@dharta/cli 0.6.77

package/src/commands/login.ts

@@ -0,0 +1,115 @@
+import { spawn } from "node:child_process";
+import { hostname } from "node:os";
+import { HttpClient } from "@dharta/sdk";
+import { cliFormatError, cliFormatNetworkError } from "../api-error.js";
+import {
+  DEFAULT_BASE_URL,
+  DEFAULT_GIT_BASE_URL,
+  saveProfile,
+} from "../config.js";
+import { deviceFlowLogin, type DeviceFlowOptions } from "../device-flow.js";
+import type { Me } from "./auth.js";
+import { normalizeHttpUrl, normalizeNonBlank } from "../validators.js";
+
+export interface LoginOptions {
+  baseUrl?: string;
+  gitBaseUrl?: string;
+  profile?: string;
+  // Direct key entry: `--with-token` pipes it via stdin (cli.ts reads the
+  // stream and passes it here); tests pass it straight in.
+  apiKey?: string;
+  fetchImpl?: typeof fetch;
+  runGit?: (args: string[]) => Promise<boolean>; // for tests
+  deviceFlow?: Partial<DeviceFlowOptions>; // test seams for the browser dance
+  log?: (line: string) => void;
+}
+
+export interface LoginResult {
+  path: string;
+  helperInstalled: boolean;
+  gitBaseUrl: string;
+  organization: { slug: string; name: string };
+  keyName: string;
+}
+
+// Default path is the RFC 8628 device flow (no key ever pasted); the
+// `--with-token` / apiKey path is the gh-parity fallback for CI and
+// air-gapped boxes.
+export async function login(opts: LoginOptions = {}): Promise<LoginResult> {
+  const baseUrl = opts.baseUrl === undefined ? DEFAULT_BASE_URL : normalizeHttpUrl(opts.baseUrl, "--base-url");
+  const gitBaseUrl = opts.gitBaseUrl === undefined ? DEFAULT_GIT_BASE_URL : normalizeHttpUrl(opts.gitBaseUrl, "--git-base-url");
+  const profileName = opts.profile === undefined ? "default" : normalizeNonBlank(opts.profile, "--profile");
+
+  const key =
+    opts.apiKey ??
+    (await deviceFlowLogin({
+      baseUrl,
+      clientName: hostname(),
+      fetchImpl: opts.fetchImpl,
+      log: opts.log,
+      ...opts.deviceFlow,
+    }));
+  if (!key) {
+    throw new Error(
+      "No API key provided. Run `dharta login` for the browser flow, or pipe a key: " +
+        "echo $DHARTA_API_KEY | dharta login --with-token",
+    );
+  }
+
+  // Validate the credential and learn who it is in one round-trip.
+  const http = new HttpClient({
+    apiKey: key,
+    baseUrl,
+    fetch: opts.fetchImpl,
+    formatError: cliFormatError,
+    formatNetworkError: cliFormatNetworkError,
+  });
+  const me = await http.request<Me>({ path: "/me" });
+
+  // RFC 0043 D8: the data-plane host this org clones karta workspaces from (the helper
+  // mints against it; the clone bytes never pass through the control plane).
+  const workspaceGitBaseUrl = me.workspace_git?.base_url;
+  const path = await saveProfile(profileName, {
+    api_key: key,
+    base_url: baseUrl,
+    git_base_url: gitBaseUrl,
+    workspace_git_base_url: workspaceGitBaseUrl,
+  });
+
+  const runGitFn = opts.runGit ?? runGit;
+
+  // RFC 0011 GIT-5: wire the credential helper so `git push dharta`
+  // never prompts. Scoped to the git host only; the key itself stays
+  // in ~/.dharta/config.toml (the helper reads it at use time, so
+  // re-login/rotation needs no re-wiring). Best effort: a machine
+  // without git still logs in fine.
+  const helperInstalled = await runGitFn([
+    "config",
+    "--global",
+    `credential.${gitBaseUrl}.helper`,
+    "!dharta git-credential",
+  ]);
+
+  // RFC 0043 D8: the same helper for the workspace clone host, plus useHttpPath so git
+  // passes the karta id in the path (the helper mints a per-karta read-only token).
