@computesdk/cli 1.0.11 → 1.0.13

package/dist/index.js

@@ -708,6 +708,76 @@ var ActionsApiError = class extends Error {
     this.name = "ActionsApiError";
   }
 };
+var ActionsCliError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ActionsCliError";
+  }
+};
+function codeForStatus(status) {
+  switch (status) {
+    case 400:
+      return "bad_request";
+    case 401:
+      return "unauthenticated";
+    case 403:
+      return "forbidden";
+    case 404:
+      return "not_found";
+    case 409:
+      return "conflict";
+    case 413:
+      return "payload_too_large";
+    case 429:
+      return "rate_limited";
+    default:
+      return status >= 500 ? "server_error" : "http_error";
+  }
+}
+function errorDetails(body) {
+  if (body && typeof body === "object" && "details" in body) {
+    const details = body.details;
+    if (details && typeof details === "object" && !Array.isArray(details)) {
+      return details;
+    }
+  }
+  return void 0;
+}
+function toErrorEnvelope(error) {
+  if (error instanceof ActionsApiError) {
+    const details = errorDetails(error.body);
+    return {
+      ok: false,
+      error: {
+        code: codeForStatus(error.status),
+        message: error.message,
+        httpStatus: error.status,
+        retryable: error.status === 429 || error.status === 502 || error.status === 503 || error.status === 504,
+        ...details !== void 0 && { details }
+      }
+    };
+  }
+  if (error instanceof ActionsCliError) {
+    return { ok: false, error: { code: error.code, message: error.message, retryable: false } };
+  }
+  if (error instanceof TypeError && /fetch failed/i.test(error.message)) {
+    const cause = error.cause;
+    const detail = cause instanceof Error ? `: ${cause.message}` : "";
+    return {
+      ok: false,
+      error: { code: "network", message: `${error.message}${detail}`, retryable: true }
+    };
+  }
+  return {
+    ok: false,
+    error: {
+      code: "unknown",
+      message: error instanceof Error ? error.message : String(error),
+      retryable: false
+    }
+  };
+}
 var ActionsClient = class {
   constructor(auth, fetchImpl = fetch) {
     this.auth = auth;
@@ -834,22 +904,64 @@ function encodeWatchCursor(id, jobId, step, offset) {
   const stepPart = step === null ? "-" : step === "runner" ? "runner" : String(step);
   return `${id}:${jobId}:${stepPart}:${offset}`;
 }
-function resolveActionsAuth(opts) {
-  const apiKey = opts.apiKey || process.env.COMPUTE_API_KEY || process.env.BENCHMARKS_PLATFORM_API_KEY;
-  if (!apiKey) {
-    throw new Error(
-      "No API key. Set COMPUTE_API_KEY or pass --api-key."
-    );
-  }
+var NO_CREDENTIALS_HINT = "Set COMPUTE_API_KEY, pass --api-key, or run `compute bench auth login`.";
+async function resolveActionsAuth(opts, resolveStored = resolveStoredPlatformAuth) {
   const baseUrl = (opts.baseUrl || process.env.COMPUTE_PLATFORM_URL || process.env.BENCHMARKS_PLATFORM_URL || // legacy name
   DEFAULT_BASE_URL).replace(/\/+$/, "");
   if (!opts.allowUntrustedHost && !isTrustedActionsHost(baseUrl)) {
-    throw new Error(
+    throw new ActionsCliError(
+      "untrusted_host",
       `Refusing to send the API key to ${baseUrl} \u2014 it is not a computesdk.com or localhost host. If this is a self-hosted/dev deployment you trust, pass --allow-untrusted-host.`
     );
   }
+  if (!isSecureActionsTransport(baseUrl)) {
+    throw new ActionsCliError(
+      "insecure_transport",
+      `Refusing to send the API key over plaintext HTTP to ${baseUrl}. Use an https:// base URL; http:// is only allowed for localhost/loopback.`
+    );
+  }
+  let apiKey = opts.apiKey || process.env.COMPUTE_API_KEY || process.env.BENCHMARKS_PLATFORM_API_KEY || // legacy name
+  void 0;
+  if (!apiKey) {
+    if (!isTrustedActionsHost(baseUrl)) {
+      throw new ActionsCliError(
+        "untrusted_host_stored_auth",
+        `Refusing to use stored platform credentials with untrusted host ${baseUrl}. Pass --api-key or set COMPUTE_API_KEY to use an explicit key with --allow-untrusted-host.`
+      );
+    }
+    let stored;
+    try {
+      stored = await resolveStored({ baseUrl });
