@easybits.cloud/cli 0.5.0 → 0.6.0

package/README.md

@@ -17,7 +17,7 @@ Requires Node 22+.
 
 ```bash
 easybits login                       # opens your browser (OAuth2 + PKCE); session renews itself
-easybits login eb_sk_live_YOUR_KEY   # or save an API key instead
+easybits login - < key.txt           # or save an API key, read from stdin (never in argv)
 easybits usage
 easybits logout
 ```
@@ -25,13 +25,14 @@ easybits logout
 Running a command without a session in a terminal starts the login automatically;
 without a terminal (agents, CI) it exits `3`. Precedence: `EASYBITS_API_KEY` env var >
 `--token <key>` > browser session > saved API key. Keys: https://www.easybits.cloud/dash/developer.
+In CI and agents, `EASYBITS_API_KEY` needs no login at all.
 
 ## Commands
 
 ```bash
 # Sandboxes (alias: sb)
 easybits sandboxes ls
-easybits sandboxes create --template node --name scratch
+easybits sandboxes create --template node --name scratch --dotenv .env
 easybits sandboxes get sb_abc123
 easybits sandboxes exec sb_abc123 -- npm test
 easybits sandboxes logs sb_abc123 --unit myapp --lines 100
@@ -41,7 +42,7 @@ easybits sandboxes files write sb_abc123 /data/work/app.js ./app.js
 easybits sandboxes suspend sb_abc123
 easybits sandboxes resume sb_abc123
 easybits sandboxes snapshot sb_abc123 --name before-upgrade
-easybits sandboxes destroy sb_abc123
+easybits sandboxes destroy sb_abc123 --yes
 
 # Hosting: permanent machines (alias: deploy)
 easybits machines ls
@@ -50,7 +51,7 @@ easybits machines releases sb_abc123
 easybits machines logs sb_abc123 --grep ERROR
 easybits machines rollback sb_abc123 rel_789
 easybits machines secrets ls sb_abc123
-easybits machines secrets set sb_abc123 DATABASE_URL=postgres://...
+easybits machines secrets set sb_abc123 --dotenv .env.production   # - reads stdin
 easybits machines secrets unset sb_abc123 DATABASE_URL
 easybits init --port 3000            # GitHub Actions workflow that deploys on every push
 
@@ -58,24 +59,25 @@ easybits init --port 3000            # GitHub Actions workflow that deploys on e
 easybits domains ls sb_abc123
 easybits domains add sb_abc123 shop.example.com --port 3000
 easybits domains verify sb_abc123 shop.example.com
-easybits domains rm sb_abc123 shop.example.com
+easybits domains rm sb_abc123 shop.example.com --yes
 
 # Databases
 easybits db ls
 easybits db create leads
+easybits db tables leads             # tables, row counts, columns
 easybits db query leads "SELECT * FROM leads" --json
-easybits db rm leads
+easybits db rm leads --yes
 
 # Agents
 easybits agents ls
-easybits agents create --template goose --name helper
+easybits agents create --template goose --name helper --dotenv .env
 easybits agents message ag_123 "hello"
-easybits agents destroy ag_123
+easybits agents destroy ag_123 --yes
 
 # Files, websites, account
 easybits files ls
 easybits files upload ./report.pdf
-easybits files delete FILE_ID
+easybits files delete FILE_ID --yes
 easybits websites ls
 easybits usage
 
@@ -86,7 +88,18 @@ easybits ssh-key       # public key for sandbox SSH
 easybits docs cli      # a docs section as markdown (--en for English)
 ```
 
-Every command has help with examples: `easybits <command> <subcommand> --help`.
+Every command has help with examples: `easybits <command> <subcommand> --help`
+(or `easybits help <command> <subcommand>`). A typo gets a "Did you mean" suggestion.
+
+**Destructive commands** (`db rm`, `agents destroy`, `sandboxes destroy`, `domains rm`,
+`files delete`) ask before acting in a terminal: `[y/N]`, or typing the name/id for
+irreversible ones (a database, an agent, a permanent sandbox). Without a terminal they
+never prompt: pass `--yes` / `-y`, or they exit `2`.
+
+**Secrets** go in a dotenv file or on stdin, never in argv (visible in `ps` and shell
+history): `--dotenv <path>` (`KEY=VALUE` lines, `-` = stdin) on `sandboxes create|exec|resume`,
+`agents create` and `machines secrets set`. `--env K=V` stays for non-secret values and wins
+over the file. (It is not called `--env-file` because Node 22 intercepts that flag name.)
 
 ## SSH over 443
 
@@ -103,11 +116,21 @@ Host *.ghosty
 - `--json`: stdout is JSON only, errors included: `{"error":"…","code":3,"hint":"…"}` (`code` = exit code).
 - Exit codes: `0` ok · `1` API error · `2` usage error · `3` no session, expired or rejected.
 - Login for a person: `easybits login --json` prints `{"event":"login_url","url":…}` first (show it to them), then `{"event":"logged_in","email":…}`.
+- Destructive commands need `--yes` (no TTY means no prompt: exit `2` with the exact command to rerun).
 - `sandboxes exec` without `--json` exits with the remote command's code; with `--json` it exits 0 and reports `exitCode`.
 - Skill: `npx skills add https://easybits.cloud` (includes `easybits-cli`).
 
