@botiverse/testbed-cli 0.4.0 → 0.5.1

package/lib/main.mjs

@@ -15,8 +15,10 @@ export const USAGE = `testbed — cloud phones + the acceptance testbed in the R
   testbed whoami                         who the API thinks you are
 
   testbed pool                           warm-pool devices and free/leased state
-  testbed acquire [--ttl MIN] [--instance ID] [--request-id ID] [--key-out FILE]
-                                         lease a phone; the ADB private key goes to --key-out (0600) or --json
+  testbed acquire [--ttl MIN] [--instance ID] [--request-id ID] [--key-out FILE] [--wait-ms N]
+                                         lease a phone; waits through in_flight (same request id) up to --wait-ms (90000);
+                                         the ADB private key goes to --key-out (0600) or --json
+  testbed <command> --help                usage only — never sends a request
   testbed devices                        your leases
   testbed renew <lease-id> [--ttl MIN]
   testbed release <lease-id>
@@ -37,6 +39,12 @@ export const USAGE = `testbed — cloud phones + the acceptance testbed in the R
                                          install for any runtime via "npx skills add" (Claude Code, Codex, Cursor, Gemini, OpenCode, ...)
   testbed skill --copy-to DIR            plain copy of SKILL.md (offline / unsupported runtime)
 
+  testbed qa-account list                QA account pool (labels, environments; never secrets)
+  testbed qa-account get <label> [--env staging|production] [--out FILE]
+                                         one QA login for a device; credential goes to --out (0600) or --json
+  testbed qa-account add <label> --env staging|production --username EMAIL
+                                         owner only; password is read from stdin, never from an argument
+
   testbed cases                          acceptance case library
   testbed run <case-id...> [--app --ref --apk --apk-run --release --by]
   testbed run --all [...]                the whole case table in one run (release smoke)
@@ -66,6 +74,11 @@ function table(rows, cols, out) {
   for (const r of rows) out(cols.map((c, i) => String(r[c] ?? "").padEnd(w[i])).join("  "));
 }
 
+async function readStdin(stream = process.stdin) {
+  if (stream.isTTY) return "";
+  let data = ""; for await (const chunk of stream) data += chunk; return data;
+}
+
 function writeKeyFile(path, key) {
   const fd = openSync(path, "wx", 0o600);
   try { writeSync(fd, key.endsWith("\n") ? key : key + "\n"); } finally { closeSync(fd); }
@@ -84,6 +97,10 @@ export async function main(argv, opts) {
   const env = opts.env ?? process.env;
   const exit = opts.exit ?? ((code) => process.exit(code));
   const json = takeSwitch(args, "json");
+  // `--help` / `-h` anywhere prints usage and NEVER reaches the API. 2026-09-05:
+  // `testbed acquire --help` acquired a device (HuaTuo) because flags were
+  // only consumed by the command that expected them.
+  if (args.includes("--help") || args.includes("-h")) { out(USAGE); return exit(0); }
   const cmd = args.shift();
   const emit = (data, human) => { if (json) out(JSON.stringify(data, null, 2)); else human(); };
 
