === true || (flags.reset !== undefined && flags.reset !== true) || (flags["no-wait"] !== undefined && flags["no-wait"] !== true)) {
+                    throw new CliError("Usage: b3iq models context <model> --machine <m> [--tokens <n>|--reset] [--no-wait]. Boolean flags take no value.", "usage", 1);
+                }
+                return modelsContext(rest[0], strFlag(flags, "machine"), flags.tokens, boolFlag(flags, "reset"), !boolFlag(flags, "no-wait"));
+            }
+            if (sub === "remove" || sub === "uninstall")
+                return modelsRemove(rest[0], strFlag(flags, "machine"), !boolFlag(flags, "no-wait"));
+            throw new CliError(`Unknown: models ${sub}. Try: list, install <model>, context <model>, remove <model>.`, "usage", 1);
+        case "runtimes":
+            if (sub === "check")
+                return runtimesCheck(strFlag(flags, "machine"));
+            if (sub === "upgrade")
+                return runtimesUpgrade(rest[0], strFlag(flags, "machine"), strFlag(flags, "target-version"), !boolFlag(flags, "no-wait"));
+            if (sub === "policy")
+                return runtimesPolicy(rest[0], strFlag(flags, "machine"), strFlag(flags, "mode"), strFlag(flags, "hour-utc"));
+            if (sub === "list" || sub === undefined)
+                return runtimesList(strFlag(flags, "machine"));
+            if (sub === "restart")
+                return runtimesRestart(rest[0], strFlag(flags, "machine"), !boolFlag(flags, "no-wait"));
+            throw new CliError(`Unknown: runtimes ${sub}. Try: list, check, restart <runtime>, upgrade <runtime> --target-version <v>, policy <runtime> --mode manual|scheduled.`, "usage", 1);
+        case "logs":
+            return logsCmd(strFlag(flags, "limit"), boolFlag(flags, "follow"));
+        case "ssh": {
+            if (boolFlag(flags, "direct") && boolFlag(flags, "tunnel"))
+                throw new CliError("--direct and --tunnel cannot be used together.", "usage", 1);
+            const transport = boolFlag(flags, "direct") ? "direct" : boolFlag(flags, "tunnel") ? "tunnel" : "auto";
+            if (flags["direct-addr"] === true)
+                throw new CliError("--direct-addr takes an address: --direct-addr <ip[:port]>.", "usage", 1);
+            return sshMachine(sub, passthrough, { transport, reconnect: !boolFlag(flags, "no-reconnect"), directAddr: strFlag(flags, "direct-addr") });
+        }
+        default:
+            throw new CliError(`Unknown command "${cmd}". Run \`b3iq --help\`.`, "usage", 1);
+    }
+}
+main().catch(fail);