 Full reference: https://www.easybits.cloud/docs#cli · https://www.easybits.cloud/en/docs/cli.md
 
+## Changes in 0.6.0
+
+- **Breaking for scripts:** `db rm`, `agents destroy`, `sandboxes destroy`, `domains rm` and
+  `files delete` now require `--yes` when not running in a terminal (exit `2` otherwise).
+- `--dotenv <path|->` for env vars and secrets; `easybits login -` / `--with-token` reads the key from stdin.
+  `login <api-key>` and `secrets set KEY=VALUE` still work but are no longer advertised.
+- `easybits db tables <db>`: tables with row counts and columns (`--json`: `[{name, rows, columns:[{name,type,pk}]}]`).
+- "Did you mean" for unknown commands and subcommands; `easybits help <command> <subcommand>`.
+
 ## License
 
 MIT

package/dist/index.js

@@ -6,6 +6,9 @@ import { parseArgs } from "util";
 // src/commands/account.ts
 import { resolveBaseUrl as resolveBaseUrl3 } from "@easybits.cloud/sdk";
 
+// src/args.ts
+import { existsSync, readFileSync } from "fs";
+
 // src/errors.ts
 import { EasybitsError } from "@easybits.cloud/sdk";
 var EXIT = { OK: 0, API: 1, USAGE: 2, AUTH: 3 };
@@ -34,24 +37,35 @@ function notLoggedIn() {
   return new CliError(
     "Not logged in.",
     EXIT.AUTH,
-    "Run: easybits login   (or: easybits login <api-key>, or set EASYBITS_API_KEY)",
+    "Run: easybits login   (or: easybits login - < key-file, or set EASYBITS_API_KEY)",
     "not_logged_in"
   );
 }
 function apiMessage(body) {
   try {
     const j = JSON.parse(body);
+    if (typeof j.error === "string" && typeof j.message === "string") return { message: `${j.error}: ${j.message}`, kind: j.error };
+    if (typeof j.code === "string" && typeof j.error === "string") return { message: `${j.code}: ${j.error}`, kind: j.code };
     const msg = j.message ?? j.error ?? j.detail;
-    if (typeof msg === "string") return msg;
-    if (msg) return JSON.stringify(msg);
+    if (typeof msg === "string") return { message: msg };
+    if (msg) return { message: JSON.stringify(msg) };
   } catch {
   }
-  return body.trim() || "empty response";
+  return { message: body.trim() || "empty response" };
 }
+var KIND_HINTS = {
+  SandboxBusy: "A snapshot or fork is running on this sandbox. Wait a few minutes and retry (easybits sb get <id> shows `activity`).",
+  SandboxUnreachable: "The sandbox is not answering inside. Wait and retry; if it persists, destroy it.",
+  SandboxHostTimeout: "The operation may still be running. Check `easybits sb get <id>` and retry in a few minutes.",
+  SandboxHostError: "The sandbox host failed. Retry; if it persists, contact support.",
+  SQL_ERROR: "Fix the SQL statement.",
+  DATABASE_STORAGE_MISSING: "This database has no storage; its data is unavailable. Delete it (easybits db rm) and create a new one.",
+  DATABASE_BACKEND_ERROR: "The database backend failed. Retry in a moment."
+};
 function toCliError(err) {
   if (err instanceof CliError) return err;
   if (err instanceof EasybitsError) {
-    const message2 = apiMessage(err.body);
+    const { message: message2, kind } = apiMessage(err.body);
     if (err.status === 401) {
       return new CliError(
         `Credentials rejected (401): ${message2}`,
@@ -61,7 +75,7 @@ function toCliError(err) {
         401
       );
     }
-    const hint = err.status === 403 ? "Your key may lack the scope for this action (READ/WRITE/DELETE)." : err.status === 404 ? "Check the id. List what you have with the matching `ls` command." : err.status === 402 ? "Plan limit reached. See: easybits usage" : void 0;
+    const hint = (kind && KIND_HINTS[kind]) ?? (err.status === 403 ? "Your key may lack the scope for this action (READ/WRITE/DELETE)." : err.status === 404 ? "Check the id. List what you have with the matching `ls` command." : err.status === 402 ? "Plan limit reached. See: easybits usage" : void 0);
     return new CliError(`API error ${err.status}: ${message2}`, EXIT.API, hint, "api_error", err.status);
   }
   const message = err instanceof Error ? err.message : String(err);
@@ -106,6 +120,34 @@ async function readStdin() {
   for await (const c of process.stdin) chunks.push(c);
   return Buffer.concat(chunks);
 }
+var ENV_FILE_OPTION = {
+  dotenv: { type: "string", value: "path", description: "KEY=VALUE lines (dotenv); - reads stdin. Use it for secrets" }
+};
+async function readEnvFile(path, usage2) {
+  let text;
+  if (path === "-") {
+    if (process.stdin.isTTY) throw usageError("--dotenv - expects KEY=VALUE lines on stdin.", usage2);
+    text = (await readStdin()).toString("utf8");
+  } else {
+    if (!existsSync(path)) throw usageError(`File not found: ${path}`, usage2);
+    text = readFileSync(path, "utf8");
+  }
+  const out = {};
+  for (const [n, raw] of text.split(/\r?\n/).entries()) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const m = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(.*)$/.exec(line);
+    if (!m) throw usageError(`${path === "-" ? "stdin" : path}:${n + 1}: expected KEY=VALUE.`, usage2);
+    let v = m[2];
+    if (v.length >= 2 && (v[0] === '"' || v[0] === "'") && v.endsWith(v[0])) v = v.slice(1, -1);
+    out[m[1]] = v;
+  }
+  return out;
+}
+async function envFrom(ctx, usage2) {
+  const file = str(ctx, "dotenv");
+  return { ...file ? await readEnvFile(file, usage2) : {}, ...pairs(list(ctx, "env"), usage2) };
+}
 