@@ -137,11 +154,24 @@ export async function main(argv, opts) {
         const body = {};
         if (ttl !== undefined) body.ttl_minutes = Number(ttl);
         if (instance) body.instance_id = instance;
-        if (requestId) body.request_id = requestId;
-        const d = await api("POST", "/device-broker/leases", body);
-        if (d.status === "in_flight") {
-          emit(d, () => out(`in_flight: request ${d.request_id} on ${d.instance_id ?? "?"} — retry acquire with --request-id ${d.request_id}`));
-          return exit(2);
+        // Always send a request id so a retry never takes a second device: the
+        // broker answers 202 in_flight (retryable) while it is still preparing
+        // the lease, and the SAME request id retried returns the acquired lease
+        // with its one-time key. 2026-09-05 (HuaTuo): the old CLI printed the
+        // in_flight receipt and exited 2, leaving a lease held with no key.
+        body.request_id = requestId ?? `testbed-cli-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+        const waitMs = Number(takeFlag(args, "wait-ms", "90000"));
+        const sleep = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        const started = Date.now();
+        let d = await api("POST", "/device-broker/leases", body);
+        while (d.status === "in_flight") {
+          if (Date.now() - started > waitMs) {
+            err(`testbed: acquire still in_flight after ${Math.round(waitMs / 1000)}s (request ${body.request_id}${d.instance_id ? ` on ${d.instance_id}` : ""}); the broker may still hold a lease for this request — run \`testbed devices\` and release it, or retry with --request-id ${body.request_id}`);
+            return exit(2);
+          }
+          if (!json) err(`testbed: in_flight${d.instance_id ? ` on ${d.instance_id}` : ""}, retrying with the same request id…`);
+          await sleep(2000);
+          d = await api("POST", "/device-broker/leases", body);
         }
         let keyPath = null;
         if (keyOut && d.adb_private_key) {
@@ -292,6 +322,44 @@ export async function main(argv, opts) {
         out(`installed skill 'testbed' via npx skills${agents.length ? ` for ${agents.join(", ")}` : ""}${global ? " (global)" : ""}`);
         return exit(0);
       }
+      case "qa-account": {
+        const sub = args.shift();
+        switch (sub) {
+          case "list": {
+            const d = await api("GET", "/device-broker/qa-accounts");
+            const rows = d.accounts ?? [];
+            emit(d, () => rows.length
+              ? table(rows.map((a) => ({ env: a.environment, label: a.label, email: a.login_email ?? "-", visibility: a.visibility ?? "-", status: a.status ?? "-" })), ["env", "label", "email", "visibility", "status"], out)
+              : out("no QA accounts visible to you"));
+            return exit(0);
+          }
+          case "get": {
+            const label = args[0]; if (!label) throw new Error("usage: testbed qa-account get <label> [--env ENV] [--out FILE]");
+            const envName = takeFlag(args, "env"); const outPath = takeFlag(args, "out");
+            const q = envName ? `?environment=${encodeURIComponent(envName)}` : "";
+            const d = await api("GET", `/device-broker/qa-account/${encodeURIComponent(label)}${q}`);
+            if (json) { out(JSON.stringify(d, null, 2)); return exit(0); }
+            if (outPath) {
+              writeKeyFile(outPath, `${d.username ?? d.login_email ?? ""}\n${d.password ?? ""}\n`);
+              out(`qa account ${d.label ?? label} (${d.environment ?? envName ?? "?"}): username ${d.username ?? d.login_email ?? "?"}; credential written to ${outPath} (0600)`);
+            } else {
+              out(`qa account ${d.label ?? label} (${d.environment ?? envName ?? "?"}): username ${d.username ?? d.login_email ?? "?"}; password not shown — pass --out FILE or --json`);
+            }
+            return exit(0);
+          }
+          case "add": {
+            const label = args[0]; const envName = takeFlag(args, "env"); const username = takeFlag(args, "username");
+            if (!label || !envName || !username) throw new Error("usage: testbed qa-account add <label> --env ENV --username EMAIL   (password on stdin)");
+            const password = (await readStdin(opts.stdin)).replace(/\r?\n$/, "");
+            if (!password) throw new Error("password must be provided on stdin (e.g. printf '%s' \"$PW\" | testbed qa-account add …)");
+            const d = await api("PUT", `/device-broker/qa-account/${encodeURIComponent(label)}`, { environment: envName, username, password });
+            emit(d, () => out(`qa account ${d.label} (${d.environment}) ${d.secret_version > 1 ? "rotated" : "created"}, secret version ${d.secret_version}`));
+            return exit(0);
+          }
+          default:
+            throw new Error("usage: testbed qa-account <list|get|add> …");
+        }
+      }
       case "cases": {
         const d = await api("GET", "/cases");
         emit(d, () => table(d.cases.map((c) => ({ id: c.id, tier: c.tier, rev: c.revision, title: c.title })), ["id", "tier", "rev", "title"], out));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botiverse/testbed-cli",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "CLI for testbed \u2014 cloud phones and the acceptance testbed in the Raft release loop",
   "license": "MIT",
   "type": "module",