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      const detail = reason.startsWith("No credentials found") ? "No API key." : reason;
+      throw new ActionsCliError("no_credentials", `${detail} ${NO_CREDENTIALS_HINT}`);
+    }
+    apiKey = stored.apiKey || stored.token || void 0;
+  }
+  if (!apiKey) {
+    throw new ActionsCliError("no_credentials", `No API key. ${NO_CREDENTIALS_HINT}`);
+  }
   return { apiKey, baseUrl };
 }
+async function resolveStoredPlatformAuth(opts) {
+  const { resolveAuth } = await import("@benchsdk/cli");
+  const auth = await resolveAuth({ baseUrl: opts.baseUrl });
+  return { apiKey: auth.apiKey, token: auth.token };
+}
+function isLoopbackHost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
+}
+function isSecureActionsTransport(baseUrl) {
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    return false;
+  }
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && isLoopbackHost(url.hostname);
+}
 function isTrustedActionsHost(baseUrl) {
   let host;
   try {
@@ -857,7 +969,7 @@ function isTrustedActionsHost(baseUrl) {
   } catch {
     return false;
   }
-  return host === "computesdk.com" || host.endsWith(".computesdk.com") || host === "localhost" || host === "127.0.0.1" || host === "::1";
+  return host === "computesdk.com" || host.endsWith(".computesdk.com") || isLoopbackHost(host);
 }
 
 // src/actions.ts
@@ -866,8 +978,21 @@ function sanitizePathPart(name) {
   if (base === "" || base === "." || base === "..") return "artifact";
   return base;
 }
-function client(opts) {
-  return new ActionsClient(resolveActionsAuth(opts));
+async function client(opts) {
+  return new ActionsClient(await resolveActionsAuth(opts));
+}
+function assertVaultValueHost(auth) {
+  if (!isTrustedActionsHost(auth.baseUrl)) {
+    throw new ActionsCliError(
+      "untrusted_host",
+      `Refusing to send or read vault values at ${auth.baseUrl} \u2014 only computesdk.com and localhost hosts are allowed, even with --allow-untrusted-host.`
+    );
+  }
+}
+async function vaultValueClient(opts) {
+  const auth = await resolveActionsAuth(opts);
+  assertVaultValueHost(auth);
+  return new ActionsClient(auth);
 }
 function output(opts, data, render) {
   if (opts.json) {
@@ -912,14 +1037,24 @@ async function fetchRunSummary(c, runId) {
     return null;
   }
 }
-function fail(error) {
-  if (error instanceof ActionsApiError) {
+function fail(error, opts = {}) {
+  if (opts.json) {
+    process.stderr.write(JSON.stringify(toErrorEnvelope(error)) + "\n");
+  } else if (error instanceof ActionsApiError) {
     console.error(pc.red(`Error (${error.status}): ${error.message}`));
   } else {
-    console.error(pc.red(`Error: ${error.message}`));
+    console.error(pc.red(`Error: ${error instanceof Error ? error.message : String(error)}`));
   }
   process.exit(1);
 }
+function usageErrorOutput(str, write, argv = process.argv) {
+  if (argv.includes("--json")) {
+    const message = str.replace(/^error:\s*/i, "").trim();
+    write(JSON.stringify(toErrorEnvelope(new ActionsCliError("invalid_argument", message))) + "\n");
+  } else {
+    write(str);
+  }
+}
 function formatDuration(ms) {
   if (ms === null || ms === void 0) return "-";
   if (ms < 1e3) return `${ms}ms`;
@@ -1085,7 +1220,7 @@ function parseInputs(pairs) {
   for (const pair of pairs ?? []) {
     const eq = pair.indexOf("=");
     if (eq === -1) {
-      throw new Error(`Invalid --inputs entry "${pair}". Expected key=value.`);
+      throw new ActionsCliError("invalid_argument", `Invalid --inputs entry "${pair}". Expected key=value.`);
     }
     inputs[pair.slice(0, eq)] = pair.slice(eq + 1);
   }
@@ -1135,7 +1270,7 @@ function parseStep(step) {
   if (step === "runner") return "runner";
   const n = Number(step);
   if (!Number.isInteger(n) || n < 0) {
-    throw new Error(`Invalid --step "${step}". Expected a step ordinal or "runner".`);
+    throw new ActionsCliError("invalid_argument", `Invalid --step "${step}". Expected a step ordinal or "runner".`);
   }
   return n;
 }
@@ -1233,14 +1368,79 @@ function printDiscovery(d) {
   }
   console.log(pc.dim(`discovery: ${d.workflowsFound ? "workflows found" : "no workflows yet"}${d.seeded ? ", cursors seeded" : ""}`));
 }
+function dispatchBody(workflow, opts) {