+  if (workspaceGitBaseUrl) {
+    await runGitFn(["config", "--global", `credential.${workspaceGitBaseUrl}.helper`, "!dharta git-credential"]);
+    await runGitFn(["config", "--global", `credential.${workspaceGitBaseUrl}.useHttpPath`, "true"]);
+  }
+
+  return {
+    path,
+    helperInstalled,
+    gitBaseUrl,
+    organization: me.organization,
+    keyName: me.api_key.name,
+  };
+}
+
+function runGit(args: string[]): Promise<boolean> {
+  return new Promise((resolvePromise) => {
+    const proc = spawn("git", args, { stdio: "ignore" });
+    proc.on("error", () => resolvePromise(false));
+    proc.on("close", (code) => resolvePromise(code === 0));
+  });
+}

package/src/commands/logs.ts

@@ -0,0 +1,111 @@
+import { cliFormatRawError } from "../api-error.js";
+import type { CliContext } from "../context.js";
+import { validateAgentSlug } from "../agent.js";
+import { normalizeIsoTimestamp, validateIsoTimestamp } from "../validators.js";
+
+export interface LogLine {
+  ts: string;
+  level?: string;
+  message: string;
+}
+
+export interface LogsOptions {
+  tail?: boolean;
+  since?: string;
+  pollIntervalMs?: number;
+  // Stops polling after N iterations — tests pass a small number;
+  // production CLI usage leaves it undefined for "forever".
+  maxIterations?: number;
+}
+
+export function validateLogsOptions(opts: LogsOptions): void {
+  if (opts.since !== undefined) validateIsoTimestamp(opts.since, "--since");
+}
+
+// Streams or polls the agent's logs. SSE-first: if the server
+// answers with `Content-Type: text/event-stream`, we parse the stream;
+// otherwise we fall through to JSON polling with `since=`.
+//
+// Output is written line-by-line to `write` so the CLI can stream
+// directly to stdout and tests can capture the sequence.
+export async function logsTail(
+  ctx: CliContext,
+  slug: string,
+  opts: LogsOptions,
+  write: (line: string) => void,
+): Promise<number> {
+  const normalizedSlug = validateAgentSlug(slug, "agent slug");
+  const base = `/api/agents/${encodeURIComponent(normalizedSlug)}/logs`;
+  const initialSince = opts.since === undefined ? undefined : normalizeIsoTimestamp(opts.since, "--since");
+  let emitted = 0;
+  const emit = (line: LogLine): void => {
+    emitted += 1;
+    write(formatLine(line));
+  };
+
+  if (opts.tail) {
+    const res = await ctx.http.raw(`${base}?tail=1`, {
+      headers: { Accept: "text/event-stream" },
+    });
+    if (!res.ok) throw await cliFormatRawError(res);
+    const ctype = res.headers.get("content-type") ?? "";
+    if (ctype.includes("text/event-stream") && res.body) {
+      await consumeSse(res.body, emit);
+      return emitted;
+    }
+    // Fall through to polling if server didn't accept SSE.
+  }
+
+  let since = initialSince ?? new Date(Date.now() - 60_000).toISOString();
+  const maxIter = opts.maxIterations ?? Infinity;
+  for (let i = 0; i < maxIter; i++) {
+    const url = `${base}?since=${encodeURIComponent(since)}`;
+    const res = await ctx.http.request<{ data: LogLine[]; next_since?: string }>({
+      path: url,
+    });
+    for (const line of res.data) emit(line);
+    if (res.next_since) since = res.next_since;
+    if (!opts.tail) return emitted; // single shot for `--since` without `--tail`
+    await sleep(opts.pollIntervalMs ?? 2000);
+  }
+  return emitted;
+}
+
+function formatLine(line: LogLine): string {
+  const level = line.level ? `[${line.level}] ` : "";
+  return `${line.ts} ${level}${line.message}`;
+}
+
+async function consumeSse(
+  body: ReadableStream<Uint8Array>,
+  emit: (line: LogLine) => void,
+): Promise<void> {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buf = "";
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    buf += decoder.decode(value, { stream: true });
+    let idx: number;
+    while ((idx = buf.indexOf("\n\n")) >= 0) {