 // src/output.ts
 function emit(ctx, data, human) {
@@ -145,7 +187,7 @@ import { EasybitsClient, resolveBaseUrl as resolveBaseUrl2 } from "@easybits.clo
 import { createHash, randomBytes } from "crypto";
 import { createServer } from "http";
 import { spawn } from "child_process";
-import { chmodSync, readFileSync, writeFileSync } from "fs";
+import { chmodSync, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
 import { resolveBaseUrl } from "@easybits.cloud/sdk";
@@ -154,7 +196,7 @@ var LOGIN_TIMEOUT_MS = 5 * 6e4;
 var RC_PATH = join(homedir(), ".easybitsrc");
 function readRc() {
   try {
-    return JSON.parse(readFileSync(RC_PATH, "utf8"));
+    return JSON.parse(readFileSync2(RC_PATH, "utf8"));
   } catch {
     return {};
   }
@@ -339,20 +381,28 @@ var login = {
   name: "login",
   group: "Account",
   summary: "Sign in with your browser (or save an API key)",
-  synopsis: "login [api-key]",
+  synopsis: "login [-]",
   leaf: {
     summary: "Sign in with your browser (OAuth2 + PKCE), or save an API key instead",
-    usage: "easybits login [api-key] [--no-browser]",
+    usage: "easybits login [-|--with-token] [--no-browser]",
     options: {
-      "no-browser": { type: "boolean", description: "Only print the sign-in URL (e.g. for an agent to relay it)" }
+      "no-browser": { type: "boolean", description: "Only print the sign-in URL (e.g. for an agent to relay it)" },
+      "with-token": { type: "boolean", description: "Read an API key from stdin instead of the browser (same as -)" }
     },
     examples: [
-      "easybits login                        # opens the browser; waits for you",
-      'easybits login --json                 # agents: prints {"event":"login_url"} first',
-      "easybits login eb_sk_live_xxxxxxxx    # API key instead of the browser (validated first)"
+      "easybits login                               # opens the browser; waits for you",
+      'easybits login --json                        # agents: prints {"event":"login_url"} first',
+      "easybits login - < key.txt                   # API key from stdin (validated first)",
+      "printenv EB_KEY | easybits login --with-token",
+      "EASYBITS_API_KEY=\u2026 easybits usage            # CI/agents: the env var needs no login at all"
     ],
     async run(ctx) {
-      const key = ctx.args[0];
+      let key = ctx.args[0];
+      if (key === "-" || bool(ctx, "with-token")) {
+        if (process.stdin.isTTY) throw usageError("Pipe the API key on stdin: easybits login - < key.txt", this.usage);
+        key = (await readStdin()).toString("utf8").trim();
+        if (!key) throw usageError("Empty API key on stdin.", this.usage);
+      }
       if (key) {
         const email2 = await fetchEmail(key);
         const { oauth: _drop, ...rest } = readRc();
@@ -517,8 +567,49 @@ var mcp = {
 };
 
 // src/commands/files.ts
-import { existsSync, readFileSync as readFileSync2, statSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, statSync } from "fs";
 import { basename, extname } from "path";
+
+// src/prompt.ts
+import { createInterface } from "readline/promises";
+var YES_OPTION = {
+  yes: { type: "boolean", short: "y", description: "Skip the confirmation (required without a terminal)" }
+};
+function sameCommand() {
+  const argv2 = process.argv.slice(2).map((a) => /^[\w@%+=:,./-]+$/.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`);
+  return `easybits ${argv2.join(" ")}`;
+}
+async function ask(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return (await rl.question(question)).trim();
+  } catch {
+    process.stderr.write("\n");
+    return "";
+  } finally {
+    rl.close();
+  }
+}
+function requireYesIfHeadless(ctx) {
+  if (bool(ctx, "yes") || interactive(ctx)) return;
+  throw new CliError("--yes required when not running interactively.", EXIT.USAGE, `Run: ${sameCommand()} --yes`, "usage");
+}
+async function confirm(ctx, action, opts = {}) {
+  if (bool(ctx, "yes")) return;
+  requireYesIfHeadless(ctx);
+  if (opts.typeName) {
+    process.stderr.write(`${action}
+This cannot be undone.
+`);
+    const answer2 = await ask(`Type "${opts.typeName}" to confirm: `);
+    if (answer2 !== opts.typeName) throw new CliError("Aborted: the name did not match.", EXIT.USAGE, void 0, "aborted");
+    return;
+  }
+  const answer = await ask(`${action} [y/N] `);
+  if (!/^y(es)?$/i.test(answer)) throw new CliError("Aborted.", EXIT.USAGE, void 0, "aborted");
+}
+
+// src/commands/files.ts
 var MIME = {
   pdf: "application/pdf",
   png: "image/png",
@@ -569,14 +660,14 @@ var files = {
       examples: ["easybits files upload ./report.pdf", "easybits files upload ./logo.png --json"],
       async run(ctx) {
         const path = need(ctx, 0, "path", this.usage);
-        if (!existsSync(path)) throw usageError(`File not found: ${path}`, this.usage);
+        if (!existsSync2(path)) throw usageError(`File not found: ${path}`, this.usage);
         const size = statSync(path).size;
         const contentType = MIME[extname(path).slice(1).toLowerCase()] || "application/octet-stream";
         const eb = await getClient(ctx);
         const data = await eb.uploadFile({ fileName: basename(path), contentType, size });
         const res = await fetch(data.putUrl, {
           method: "PUT",
-          body: readFileSync2(path),
+          body: readFileSync3(path),
           headers: { "Content-Type": contentType }
         });
         if (!res.ok) throw new CliError(`Upload failed: storage answered ${res.status}`, 1, void 0, "upload_failed", res.status);
@@ -586,10 +677,13 @@ var files = {
     delete: {
       aliases: ["rm"],
       summary: "Delete a file (soft delete, 7-day trash)",
-      usage: "easybits files delete <file-id>",
-      examples: ["easybits files delete 6650f0c2a1b2c3d4e5f60718"],
+      usage: "easybits files delete <file-id> [--yes]",
+      options: { ...YES_OPTION },
+      examples: ["easybits files delete 6650f0c2a1b2c3d4e5f60718", "easybits files rm 6650f0c2a1b2c3d4e5f60718 --yes"],
       async run(ctx) {
         const id = need(ctx, 0, "file-id", this.usage);
+        requireYesIfHeadless(ctx);
+        await confirm(ctx, `Delete file ${id}? (recoverable from trash for 7 days)`);
         const eb = await getClient(ctx);
         const r = await eb.deleteFile(id);
         emit(ctx, r, () => console.log("Deleted"));
@@ -599,7 +693,7 @@ var files = {
 };
 