+  if (!workflow.dispatchable && !opts.manual) {
+    throw new ActionsCliError(
+      "invalid_argument",
+      `Workflow "${workflow.path}" does not declare workflow_dispatch. Pass --manual to run it anyway (no inputs).`
+    );
+  }
+  if (!workflow.dispatchable && opts.inputs !== void 0 && opts.inputs.length > 0) {
+    throw new ActionsCliError(
+      "invalid_argument",
+      `Workflow "${workflow.path}" has no workflow_dispatch inputs; --manual runs of it take no --inputs.`
+    );
+  }
+  const ref = opts.ref ?? workflow.refs[0];
+  if (!ref) throw new ActionsCliError("invalid_argument", "No --ref given and the workflow has no watched refs.");
+  if (opts.providerRegion !== void 0 && opts.provider === void 0) {
+    throw new ActionsCliError("invalid_argument", "--provider-region requires --provider.");
+  }
+  return {
+    workflowId: workflow.id,
+    ref,
+    inputs: parseInputs(opts.inputs),
+    ...opts.manual && { manual: true },
+    ...opts.provider !== void 0 && {
+      provider: opts.provider,
+      ...opts.providerRegion !== void 0 && { providerRegion: opts.providerRegion }
+    }
+  };
+}
+function parseVaultKind(kind) {
+  if (kind === void 0 || kind === "secret" || kind === "variable") return kind ?? "secret";
+  throw new ActionsCliError("invalid_argument", `--kind must be secret or variable, got "${kind}".`);
+}
+function vaultPath(path5, params) {
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0) search.set(key, value);
+  }
+  const query = search.toString();
+  return query ? `${path5}?${query}` : path5;
+}
+function vaultSetBody(name, value, opts) {
+  if (value === "") throw new ActionsCliError("invalid_argument", "The value is empty.");
+  if (opts.revealable && opts.kind === "variable") {
+    throw new ActionsCliError("invalid_argument", "--revealable applies to secrets; variables are always readable.");
+  }
+  return {
+    name,
+    kind: opts.kind,
+    value,
+    ...opts.revealable && { revealable: true },
+    ...opts.description !== void 0 && { description: opts.description },
+    ...opts.labels !== void 0 && opts.labels.length > 0 && { labels: opts.labels }
+  };
+}
+function formatVaultRow(item) {
+  const flags = [
+    item.kind,
+    ...item.revealable && item.kind === "secret" ? ["revealable"] : [],
+    `v${item.version}`,
+    ...item.source === "organization" ? ["inherited"] : [],
+    ...item.overridesOrganization ? ["overrides org"] : []
+  ];
+  return `${pc.cyan(safeTerm(item.name))}  ${pc.dim(flags.join(", "))}  ${pc.dim(`updated ${safeTerm(item.updatedAt)}`)}`;
+}
 function registerActionsCommands(program2) {
-  const actions = program2.command("actions").alias("ci").description("Drive the benchmarks-platform Actions API");
-  const common = (cmd) => cmd.option("--api-key <key>", "API key (default: $COMPUTE_API_KEY)").option("--base-url <url>", "API base URL (default: https://platform.computesdk.com)").option("--allow-untrusted-host", "send the API key to a non-computesdk, non-localhost --base-url").option("--json", "print machine-readable JSON");
+  const actions = program2.command("actions").alias("ci").description("Drive the benchmarks-platform Actions API").configureOutput({ outputError: usageErrorOutput });
+  const common = (cmd) => cmd.option("--api-key <key>", "API key (default: $COMPUTE_API_KEY)").option("--base-url <url>", "API base URL (default: https://platform.computesdk.com)").option("--allow-untrusted-host", "send an explicit --api-key/env key to a non-computesdk, non-localhost --base-url (stored login credentials are never sent)").option("--json", "print machine-readable JSON");
   common(
-    actions.command("dispatch").description("Dispatch a workflow_dispatch run").argument("<repo>", "repository in owner/repo format").requiredOption("--workflow <path|name>", "workflow path or name").option("--ref <ref>", "git ref to run (default: the workflow's first watched ref)").option("--inputs <pairs...>", "workflow inputs as key=value").option("--provider <id>", "place the run on one provider (e.g. namespace, vercel:sfo1) instead of the org provider order").option("--provider-region <region>", "region for --provider (same as --provider <id>:<region>)")