+      const block = buf.slice(0, idx);
+      buf = buf.slice(idx + 2);
+      const dataLine = block
+        .split("\n")
+        .filter((l) => l.startsWith("data:"))
+        .map((l) => l.slice(5).trim())
+        .join("\n");
+      if (!dataLine) continue;
+      try {
+        emit(JSON.parse(dataLine) as LogLine);
+      } catch {
+        emit({ ts: new Date().toISOString(), message: dataLine });
+      }
+    }
+  }
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((r) => setTimeout(r, ms));
+}

package/src/commands/members.ts

@@ -0,0 +1,109 @@
+import { randomUUID } from "node:crypto";
+import type { CliContext } from "../context.js";
+import { table } from "../output.js";
+import { closestChoice, normalizeNonBlank, parsePositiveInteger } from "../validators.js";
+
+const MEMBER_ROLES = ["owner", "admin", "developer", "billing", "viewer"] as const;
+type MemberRole = (typeof MEMBER_ROLES)[number];
+
+export interface MemberRow {
+  id: number;
+  email: string;
+  role: string;
+}
+
+export interface InvitationRow {
+  id: number;
+  email: string;
+  role: string;
+}
+
+interface MembersEnvelope {
+  data: MemberRow[];
+  invitations: InvitationRow[];
+}
+
+export async function membersListData(ctx: CliContext): Promise<MembersEnvelope> {
+  return ctx.http.request<MembersEnvelope>({ path: "/api/members" });
+}
+
+export async function membersList(ctx: CliContext): Promise<string> {
+  const res = await membersListData(ctx);
+  const members = res.data.length ? table(res.data.map((m) => ({ id: String(m.id), email: m.email, role: m.role }))) : "No members.";
+  const invites = res.invitations.length
+    ? table(res.invitations.map((i) => ({ id: String(i.id), email: i.email, role: i.role })))
+    : "No pending invitations. Invite someone with: dharta members invite <email> --role viewer";
+  return `Members\n${members}\n\nInvitations\n${invites}`;
+}
+
+export async function membersInviteData(ctx: CliContext, email: string, role: string): Promise<{ invitation: InvitationRow }> {
+  validateMembersInviteInput(email);
+  const normalizedEmail = normalizeEmail(email);
+  const normalizedRole = normalizeRole(role);
+  return ctx.http.request<{ invitation: InvitationRow }>({
+    method: "POST",
+    path: "/api/members/invitations",
+    body: { email: normalizedEmail, role: normalizedRole },
+    headers: { "Idempotency-Key": randomUUID() },
+  });
+}
+
+export async function membersInvite(ctx: CliContext, email: string, role: string): Promise<string> {
+  const res = await membersInviteData(ctx, email, role);
+  return `Invited ${res.invitation.email} as ${res.invitation.role}.`;
+}
+
+export function validateMembersInviteInput(email: string): void {
+  normalizeEmail(email);
+}
+
+export async function membersSetRoleData(ctx: CliContext, id: string, role: string): Promise<{ member: MemberRow }> {
+  const memberId = parsePositiveInteger(id, "member id");
+  const normalizedRole = normalizeRole(role);
+  return ctx.http.request<{ member: MemberRow }>({
+    method: "PATCH",
+    path: `/api/members/${encodeURIComponent(memberId)}`,
+    body: { role: normalizedRole },
+    headers: { "Idempotency-Key": randomUUID() },
+  });
+}
+
+export async function membersSetRole(ctx: CliContext, id: string, role: string): Promise<string> {
+  const res = await membersSetRoleData(ctx, id, role);
+  return `${res.member.email} is now ${res.member.role}.`;
+}
+
+export async function membersRemoveData(ctx: CliContext, id: string): Promise<{ id: string; removed: boolean }> {
+  const memberId = parsePositiveInteger(id, "member id");
+  await ctx.http.request<void>({
+    method: "DELETE",
+    path: `/api/members/${encodeURIComponent(memberId)}`,
+    headers: { "Idempotency-Key": randomUUID() },
+  });
+  return { id: String(memberId), removed: true };
+}
+