 // src/commands/init.ts
-import { existsSync as existsSync2, mkdirSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync, writeFileSync as writeFileSync2 } from "fs";
 var init = {
   name: "init",
   group: "Hosting",
@@ -616,7 +710,7 @@ var init = {
     async run(ctx) {
       const appDir = str(ctx, "app-dir") ?? "/srv/app";
       const port = str(ctx, "port") ?? "3000";
-      if (!existsSync2("package.json")) {
+      if (!existsSync3("package.json")) {
         throw usageError("No package.json here. Run this at the root of your app's repo.", this.usage);
       }
       const workflow = `# Despliegue a EasyBits en cada push a main.
@@ -793,7 +887,7 @@ From then on, every push to main deploys.`));
 // src/commands/ssh.ts
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
-import { existsSync as existsSync3, readFileSync as readFileSync3, mkdirSync as mkdirSync2 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, mkdirSync as mkdirSync2 } from "fs";
 import { execFileSync } from "child_process";
 var SSH_CONFIG_SNIPPET = `Host *.ghosty
     ProxyCommand easybits ssh-proxy %h
@@ -811,14 +905,14 @@ var sshKey = {
       const dir = join2(homedir2(), ".ssh");
       const key = join2(dir, "easybits_ed25519");
       const pub = `${key}.pub`;
-      if (!existsSync3(pub)) {
+      if (!existsSync4(pub)) {
         mkdirSync2(dir, { recursive: true, mode: 448 });
         execFileSync("ssh-keygen", ["-t", "ed25519", "-N", "", "-f", key, "-C", "easybits"], {
           stdio: ["ignore", "ignore", "inherit"]
         });
         console.error(`easybits: key created at ${key}`);
       }
-      const publicKey = readFileSync3(pub, "utf8").trim();
+      const publicKey = readFileSync4(pub, "utf8").trim();
       if (ctx.json) process.stdout.write(JSON.stringify({ publicKey, path: pub }, null, 2) + "\n");
       else process.stdout.write(publicKey + "\n");
     }
@@ -870,7 +964,7 @@ var sshProxy = {
 };
 