+    actions.command("dispatch").description("Dispatch a workflow_dispatch run (or any workflow with --manual)").argument("<repo>", "repository in owner/repo format").requiredOption("--workflow <path|name>", "workflow path or name").option("--ref <ref>", "git ref to run (default: the workflow's first watched ref)").option("--inputs <pairs...>", "workflow inputs as key=value (workflow_dispatch inputs only)").option("--manual", "run a workflow even if it does not declare workflow_dispatch (such runs take no --inputs)").option("--provider <id>", "place the run on one provider (e.g. namespace, vercel:sfo1) instead of the org provider order").option("--provider-region <region>", "region for --provider (same as --provider <id>:<region>)")
   ).action(async (repo, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       const { workflows } = await c.get(
         "/api/v1/actions/workflows",
         { repo }
@@ -1248,26 +1448,15 @@ function registerActionsCommands(program2) {
       const workflow = matchWorkflow(workflows, opts.workflow);
       if (!workflow) {
         const choices = workflows.map((w) => `${w.path} (${w.name})`).join(", ") || "none";
-        throw new Error(
-          `No dispatchable workflow "${opts.workflow}" in ${repo}. Available: ${choices}`
+        throw new ActionsCliError(
+          "workflow_not_found",
+          `No workflow "${opts.workflow}" in ${repo}. Available: ${choices}`
         );
       }
-      const ref = opts.ref ?? workflow.refs[0];
-      if (!ref) throw new Error("No --ref given and the workflow has no watched refs.");
-      if (opts.providerRegion !== void 0 && opts.provider === void 0) {
-        throw new Error("--provider-region requires --provider.");
-      }
+      const body = dispatchBody(workflow, opts);
       const result = await c.post(
         "/api/v1/actions/dispatch",
-        {
-          workflowId: workflow.id,
-          ref,
-          inputs: parseInputs(opts.inputs),
-          ...opts.provider !== void 0 && {
-            provider: opts.provider,
-            ...opts.providerRegion !== void 0 && { providerRegion: opts.providerRegion }
-          }
-        }
+        body
       );
       const org = await c.org();
       const url = `${c.baseUrl}/${org.slug}/actions/runs/${result.runId}`;
@@ -1277,14 +1466,14 @@ function registerActionsCommands(program2) {
         console.log(`url: ${r.url}`);
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("runs").description("List recent runs for a repo").argument("<repo>", "repository in owner/repo format").option("--status <status...>", "filter by conclusion: passed, failed, running, cancelled, none").option("--branch <branch...>", "filter by branch/ref")
   ).action(async (repo, opts) => {
     try {
-      const { runs } = await client(opts).get(
+      const { runs } = await (await client(opts)).get(
         "/api/v1/actions/runs",
         { repo, status: opts.status, branch: opts.branch }
       );
@@ -1296,14 +1485,14 @@ function registerActionsCommands(program2) {
         for (const run of rs) console.log(formatRunRow(run));
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("history").description("Recent run history for a workflow \u2014 per-job/step failure rates (is this failure flaky?)").argument("<repo>", "repository in owner/repo format").requiredOption("--workflow <path|name>", "workflow path or name").option("--branch <branch...>", "narrow the window to branches/refs").option("--job <job>", "narrow the rollup to one job name or workflow job id").option("--limit <n>", "runs in the window (default 10, max 50)")
   ).action(async (repo, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       const { workflows } = await c.get(
         "/api/v1/actions/workflows",
         { repo }
@@ -1319,14 +1508,14 @@ function registerActionsCommands(program2) {
       });
       output(opts, history, (h) => console.log(formatRunHistory(h)));
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("run").description("Show a run: jobs, provider:region placement, placement attempts").argument("<run-id>", "run ID")
   ).action(async (runId, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       const run = await c.get(`/api/v1/actions/runs/${runId}`);