+export async function membersRemove(ctx: CliContext, id: string): Promise<string> {
+  const res = await membersRemoveData(ctx, id);
+  return `Removed member ${res.id}.`;
+}
+
+function normalizeEmail(email: string): string {
+  const normalized = email.trim();
+  if (!normalized) {
+    throw new Error("Member email cannot be blank.");
+  }
+  return normalized;
+}
+
+function normalizeRole(role: string): MemberRole {
+  const normalized = normalizeNonBlank(role, "Member role");
+  if ((MEMBER_ROLES as readonly string[]).includes(normalized)) {
+    return normalized as MemberRole;
+  }
+  const suggestion = closestChoice(normalized, MEMBER_ROLES);
+  throw new Error(
+    `Unknown member role ${normalized}. Allowed roles: ${MEMBER_ROLES.join(", ")}.` +
+      (suggestion ? ` Did you mean ${suggestion}?` : ""),
+  );
+}

package/src/commands/model-keys.ts

@@ -0,0 +1,278 @@
+import { randomUUID } from "node:crypto";
+import type { CliContext } from "../context.js";
+import type { ModelApiFormat, ModelKey, ModelKeyProvider } from "@dharta/sdk";
+import { fmtTs, table } from "../output.js";
+import { closestChoice, normalizeHttpUrl, normalizeNonBlank, parsePositiveInteger } from "../validators.js";
+
+interface ListEnvelope<T> {
+  data: T[];
+}
+
+interface ModelKeyEnvelope {
+  model_key: ModelKey;
+}
+
+const MODEL_KEY_PROVIDERS = ["anthropic", "openai", "bedrock", "vertex", "openrouter", "xai", "google"] as const;
+export const MODEL_API_FORMATS = [
+  "anthropic_messages",
+  "openai_chat_completions",
+  "openai_responses",
+  "bedrock_converse",
+  "vertex_generate_content",
+] as const satisfies readonly ModelApiFormat[];
+const MODEL_KEY_AUTH_TYPES = ["api_key", "oauth_subscription"] as const;
+type ModelKeyAuthType = (typeof MODEL_KEY_AUTH_TYPES)[number];
+
+export interface ModelKeyCreateOptions {
+  key?: string;
+  keyStdin?: boolean;
+  authType?: string;
+  endpointUrl?: string;
+  apiFormat?: string;
+}
+
+export async function modelKeysListData(ctx: CliContext): Promise<ModelKey[]> {
+  const res = await ctx.http.request<ListEnvelope<ModelKey>>({ path: "/model_keys" });
+  return res.data;
+}
+
+export async function modelKeysList(ctx: CliContext): Promise<string> {
+  const keys = await modelKeysListData(ctx);
+  if (keys.length === 0) return "No model keys. Store one with: dharta model-keys create <provider> <name> --key-stdin";
+  return table(keys.map((key) => ({
+    id: String(key.id),
+    provider: key.provider,
+    name: key.name,
+    tail: key.tail,
+    created: fmtTs(key.created_at),
+    revoked: fmtTs(key.revoked_at),
+  })));
+}
+
+export async function modelKeysCreateData(
+  ctx: CliContext,
+  provider: ModelKeyProvider,
+  name: string,
+  opts: ModelKeyCreateOptions = {},
+): Promise<ModelKey> {
+  validateModelKeysCreateOptions(provider, name, opts);
+  const normalizedProvider = normalizeProvider(provider);
+  const normalizedName = normalizeModelKeyName(name);
+  const plaintext = await resolvePlaintext(opts);
+  const normalizedAuthType = opts.authType === undefined ? undefined : normalizeAuthType(opts.authType);
+  const body: Record<string, string> = { provider: normalizedProvider, name: normalizedName, plaintext };
+  if (normalizedAuthType) body.auth_type = normalizedAuthType;
+  if (opts.endpointUrl) body.endpoint_url = normalizeEndpointUrl(opts.endpointUrl);
+  if (opts.apiFormat) body.api_format = normalizeApiFormat(opts.apiFormat);
+  try {
+    const res = await ctx.http.request<ModelKeyEnvelope>({
+      method: "POST",
+      path: "/model_keys",
+      body,
+      headers: { "Idempotency-Key": randomUUID() },
+    });
+    return res.model_key;
+  } catch (error) {
+    throw addModelKeysWriteScopeGuidance(error);
+  }
+}
+
+export async function modelKeysCreate(
+  ctx: CliContext,
+  provider: ModelKeyProvider,