package/dist/lib/api.js

@@ -0,0 +1,149 @@
+import { explainApiStatus, explainAuthFailure, explainNetworkFailure, explainNotLoggedIn } from "./diagnosis.js";
+import { CliError, warn } from "./output.js";
+import { isLoopbackHost, resolveSettings } from "./config.js";
+export function assertApiUrl(apiUrl) {
+    let url;
+    try {
+        url = new URL(apiUrl);
+    }
+    catch {
+        url = undefined;
+    }
+    const scheme = url?.protocol;
+    if (!url || url.username || url.password || !(scheme === "https:" || (scheme === "http:" && isLoopbackHost(url.hostname)))) {
+        throw new CliError("The control plane URL (B3IQ_API_URL or config api_url) must be https://, or http:// on localhost only, without credentials.", "usage");
+    }
+}
+function structuredDetail(text) {
+    try {
+        const body = JSON.parse(text);
+        const envelope = body.error && typeof body.error === "object" ? body.error : undefined;
+        const value = [body.detail, typeof body.error === "string" ? body.error : undefined, envelope?.detail, envelope?.message, body.message].find((item) => typeof item === "string" && item.trim());
+        return typeof value === "string" ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const EXPIRY_WARNING_DAYS = 14;
+let expiryWarned = false;
+function warnIfLoginEndsSoon(expiresAt) {
+    if (expiryWarned || !expiresAt)
+        return;
+    const left = Date.parse(expiresAt) - Date.now();
+    if (!(left > 0 && left <= EXPIRY_WARNING_DAYS * 86_400_000))
+        return;
+    expiryWarned = true;
+    const days = Math.max(1, Math.floor(left / 86_400_000));
+    warn(`this login expires in ${days} day${days === 1 ? "" : "s"} — run \`b3iq login\` to renew it`);
+}
+export function __resetExpiryWarningForTests() {
+    expiryWarned = false;
+}
+async function request(path, init = {}, retryOn429 = true, as) {
+    const settings = resolveSettings();
+    const { apiUrl } = settings;
+    assertApiUrl(apiUrl);
+    const token = as ? as.token : settings.token;
+    const orgId = as ? as.orgId : settings.orgId;
+    const savedExpiresAt = as ? undefined : settings.savedExpiresAt;
+    if (!token)
+        throw explainNotLoggedIn();
+    warnIfLoginEndsSoon(savedExpiresAt);
+    const headers = new Headers(init.headers);
+    headers.set("accept", "application/json");
+    headers.set("authorization", `Bearer ${token}`);
+    if (orgId)
+        headers.set("x-org-id", orgId);
+    let res;
+    try {
+        res = await fetch(`${apiUrl}${path}`, { ...init, headers });
+    }
+    catch (error) {
+        if (error instanceof CliError)
+            throw error;
+        throw explainNetworkFailure(error, "control plane");
+    }
+    if (res.status === 429 && retryOn429) {
+        await new Promise((r) => setTimeout(r, 1000));
+        return request(path, init, false, as);
+    }
+    const requestId = res.headers.get("x-request-id") ?? undefined;
+    const text = await res.text();
+    if (!res.ok) {
+        const detail = structuredDetail(text);
+        if (res.status === 401 || res.status === 403)
+            throw explainAuthFailure(detail, res.status, requestId, orgId, savedExpiresAt);
+        throw explainApiStatus(detail, res.status, requestId);
+    }
+    return (text ? JSON.parse(text) : {});
+}
+export const api = {
+    nodes: () => request("/api/dev/nodes"),
+    node: (id) => request(`/api/dev/nodes/${encodeURIComponent(id)}`),
+    nodeGuests: (id) => request(`/api/dev/nodes/${encodeURIComponent(id)}/guests`),
+    rentedGuests: () => request("/api/dev/guests"),
+    models: () => request("/api/dev/models/available"),
+    settings: (as) => request("/api/dev/settings", {}, true, as),
+    features: (signal) => request("/v1/public/features", signal ? { signal } : {}),
+    currentCredential: (as) => request("/api/dev/credential", {}, true, as),
+    revokeCurrentCredential: (as) => request("/api/dev/credential/revoke", { method: "POST" }, true, as),
+    enqueueCommand: (nodeId, type, params) => request(`/api/dev/nodes/${encodeURIComponent(nodeId)}/commands`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ type, params }),
+    }),
+    nodeCommands: (nodeId, limit = 20) => request(`/api/dev/nodes/${encodeURIComponent(nodeId)}/commands?limit=${limit}`),
+    nodeCommand: (nodeId, commandId) => request(`/api/dev/nodes/${encodeURIComponent(nodeId)}/commands/${encodeURIComponent(commandId)}`),
+    plugins: () => request("/api/dev/plugins"),
+    installPlugin: (nodeId, name) => request(`/api/dev/nodes/${encodeURIComponent(nodeId)}/plugins/${encodeURIComponent(name)}`, { method: "POST" }),
+    uninstallPlugin: (nodeId, name) => request(`/api/dev/nodes/${encodeURIComponent(nodeId)}/plugins/${encodeURIComponent(name)}`, { method: "DELETE" }),
+    qualify: (nodeId) => request(`/api/dev/nodes/${encodeURIComponent(nodeId)}/qualify`, { method: "POST" }),
+    logs: (limit = 50) => request(`/api/dev/logs?limit=${limit}`),
+};
+export async function whoAmI(as) {
+    try {
+        const current = await api.currentCredential(as);
+        return {
+            user: {
+                id: current.user.id,
+                ...(current.user.email ? { email: current.user.email } : {}),
+                ...(current.user.display_name ? { displayName: current.user.display_name } : {}),
+                ...(current.user.avatar_url ? { avatarUrl: current.user.avatar_url } : {}),
+            },
+            organization: current.credential?.organization ?? null,
+            expiresAt: current.credential?.expires_at ?? null,
+        };
+    }
+    catch (error) {
+        if (!(error instanceof CliError) || error.diagnosis?.observed?.http_status !== 404)
+            throw error;
+        const { user } = await api.settings(as);
+        return { user, organization: null, expiresAt: null };
+    }
+}
+async function unauthedPost(path, body) {
+    const { apiUrl } = resolveSettings();
+    assertApiUrl(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${apiUrl}${path}`, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json" },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (error) {
+        if (error instanceof CliError)
+            throw error;
+        throw explainNetworkFailure(error, "control plane");
+    }
+    const text = await res.text();
+    if (!res.ok)
+        throw explainApiStatus(structuredDetail(text), res.status, res.headers.get("x-request-id") ?? undefined);
+    return JSON.parse(text);
+}
+export const deviceAuth = {
+    start: (label) => unauthedPost("/api/dev/cli/device", { label, accepts: ["api_key"] }),
+    poll: (deviceCode) => unauthedPost("/api/dev/cli/device/token", { device_code: deviceCode }),
+};