       const org = await c.org();
       const url = `${c.baseUrl}/${org.slug}/actions/runs/${run.id}`;
@@ -1339,37 +1528,37 @@ function registerActionsCommands(program2) {
         }
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("summary").description("Show a run's failure digest: failed jobs, failed steps, bounded log tails").argument("<run-id>", "run ID")
   ).action(async (runId, opts) => {
     try {
-      const summary = await client(opts).get(`/api/v1/actions/runs/${runId}/summary`);
+      const summary = await (await client(opts)).get(`/api/v1/actions/runs/${runId}/summary`);
       output(opts, summary, (s) => console.log(formatRunSummary(s)));
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("inspect").description("Inspect a run: resolved runner image, caches, secret names, concurrency, placement context").argument("<run-id>", "run ID")
   ).action(async (runId, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       const inspection = await c.get(
         `/api/v1/actions/runs/${runId}/state`
       );
       output(opts, inspection, (r) => console.log(formatRunInspection(r)));
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("logs").description("Print or follow a run's job logs").argument("<run-id>", "run ID").option("--job <job>", "job ID or name (default: all jobs)").option("--step <step>", 'step ordinal or "runner" (default: whole job)').option("--follow", "stream logs while the run is live")
   ).action(async (runId, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       let jobs = await listRunJobs(c, runId);
       if (opts.job) {
         const job = matchJob(jobs, opts.job);
@@ -1420,25 +1609,25 @@ function registerActionsCommands(program2) {
         }
       }
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   const providers = actions.command("providers").description("List the org's registered compute providers (regions, act/usable status)");
   common(providers).action(async (opts) => {
     try {
-      const data = await client(opts).get("/api/v1/actions/providers");
+      const data = await (await client(opts)).get("/api/v1/actions/providers");
       output(opts, data, (d) => {
         for (const p5 of d.providers) console.log(formatProviderRow(p5));
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     providers.command("configure").description("Save the org's credential for a provider (owner/admin API key)").argument("<provider>", "provider id (e.g. tensorlake, blaxel)").option("--key <key>", "provider API key (single-field credentials)").option("--field <pair...>", "credential fields as name=value (multi-field providers)").option("--verify", "run the placement probe after saving")
   ).action(async (provider, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       let body;
       if (opts.field !== void 0) {
         if (opts.key !== void 0) throw new Error("Pass either --key or --field, not both.");
@@ -1461,45 +1650,45 @@ function registerActionsCommands(program2) {
       });
       if (verification?.verified === false) process.exitCode = 1;
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     providers.command("verify").description('Probe the stored provider key with a real sandbox ("Test" in Settings)').argument("<provider>", "provider id")
   ).action(async (provider, opts) => {
     try {
-      const result = await client(opts).post(
+      const result = await (await client(opts)).post(
         `/api/v1/actions/providers/${provider}/verify`
       );
       output(opts, result, (r) => console.log(formatVerifyResult(r)));
       if (result.verified === false) process.exitCode = 1;
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     providers.command("remove").description("Delete the org's stored credential for a provider").argument("<provider>", "provider id")
   ).action(async (provider, opts) => {
     try {
-      const result = await client(opts).del(
+      const result = await (await client(opts)).del(
         `/api/v1/actions/providers/${provider}/key`
       );
       output(opts, result, (r) => {
         console.log(r.deleted ? `deleted  ${r.provider}` : `no key stored for ${r.provider}`);