 // src/commands/sandboxes.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
 function sandboxRecord(s) {
   return {
     sandboxId: s.sandboxId,
@@ -883,7 +977,8 @@ function sandboxRecord(s) {
     tier: s.tier,
     cpuMode: s.cpuMode,
     monthlyMxn: s.monthlyMxn,
-    metadata: s.metadata
+    metadata: s.metadata,
+    activity: s.activity
   };
 }
 function printSandbox(s) {
@@ -891,6 +986,7 @@ function printSandbox(s) {
   if (s.name) console.log(`Name:      ${s.name}`);
   console.log(`Template:  ${s.template}`);
   console.log(`Status:    ${s.status}`);
+  if (s.activity) console.log(`Activity:  ${s.activity} (busy: exec/suspend/destroy answer 409 SandboxBusy until it ends)`);
   console.log(`Created:   ${fmtDate(s.createdAt)}`);
   console.log(`Expires:   ${s.persistent ? "never (permanent)" : fmtDate(s.expiresAt)}`);
   if (s.tier) console.log(`Tier:      ${s.tier}${s.monthlyMxn != null ? ` ($${s.monthlyMxn} MXN/month)` : ""}`);
@@ -930,23 +1026,25 @@ var sandboxes = {
     create: {
       aliases: ["new"],
       summary: "Create a sandbox and wait until it is running",
-      usage: "easybits sandboxes create [--template ubuntu] [--name <name>] [--timeout <s>] [--size s|m|l|xl] [--env K=V]...",
+      usage: "easybits sandboxes create [--template ubuntu] [--name <name>] [--timeout <s>] [--size s|m|l|xl] [--dotenv <path>] [--env K=V]...",
       options: {
         template: { type: "string", value: "name", description: "Base template (default ubuntu): ubuntu, python, node, code-interpreter\u2026" },
         name: { type: "string", value: "name", description: "Human label (lets you `ssh <name>.ghosty`)" },
         timeout: { type: "string", value: "seconds", description: "Time to live before auto-destroy" },
         size: { type: "string", value: "s|m|l|xl", description: "VM size class (gated by plan)" },
-        env: { type: "string", multiple: true, value: "K=V", description: "Environment variable (repeatable)" },
+        env: { type: "string", multiple: true, value: "K=V", description: "Environment variable, non-secret (repeatable)" },
+        ...ENV_FILE_OPTION,
         "no-wait": { type: "boolean", description: "Return right away instead of waiting for running" }
       },
       examples: [
         "easybits sandboxes create --template node --name scratch",
-        "ID=$(easybits sb create --template python --json | jq -r .sandboxId)"
+        "ID=$(easybits sb create --template python --json | jq -r .sandboxId)",
+        "easybits sb create --template node --dotenv .env"
       ],
       async run(ctx) {
         const size = str(ctx, "size");
         if (size && !["s", "m", "l", "xl"].includes(size)) throw usageError("--size must be s, m, l or xl.", this.usage);
-        const env = pairs(list(ctx, "env"), this.usage);
+        const env = await envFrom(ctx, this.usage);
         const eb = await getClient(ctx);
         const sb = await eb.sandboxes.create({
           template: str(ctx, "template") ?? "ubuntu",
@@ -972,14 +1070,16 @@ var sandboxes = {
     },
     exec: {
       summary: "Run a shell command inside a sandbox",
-      usage: "easybits sandboxes exec <sandbox-id> [--cwd <dir>] [--timeout <s>] -- <command...>",
+      usage: "easybits sandboxes exec <sandbox-id> [--cwd <dir>] [--timeout <s>] [--dotenv <path>] -- <command...>",
       options: {
         cwd: { type: "string", value: "dir", description: "Working directory" },
         timeout: { type: "string", value: "seconds", description: "Kill the command after this long" },
-        env: { type: "string", multiple: true, value: "K=V", description: "Environment variable (repeatable)" }
+        env: { type: "string", multiple: true, value: "K=V", description: "Environment variable, non-secret (repeatable)" },
+        ...ENV_FILE_OPTION
       },
       examples: [
         "easybits sandboxes exec sb_abc123 -- uname -a",
+        "easybits sb exec sb_abc123 --dotenv .env -- node migrate.js",
         "easybits sb exec sb_abc123 --cwd /data/work -- npm test",
         "easybits sb exec sb_abc123 --json -- 'ls -la /' | jq .exitCode"
       ],
@@ -987,7 +1087,7 @@ var sandboxes = {
         need(ctx, 0, "sandbox-id", this.usage);
         const command = ctx.args.slice(1).join(" ");
         if (!command) throw usageError("Missing <command>.", this.usage);
-        const env = pairs(list(ctx, "env"), this.usage);
+        const env = await envFrom(ctx, this.usage);
         const sb = await sandbox(ctx, this.usage);
         const r = await sb.exec(command, {
           cwd: str(ctx, "cwd"),
@@ -1073,8 +1173,8 @@ var sandboxes = {
           let buf;
           if (inline != null) buf = Buffer.from(inline, "utf8");
           else if (local) {
-            if (!existsSync4(local)) throw usageError(`File not found: ${local}`, FILES_USAGE);
-            buf = readFileSync4(local);
+            if (!existsSync5(local)) throw usageError(`File not found: ${local}`, FILES_USAGE);
+            buf = readFileSync5(local);
           } else if (!process.stdin.isTTY) buf = await readStdin();
           else throw usageError("Give a local file, --content, or pipe data on stdin.", FILES_USAGE);
           const r = await sb.files.write(path, buf.toString("base64"), { encoding: "base64" });
@@ -1095,11 +1195,14 @@ var sandboxes = {
     },
     resume: {
       summary: "Wake a suspended sandbox",
-      usage: "easybits sandboxes resume <sandbox-id> [--env K=V]...",
-      options: { env: { type: "string", multiple: true, value: "K=V", description: "Rewrite env on wake (repeatable)" } },
+      usage: "easybits sandboxes resume <sandbox-id> [--dotenv <path>] [--env K=V]...",
+      options: {
+        env: { type: "string", multiple: true, value: "K=V", description: "Rewrite env on wake, non-secret (repeatable)" },
+        ...ENV_FILE_OPTION
+      },
       examples: ["easybits sandboxes resume sb_abc123"],
       async run(ctx) {
-        const env = pairs(list(ctx, "env"), this.usage);
+        const env = await envFrom(ctx, this.usage);
         const r = await (await sandbox(ctx, this.usage)).resume(Object.keys(env).length ? { env } : {});
         emit(ctx, r, () => console.log(`Resumed ${r.sandboxId ?? ctx.args[0]} (${r.status ?? "running"})`));
       }
@@ -1107,10 +1210,19 @@ var sandboxes = {
     destroy: {
       aliases: ["rm", "delete"],
       summary: "Destroy a sandbox (irreversible)",
-      usage: "easybits sandboxes destroy <sandbox-id>",
-      examples: ["easybits sandboxes destroy sb_abc123"],
+      usage: "easybits sandboxes destroy <sandbox-id> [--yes]",
+      options: { ...YES_OPTION },
+      examples: ["easybits sandboxes destroy sb_abc123", "easybits sb rm sb_abc123 --yes"],
       async run(ctx) {
-        const r = await (await sandbox(ctx, this.usage)).destroy();
+        need(ctx, 0, "sandbox-id", this.usage);
+        requireYesIfHeadless(ctx);
+        const sb = await sandbox(ctx, this.usage);
+        await confirm(
+          ctx,
+          sb.persistent ? `Destroy permanent sandbox ${sb.sandboxId}${sb.name ? ` (${sb.name})` : ""} and its disk?` : `Destroy sandbox ${sb.sandboxId}?`,
+          sb.persistent ? { typeName: sb.sandboxId } : {}
+        );
+        const r = await sb.destroy();
         emit(ctx, { ...r, sandboxId: ctx.args[0] }, () => console.log(`Destroyed ${ctx.args[0]}`));
       }
     },
@@ -1128,7 +1240,7 @@ var sandboxes = {
 };
 