package/dist/lib/args.js

@@ -0,0 +1,35 @@
+const SHORT = { q: "quiet", h: "help", v: "version" };
+export function parseArgs(argv, flagsThatTakeAValue = new Set()) {
+    const positionals = [];
+    const flags = {};
+    for (let i = 0; i < argv.length; i++) {
+        const tok = argv[i];
+        if (tok === "--") {
+            positionals.push(...argv.slice(i + 1));
+            break;
+        }
+        if (tok.startsWith("--")) {
+            const body = tok.slice(2);
+            const eq = body.indexOf("=");
+            if (eq >= 0) {
+                flags[body.slice(0, eq)] = body.slice(eq + 1);
+            }
+            else if (flagsThatTakeAValue.has(body) && i + 1 < argv.length && !argv[i + 1].startsWith("-")) {
+                flags[body] = argv[++i];
+            }
+            else {
+                flags[body] = true;
+            }
+        }
+        else if (tok.startsWith("-") && tok.length > 1) {
+            for (const ch of tok.slice(1))
+                flags[SHORT[ch] ?? ch] = true;
+        }
+        else {
+            positionals.push(tok);
+        }
+    }
+    return { positionals, flags };
+}
+export const boolFlag = (flags, name) => flags[name] === true;
+export const strFlag = (flags, name) => typeof flags[name] === "string" ? flags[name] : undefined;

package/dist/lib/commands-wait.js

@@ -0,0 +1,41 @@
+import { api } from "./api.js";
+import { explainCommandEnded, explainCommandTimeout } from "./diagnosis.js";
+import { log } from "./output.js";
+const POLL_MS = 3_000;
+export async function waitForCommand(nodeId, commandId, opts) {
+    const deadline = Date.now() + opts.timeoutMs;
+    let lastStatus;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, POLL_MS));
+        const { commands } = await api.nodeCommands(nodeId, 50);
+        const row = commands.find((c) => c.command_id === commandId);
+        if (!row)
+            continue;
+        if (row.status !== lastStatus) {
+            lastStatus = row.status;
+            log(`${opts.describe}: ${row.status}`);
+        }
+        if (row.status === "completed")
+            return row;
+        if (row.status === "failed" || row.status === "cancelled") {
+            throw explainCommandEnded(opts.describe, row.status, row.error, commandId, nodeId);
+        }
+    }
+    throw explainCommandTimeout({
+        describe: opts.describe,
+        commandId,
+        nodeId,
+        timeoutMs: opts.timeoutMs,
+        ...(lastStatus !== undefined ? { lastStatus } : {}),
+    });
+}
+export async function queuedThenWait(nodeId, queued, opts) {
+    log(`${opts.describe} queued (${queued.command_id})`);
+    if (!opts.wait)
+        return { command_id: queued.command_id, type: queued.type, status: "queued" };
+    return waitForCommand(nodeId, queued.command_id, opts);
+}
+export async function enqueueAndWait(nodeId, type, params, opts) {
+    const { command_id } = await api.enqueueCommand(nodeId, type, params);
+    return queuedThenWait(nodeId, { command_id, type, status: "queued" }, opts);
+}