@botiverse/testbed-cli 0.5.0 → 0.5.1

package/lib/main.mjs

@@ -15,8 +15,10 @@ export const USAGE = `testbed — cloud phones + the acceptance testbed in the R
   testbed whoami                         who the API thinks you are
 
   testbed pool                           warm-pool devices and free/leased state
-  testbed acquire [--ttl MIN] [--instance ID] [--request-id ID] [--key-out FILE]
-                                         lease a phone; the ADB private key goes to --key-out (0600) or --json
+  testbed acquire [--ttl MIN] [--instance ID] [--request-id ID] [--key-out FILE] [--wait-ms N]
+                                         lease a phone; waits through in_flight (same request id) up to --wait-ms (90000);
+                                         the ADB private key goes to --key-out (0600) or --json
+  testbed <command> --help                usage only — never sends a request
   testbed devices                        your leases
   testbed renew <lease-id> [--ttl MIN]
   testbed release <lease-id>
@@ -95,6 +97,10 @@ export async function main(argv, opts) {
   const env = opts.env ?? process.env;
   const exit = opts.exit ?? ((code) => process.exit(code));
   const json = takeSwitch(args, "json");
+  // `--help` / `-h` anywhere prints usage and NEVER reaches the API. 2026-09-05:
+  // `testbed acquire --help` acquired a device (HuaTuo) because flags were
+  // only consumed by the command that expected them.
+  if (args.includes("--help") || args.includes("-h")) { out(USAGE); return exit(0); }
   const cmd = args.shift();
   const emit = (data, human) => { if (json) out(JSON.stringify(data, null, 2)); else human(); };
 
@@ -148,11 +154,24 @@ export async function main(argv, opts) {
         const body = {};
         if (ttl !== undefined) body.ttl_minutes = Number(ttl);
         if (instance) body.instance_id = instance;
-        if (requestId) body.request_id = requestId;
-        const d = await api("POST", "/device-broker/leases", body);
-        if (d.status === "in_flight") {
-          emit(d, () => out(`in_flight: request ${d.request_id} on ${d.instance_id ?? "?"} — retry acquire with --request-id ${d.request_id}`));
-          return exit(2);
+        // Always send a request id so a retry never takes a second device: the
+        // broker answers 202 in_flight (retryable) while it is still preparing
+        // the lease, and the SAME request id retried returns the acquired lease
+        // with its one-time key. 2026-09-05 (HuaTuo): the old CLI printed the
+        // in_flight receipt and exited 2, leaving a lease held with no key.
+        body.request_id = requestId ?? `testbed-cli-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+        const waitMs = Number(takeFlag(args, "wait-ms", "90000"));
+        const sleep = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        const started = Date.now();
+        let d = await api("POST", "/device-broker/leases", body);
+        while (d.status === "in_flight") {
+          if (Date.now() - started > waitMs) {
+            err(`testbed: acquire still in_flight after ${Math.round(waitMs / 1000)}s (request ${body.request_id}${d.instance_id ? ` on ${d.instance_id}` : ""}); the broker may still hold a lease for this request — run \`testbed devices\` and release it, or retry with --request-id ${body.request_id}`);
+            return exit(2);
+          }
+          if (!json) err(`testbed: in_flight${d.instance_id ? ` on ${d.instance_id}` : ""}, retrying with the same request id…`);
+          await sleep(2000);
+          d = await api("POST", "/device-broker/leases", body);
         }
         let keyPath = null;
         if (keyOut && d.adb_private_key) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botiverse/testbed-cli",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "CLI for testbed \u2014 cloud phones and the acceptance testbed in the Raft release loop",
   "license": "MIT",
   "type": "module",