 // src/commands/machines.ts
-var SECRETS_USAGE = "easybits machines secrets <ls|set|unset> <machine-id> [KEY=VALUE... | NAME]";
+var SECRETS_USAGE = "easybits machines secrets <ls|set|unset> <machine-id> [--dotenv <path> | NAME]";
 var machines = {
   name: "machines",
   aliases: ["deploy", "machine"],
@@ -1219,9 +1331,11 @@ var machines = {
     secrets: {
       summary: "App env vars stored encrypted in your vault",
       usage: SECRETS_USAGE,
+      options: { ...ENV_FILE_OPTION },
       examples: [
         "easybits machines secrets ls sb_abc123",
-        "easybits machines secrets set sb_abc123 DATABASE_URL=postgres://\u2026 API_KEY=xyz",
+        "easybits machines secrets set sb_abc123 --dotenv .env.production",
+        `printf 'API_KEY=%s\\n' "$API_KEY" | easybits machines secrets set sb_abc123 --dotenv -`,
         "easybits machines secrets unset sb_abc123 API_KEY"
       ],
       async run(ctx) {
@@ -1235,8 +1349,9 @@ var machines = {
             console.log(`In vault: ${r.inVault.length ? r.inVault.join(", ") : "(none)"}`);
           });
         } else if (action === "set") {
-          const values = pairs(ctx.args.slice(2), SECRETS_USAGE);
-          if (!Object.keys(values).length) throw usageError("Give at least one KEY=VALUE.", SECRETS_USAGE);
+          const file = str(ctx, "dotenv");
+          const values = { ...file ? await readEnvFile(file, SECRETS_USAGE) : {}, ...pairs(ctx.args.slice(2), SECRETS_USAGE) };
+          if (!Object.keys(values).length) throw usageError("Give --dotenv <path> (or - for stdin).", SECRETS_USAGE);
           const r = await eb.machines.setSecrets(id, values);
           emit(ctx, r, () => console.log(`Set ${Object.keys(values).join(", ")}. Injected now: ${r.secretNames.join(", ")}`));
         } else if (action === "unset") {
@@ -1308,10 +1423,14 @@ var domains = {
     rm: {
       aliases: ["remove", "delete"],
       summary: "Detach a domain",
-      usage: "easybits domains rm <sandbox-id> <domain>",
-      examples: ["easybits domains rm sb_abc123 shop.example.com"],
+      usage: "easybits domains rm <sandbox-id> <domain> [--yes]",
+      options: { ...YES_OPTION },
+      examples: ["easybits domains rm sb_abc123 shop.example.com", "easybits domains rm sb_abc123 shop.example.com --yes"],
       async run(ctx) {
+        need(ctx, 0, "sandbox-id", this.usage);
         const domain = need(ctx, 1, "domain", this.usage);
+        requireYesIfHeadless(ctx);
+        await confirm(ctx, `Detach ${domain} from ${ctx.args[0]}? It stops serving right away.`);
         const r = await (await sandbox2(ctx, this.usage)).removeDomain(domain);
         emit(ctx, r, () => console.log(`Removed ${domain}`));
       }
@@ -1367,16 +1486,55 @@ var db = {
     rm: {
       aliases: ["delete", "drop"],
       summary: "Delete a database (irreversible)",
-      usage: "easybits db rm <db-id|name>",
-      examples: ["easybits db rm leads"],
+      usage: "easybits db rm <db-id|name> [--yes]",
+      options: { ...YES_OPTION },
+      examples: ["easybits db rm leads            # asks you to type the name", "easybits db rm leads --yes      # scripts and agents"],
       async run(ctx) {
         const ref = need(ctx, 0, "db-id|name", this.usage);
+        requireYesIfHeadless(ctx);
         const eb = await getClient(ctx);
         const hit = await findDb(eb, ref);
+        await confirm(ctx, `Delete database ${hit.name} (${hit.id}) and all its data?`, { typeName: hit.name });
         const r = await eb.deleteDatabase(hit.id);
         emit(ctx, { ...r, id: hit.id, name: hit.name }, () => console.log(`Deleted ${hit.name} (${hit.id})`));
       }
     },
+    tables: {
+      aliases: ["inspect", "schema"],
+      summary: "List tables with row counts and columns",
+      usage: "easybits db tables <db-id|name>",
+      examples: ["easybits db tables leads", "easybits db tables leads --json"],
+      // Patrón de `turso db inspect` / `.tables` + `.schema` de sqlite3, en una sola vista.
+      async run(ctx) {
+        const ref = need(ctx, 0, "db-id|name", this.usage);
+        const eb = await getClient(ctx);
+        const hit = await findDb(eb, ref);
+        const q = (sql, args) => eb.queryDatabase(hit.id, sql, args);
+        const names = (await q("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '_litestream_%' ORDER BY name")).rows.map((r) => String(r[0]));
+        const ident = (n) => `"${n.replace(/"/g, '""')}"`;
+        const tables = [];
+        for (const name of names) {
+          const info2 = await q(`PRAGMA table_info(${ident(name)})`);
+          const col = (k) => info2.cols.indexOf(k);
+          const columns = info2.rows.map((r) => ({ name: String(r[col("name")]), type: String(r[col("type")] ?? ""), pk: Number(r[col("pk")]) > 0 }));
+          const count = await q(`SELECT count(*) FROM ${ident(name)}`);
+          tables.push({ name, rows: Number(count.rows[0]?.[0] ?? 0), columns });
+        }
+        emit(
+          ctx,
+          tables,
+          () => table(
+            tables.map((t) => ({
+              name: t.name,
+              rows: t.rows,
+              columns: t.columns.map((c) => `${c.name}${c.type ? ` ${c.type}` : ""}${c.pk ? " PK" : ""}`).join(", ")
+            })),
+            [["name", "TABLE"], ["rows", "ROWS"], ["columns", "COLUMNS"]],
+            `No tables in ${hit.name}. Create one: easybits db query ${hit.name} 'CREATE TABLE \u2026'`
+          )
+        );
+      }
+    },
     query: {
       aliases: ["sql"],
       summary: "Run one SQL statement (by database id or name)",
@@ -1439,25 +1597,28 @@ var agents = {
     },
     create: {
       summary: "Create an agent from a template",
-      usage: "easybits agents create --template <template> [--name <name>] [--env K=V]... [--timeout <s>]",
+      usage: "easybits agents create --template <template> [--name <name>] [--dotenv <path>] [--env K=V]... [--timeout <s>]",
       options: {
         template: { type: "string", value: "template", description: "Agent template (see: easybits docs agents)" },
         name: { type: "string", value: "name", description: "Label" },
-        env: { type: "string", multiple: true, value: "K=V", description: "Env for the agent (repeatable)" },
+        env: { type: "string", multiple: true, value: "K=V", description: "Env for the agent, non-secret (repeatable)" },
+        ...ENV_FILE_OPTION,
         timeout: { type: "string", value: "seconds", description: "Lifetime before auto-destroy" }
       },
       examples: [
         "easybits agents create --template goose --name helper",
-        "easybits agents create --template chat-anthropic --env ANTHROPIC_API_KEY=sk-ant-\u2026 --json"
+        "easybits agents create --template chat-anthropic --dotenv .env --json",
+        "op read op://vault/anthropic/env | easybits agents create --template chat-anthropic --dotenv -"
       ],
       async run(ctx) {
         const template = str(ctx, "template");
         if (!template) throw usageError("Missing --template.", this.usage);
+        const env = await envFrom(ctx, this.usage);
         const eb = await getClient(ctx);
         const a = await eb.createAgent({
           template,
           name: str(ctx, "name"),
-          env: pairs(list(ctx, "env"), this.usage),
+          env,
           timeoutSeconds: int(ctx, "timeout", this.usage)
         });
         emit(ctx, a, () => {
@@ -1492,10 +1653,13 @@ var agents = {
     destroy: {
       aliases: ["rm", "delete"],
       summary: "Destroy an agent and its sandbox",
-      usage: "easybits agents destroy <agent-id>",
-      examples: ["easybits agents destroy ag_123"],
+      usage: "easybits agents destroy <agent-id> [--yes]",
+      options: { ...YES_OPTION },
+      examples: ["easybits agents destroy ag_123            # asks you to type the id", "easybits agents destroy ag_123 --yes"],
       async run(ctx) {
         const id = need(ctx, 0, "agent-id", this.usage);
+        requireYesIfHeadless(ctx);
+        await confirm(ctx, `Destroy agent ${id} and its sandbox (including /data)?`, { typeName: id });
         const eb = await getClient(ctx);
         const r = await eb.destroyAgent(id);
         emit(ctx, { ...r, agentId: id }, () => console.log(`Destroyed ${id}`));
@@ -1574,10 +1738,36 @@ function findCommand(name) {
   return COMMANDS.find((c) => c.name === name || c.aliases?.includes(name));
 }
 