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   const repos = actions.command("repos").description("List the org's connected repositories");
   common(repos).action(async (opts) => {
     try {
-      const data = await client(opts).get("/api/v1/actions/repos");
+      const data = await (await client(opts)).get("/api/v1/actions/repos");
       output(opts, data, (d) => {
         for (const r of d.repos) console.log(formatRepoRow(r));
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
@@ -1529,7 +1718,7 @@ function registerActionsCommands(program2) {
       if (opts.knownHostsFile !== void 0 && opts.sshKeyFile === void 0) {
         throw new Error("--known-hosts-file requires --ssh-key-file.");
       }
-      const result = await client(opts).post("/api/v1/actions/repos", {
+      const result = await (await client(opts)).post("/api/v1/actions/repos", {
         cloneUrl,
         ...body,
         ...opts.name !== void 0 && { name: opts.name },
@@ -1540,14 +1729,14 @@ function registerActionsCommands(program2) {
         printDiscovery(r.discovery);
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     repos.command("enable").description("Enable a repo the org can already see (granted by a GitHub App install, or a connected remote)").argument("<repo>", "repository in owner/repo format").option("--repo-id <id>", "scope to one row when two installations grant the same name")
   ).action(async (repo, opts) => {
     try {
-      const result = await client(opts).patch("/api/v1/actions/repos", {
+      const result = await (await client(opts)).patch("/api/v1/actions/repos", {
         fullName: repo,
         enabled: true,
         ...opts.repoId !== void 0 && { repoId: opts.repoId }
@@ -1557,42 +1746,110 @@ function registerActionsCommands(program2) {
         if (r.discovery) printDiscovery(r.discovery);
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     repos.command("disable").description("Disable a repo \u2014 it stays connected but no runs are scheduled").argument("<repo>", "repository in owner/repo format").option("--repo-id <id>", "scope to one row when two installations grant the same name")
   ).action(async (repo, opts) => {
     try {
-      const result = await client(opts).patch("/api/v1/actions/repos", {
+      const result = await (await client(opts)).patch("/api/v1/actions/repos", {
         fullName: repo,
         enabled: false,
         ...opts.repoId !== void 0 && { repoId: opts.repoId }
       });
       output(opts, result, (r) => console.log(`disabled  ${pc.cyan(safeTerm(r.fullName))}`));
     } catch (e) {
-      fail(e);
+      fail(e, opts);
+    }
+  });
+  const vault = actions.command("vault").description("The org vault: secrets and variables (owner/admin key)");
+  const vaultScope = (cmd) => common(cmd).option("--repo <owner/repo>", "scope to a repo's own items instead of the org's").option("--kind <kind>", "secret or variable", "secret");
+  vaultScope(
+    vault.command("ls").description("List names and metadata (never values)")
+  ).action(async (opts) => {
+    try {
+      const path5 = vaultPath("/api/v1/vault", { repo: opts.repo, kind: parseVaultKind(opts.kind) });
+      const data = await (await client(opts)).get(path5);
+      output(opts, data, (d) => {
+        for (const item of d.items) console.log(formatVaultRow(item));
+      });
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
+  vaultScope(
+    vault.command("set").description("Store a value, read from stdin (or --from-file) and sent exactly as read").argument("<name>", "item name, e.g. NPM_TOKEN").option("--from-file <path>", "read the value from a file instead of stdin").option("--revealable", "let the value be read back with `vault get` (secrets; fixed at creation)").option("--description <text>", "what the item is for").option("--labels <labels...>", "labels (fixed at creation)")
+  ).action(async (name, opts) => {
+    try {
+      if (opts.fromFile === void 0 && process.stdin.isTTY) {
+        throw new ActionsCliError(
+          "invalid_argument",
+          'Pipe the value on stdin (e.g. printf %s "$VALUE" | compute actions vault set NAME) or pass --from-file.'