+  name: string,
+  opts: ModelKeyCreateOptions = {},
+): Promise<string> {
+  const key = await modelKeysCreateData(ctx, provider, name, opts);
+  return `Stored ${key.provider} connector ${key.name} (${key.id}).`;
+}
+
+export function validateModelKeysCreateOptions(provider: ModelKeyProvider, name: string, opts: ModelKeyCreateOptions = {}): void {
+  const normalizedProvider = normalizeProvider(provider);
+  normalizeModelKeyName(name);
+  const normalizedAuthType = opts.authType === undefined ? undefined : normalizeAuthType(opts.authType);
+  if (normalizedAuthType === "oauth_subscription" && normalizedProvider !== "anthropic") {
+    throw new Error("--auth-type oauth_subscription is only supported for the anthropic provider.");
+  }
+  if (opts.key !== undefined && opts.keyStdin) {
+    throw new Error("Use either --key or --key-stdin, not both.");
+  }
+  if (opts.key !== undefined) {
+    normalizePlaintext(opts.key, "--key");
+  } else if (!opts.keyStdin) {
+    throw new Error("Model key plaintext is required. Pass --key or --key-stdin.");
+  } else if (process.stdin.isTTY) {
+    throw new Error(
+      "No piped input. Usage: echo $PROVIDER_API_KEY | dharta model-keys create anthropic Claude --key-stdin",
+    );
+  }
+  if (opts.endpointUrl !== undefined) {
+    normalizeEndpointUrl(opts.endpointUrl);
+  }
+  if (opts.apiFormat !== undefined) {
+    normalizeApiFormat(opts.apiFormat);
+  }
+}
+
+function normalizeProvider(provider: ModelKeyProvider): ModelKeyProvider {
+  const normalized = normalizeNonBlank(provider, "Model key provider");
+  if ((MODEL_KEY_PROVIDERS as readonly string[]).includes(normalized)) {
+    return normalized as ModelKeyProvider;
+  }
+  const suggestion = closestChoice(normalized, MODEL_KEY_PROVIDERS);
+  throw new Error(
+    `Unknown model key provider ${normalized}. Allowed providers: ${MODEL_KEY_PROVIDERS.join(", ")}.` +
+      (suggestion ? ` Did you mean ${suggestion}?` : ""),
+  );
+}
+
+function normalizeAuthType(authType: string): ModelKeyAuthType {
+  const normalized = normalizeNonBlank(authType, "--auth-type");
+  if ((MODEL_KEY_AUTH_TYPES as readonly string[]).includes(normalized)) {
+    return normalized as ModelKeyAuthType;
+  }
+  const suggestion = closestChoice(normalized, MODEL_KEY_AUTH_TYPES);
+  throw new Error(
+    `Unknown --auth-type ${normalized}. Allowed auth types: ${MODEL_KEY_AUTH_TYPES.join(", ")}.` +
+      (suggestion ? ` Did you mean ${suggestion}?` : ""),
+  );
+}
+
+function normalizeApiFormat(apiFormat: string): ModelApiFormat {
+  const normalized = normalizeNonBlank(apiFormat, "--api-format");
+  if ((MODEL_API_FORMATS as readonly string[]).includes(normalized)) {
+    return normalized as ModelApiFormat;
+  }
+  const suggestion = closestChoice(normalized, MODEL_API_FORMATS);
+  throw new Error(
+    `Unknown --api-format ${normalized}. Allowed API formats: ${MODEL_API_FORMATS.join(", ")}.` +
+      (suggestion ? ` Did you mean ${suggestion}?` : ""),
+  );
+}
+
+export async function prepareModelKeysCreateOptions(
+  provider: ModelKeyProvider,
+  name: string,
+  opts: ModelKeyCreateOptions = {},
+  read: () => Promise<string> = readModelKeyStdin,
+): Promise<ModelKeyCreateOptions> {
+  validateModelKeysCreateOptions(provider, name, opts);
+  if (!opts.keyStdin) return opts;
+  return { ...opts, key: normalizeModelKeyStdin(await read()), keyStdin: false };
+}
+
+export async function modelKeysRevokeData(ctx: CliContext, id: string): Promise<{ id: number; revoked: boolean }> {
+  const normalizedId = normalizeNonBlank(id, "Model key id");
+  const numericId = parseModelKeyId(normalizedId);
+  try {
+    await ctx.http.request<void>({
+      method: "DELETE",
+      path: `/model_keys/${encodeURIComponent(normalizedId)}`,
+      headers: { "Idempotency-Key": randomUUID() },
+    });