+// src/suggest.ts
+function levenshtein(a, b) {
+  if (a === b) return 0;
+  let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1; i <= a.length; i++) {
+    const cur = [i];
+    for (let j = 1; j <= b.length; j++) {
+      cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    }
+    prev = cur;
+  }
+  return prev[b.length];
+}
+function suggest(input, candidates, max = 2) {
+  const needle = input.toLowerCase();
+  const scored = [...new Set(candidates)].map((c) => ({ c, d: levenshtein(needle, c.toLowerCase()) })).filter(({ c, d }) => d <= max || needle.length >= 2 && c.toLowerCase().startsWith(needle)).sort((x, y) => x.d - y.d || x.c.localeCompare(y.c));
+  return scored.map(({ c }) => c);
+}
+function didYouMean(input, candidates, prefix, canonical = (n) => n) {
+  const hits = [...new Set(suggest(input, candidates).map(canonical))].slice(0, 3);
+  if (!hits.length) return void 0;
+  return `Did you mean this?
+${hits.map((h) => `  ${prefix}${h}`).join("\n")}`;
+}
+
 // src/help.ts
 var GLOBAL_FLAGS = `Global flags:
   --json           Machine output: JSON on stdout, errors included
-  --token <key>    API key for this call (EASYBITS_API_KEY wins if set)
+  --token <key>    API key for this call (prefer EASYBITS_API_KEY: argv leaks to ps)
+  -y, --yes        On rm/destroy: skip the confirmation (required without a TTY)
   -h, --help       Help (also: easybits <command> --help)
   -v, --version    Print the CLI version
 