+        );
+      }
+      const value = readFileSync(opts.fromFile ?? 0, "utf8");
+      const kind = parseVaultKind(opts.kind);
+      const body = vaultSetBody(name, value, { ...opts, kind });
+      const result = await (await vaultValueClient(opts)).put(
+        vaultPath("/api/v1/vault", { repo: opts.repo }),
+        body
+      );
+      output(opts, result, (r) => {
+        const where = opts.repo ? safeTerm(opts.repo) : "org";
+        console.log(`saved  ${pc.cyan(safeTerm(r.item.name))}  ${pc.dim(`(${r.item.kind}, v${r.item.version}, ${where})`)}`);
+        if (/\r?\n$/.test(value)) {
+          console.error(pc.yellow("note: the stored value ends with a newline; use printf %s rather than echo to avoid one."));
+        }
+      });
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
+  vaultScope(
+    vault.command("get").description("Print a value: any variable, or a secret created --revealable").argument("<name>", "item name")
+  ).action(async (name, opts) => {
+    try {
+      const kind = parseVaultKind(opts.kind);
+      const result = await (await vaultValueClient(opts)).post(
+        vaultPath("/api/v1/vault/reveal", { repo: opts.repo }),
+        { name, kind }
+      );
+      output(opts, result, (r) => process.stdout.write(r.value));
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
+  vaultScope(
+    vault.command("rm").description("Delete an item (with --repo, only the repo's override)").argument("<name>", "item name")
+  ).action(async (name, opts) => {
+    try {
+      const path5 = vaultPath("/api/v1/vault", { repo: opts.repo, kind: parseVaultKind(opts.kind), name });
+      const result = await (await client(opts)).del(path5);
+      output(opts, result, (r) => console.log(`deleted  ${pc.cyan(safeTerm(r.name))}  ${pc.dim(`(${r.kind})`)}`));
+    } catch (e) {
+      fail(e, opts);
     }
   });
   common(
     actions.command("cancel").description("Cancel a run").argument("<run-id>", "run ID")
   ).action(async (runId, opts) => {
     try {
-      const result = await client(opts).post(
+      const result = await (await client(opts)).post(
         `/api/v1/actions/runs/${runId}/cancel`
       );
       output(opts, result, (r) => {
         console.log(r.cancelled ? `Cancelled ${runId}` : `Run ${runId} was already finished`);
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("rerun").description("Re-run a finished run at the same commit").argument("<run-id>", "run ID")
   ).action(async (runId, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       const result = await c.post(
         `/api/v1/actions/runs/${runId}/rerun`
       );
@@ -1603,14 +1860,14 @@ function registerActionsCommands(program2) {
         console.log(`url: ${r.url}`);
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
   common(
     actions.command("artifacts").description("List or download a run's artifacts").argument("<run-id>", "run ID").option("--job <job>", "job ID or name (default: all jobs)").option("--out <dir>", "download artifacts into this directory instead of listing")
   ).action(async (runId, opts) => {
     try {
-      const c = client(opts);
+      const c = await client(opts);
       let jobs = await listRunJobs(c, runId);
       if (opts.job) {
         const job = matchJob(jobs, opts.job);
@@ -1659,7 +1916,7 @@ function registerActionsCommands(program2) {
         if (!any) console.log("No artifacts.");
       });
     } catch (e) {
-      fail(e);
+      fail(e, opts);
     }
   });
 }