+  } catch (error) {
+    throw addModelKeysWriteScopeGuidance(error);
+  }
+  return { id: numericId, revoked: true };
+}
+
+export async function modelKeysRevoke(ctx: CliContext, id: string): Promise<string> {
+  const res = await modelKeysRevokeData(ctx, id);
+  return `Revoked ${res.id}.`;
+}
+
+export function validateModelKeyId(id: string): void {
+  normalizeModelKeyId(id);
+}
+
+async function resolvePlaintext(opts: ModelKeyCreateOptions): Promise<string> {
+  if (opts.key !== undefined && opts.keyStdin) {
+    throw new Error("Use either --key or --key-stdin, not both.");
+  }
+  if (opts.key !== undefined) return normalizePlaintext(opts.key, "--key");
+  if (opts.keyStdin) {
+    return readModelKeyStdin();
+  }
+  throw new Error("Model key plaintext is required. Pass --key or --key-stdin.");
+}
+
+async function readModelKeyStdin(): Promise<string> {
+  if (process.stdin.isTTY) {
+    throw new Error(
+      "No piped input. Usage: echo $PROVIDER_API_KEY | dharta model-keys create anthropic Claude --key-stdin",
+    );
+  }
+  const chunks: Buffer[] = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  return normalizeModelKeyStdin(Buffer.concat(chunks).toString("utf8"));
+}
+
+function normalizeModelKeyStdin(value: string): string {
+  const text = value.trim();
+  if (text) return text;
+  throw new Error(
+    "No model key on stdin. Usage: echo $PROVIDER_API_KEY | dharta model-keys create anthropic Claude --key-stdin",
+  );
+}
+
+function normalizeModelKeyName(name: string): string {
+  const normalized = name.trim();
+  if (!normalized) {
+    throw new Error("Model key name cannot be blank.");
+  }
+  return normalized;
+}
+
+function normalizeModelKeyId(id: string): string {
+  const normalized = normalizeNonBlank(id, "Model key id");
+  parseModelKeyId(normalized);
+  return normalized;
+}
+
+function parseModelKeyId(id: string): number {
+  return parsePositiveInteger(id, "Model key id");
+}
+
+function normalizePlaintext(value: string, flag: string): string {
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new Error(`${flag} cannot be blank.`);
+  }
+  return normalized;
+}
+
+function normalizeEndpointUrl(value: string): string {
+  const normalized = normalizeHttpUrl(value, "--endpoint-url");
+  const parsed = new URL(normalized);
+  if (parsed.protocol !== "https:") {
+    throw new Error("--endpoint-url must use https.");
+  }
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new Error("--endpoint-url cannot include credentials, a query string, or a fragment.");
+  }
+  return normalized;
+}
+
+// Storing or revoking a connector needs `model_keys:write`, a tenant-admin
+// scope that the `dharta login` device-flow credential deliberately never
+// carries (that key is long-lived and non-admin, so it can't hold a
+// forced-expiry admin scope). A CLI login therefore always 403s here. The
+// generic scope hint says "manage key scopes", but the login key's scopes are
+// fixed — you cannot add the scope to it — so name the real path: store the
+// connector in the dashboard, or mint a bounded key and re-auth with a token.
+function addModelKeysWriteScopeGuidance(error: unknown): Error {
+  if (!(error instanceof Error)) return new Error(String(error));
+  const status = (error as Error & { status?: unknown }).status;
+  if (
+    status === 403 &&
+    /model_keys:write/.test(error.message) &&
+    !error.message.includes("dharta login --with-token")
+  ) {
+    error.message +=
+      `${error.message.endsWith(".") ? "" : "."} ` +
+      "The `dharta login` credential cannot hold model_keys:write. Store the connector from the dashboard " +
+      "(`dharta open model-keys`), or mint a bounded key with model_keys:write there (`dharta open api-keys`) " +
+      "and re-authenticate with `dharta login --with-token`.";
+  }
+  return error;
+}