@@ -1636,7 +1826,7 @@ var BANNER = "            \x1B[38;2;244;245;251m\u2860\u2812\u2812\u28E4\x1B[38;
 
 // src/index.ts
 import { EasybitsError as EasybitsError2 } from "@easybits.cloud/sdk";
-var VERSION = true ? "0.5.0" : "dev";
+var VERSION = true ? "0.6.0" : "dev";
 var GLOBAL_OPTIONS = {
   json: { type: "boolean" },
   token: { type: "string" },
@@ -1679,16 +1869,44 @@ function parse(argv2, skip, leaf) {
     throw usageError(e.message.split("\n")[0].split(". To specify")[0].replace(/\.?$/, "."), leaf?.usage);
   }
 }
+function findSub(cmd, name) {
+  return Object.entries(cmd.subs ?? {}).find(([n, l]) => n === name || l.aliases?.includes(name));
+}
+function unknownCommand(name) {
+  const e = usageError(`Unknown command "${name}".`);
+  const names = COMMANDS.flatMap((c) => [c.name, ...c.aliases ?? []]);
+  const hint = didYouMean(name, names, "easybits ", (n) => findCommand(n)?.name ?? n);
+  if (hint) e.hint = `${hint}
+Run: easybits --help`;
+  return e;
+}
+function unknownSub(cmd, name) {
+  const e = usageError(`Unknown subcommand "${cmd.name} ${name}".`, `easybits ${cmd.name} <${Object.keys(cmd.subs ?? {}).join("|")}>`);
+  const names = Object.entries(cmd.subs ?? {}).flatMap(([n, l]) => [n, ...l.aliases ?? []]);
+  const hint = didYouMean(name, names, `easybits ${cmd.name} `, (n) => findSub(cmd, n)?.[0] ?? n);
+  if (hint) e.hint = `${hint}
+${e.hint}`;
+  return e;
+}
 async function main(argv2) {
   const pos = positionalIndexes(argv2);
   const cmdName = pos.length ? argv2[pos[0]] : void 0;
   if (!cmdName || cmdName === "help") {
-    const topic = cmdName === "help" && pos[1] != null ? findCommand(argv2[pos[1]]) : void 0;
-    const { values: values2 } = parse(argv2, pos.slice(0, 2), void 0);
+    const topicName = cmdName === "help" && pos[1] != null ? argv2[pos[1]] : void 0;
+    const topic = topicName ? findCommand(topicName) : void 0;
+    if (topicName && !topic) throw unknownCommand(topicName);
+    const subName = topic?.subs && pos[2] != null ? argv2[pos[2]] : void 0;
+    const sub = topic && subName ? findSub(topic, subName) : void 0;
+    if (topic && subName && !sub) throw unknownSub(topic, subName);
+    const { values: values2 } = parse(argv2, pos.slice(0, sub ? 3 : 2), void 0);
     if (values2.version) {
       console.log(VERSION);
       return;
     }
+    if (sub) {
+      console.log(leafHelp(sub[1]));
+      return;
+    }
     if (topic) {
       console.log(commandHelp(topic));
       return;
@@ -1698,17 +1916,17 @@ async function main(argv2) {
     return;
   }
   const cmd = findCommand(cmdName);
-  if (!cmd) throw usageError(`Unknown command "${cmdName}".`);
+  if (!cmd) throw unknownCommand(cmdName);
   let leaf = cmd.leaf;
   const skip = [pos[0]];
   if (cmd.subs) {
     const subName = pos[1] != null ? argv2[pos[1]] : void 0;
-    const entry = subName ? Object.entries(cmd.subs).find(([n, l]) => n === subName || l.aliases?.includes(subName)) : void 0;
+    const entry = subName ? findSub(cmd, subName) : void 0;
     if (entry) {
       leaf = entry[1];
       skip.push(pos[1]);
     } else if (subName) {
-      throw usageError(`Unknown subcommand "${cmd.name} ${subName}".`, `easybits ${cmd.name} <${Object.keys(cmd.subs).join("|")}>`);
+      throw unknownSub(cmd, subName);
     } else if (cmd.defaultSub && !argv2.includes("--help") && !argv2.includes("-h")) {
       leaf = cmd.subs[cmd.defaultSub];
     } else if (!argv2.includes("--help") && !argv2.includes("-h")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easybits.cloud/cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Official CLI for EasyBits, the cloud for AI agents — sandboxes, hosting, domains, databases, agents and files from your terminal",
   "type": "module",
   "bin": {
@@ -29,13 +29,14 @@
     "build": "tsup",
     "dev": "tsup --watch",
     "prepublishOnly": "npm run build",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "test": "node --experimental-strip-types --no-warnings --test src/*.test.ts"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@easybits.cloud/sdk": "^0.35.2"
+    "@easybits.cloud/sdk": "^0.36.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",