@eve-horizon/cli 0.2.0 → 0.2.1

package/dist/commands/admin.js

@@ -18,11 +18,26 @@ async function handleAdmin(subcommand, positionals, flags, context) {
             if (!['owner', 'admin', 'member'].includes(role)) {
                 throw new Error(`Invalid role: ${role}. Must be one of: owner, admin, member`);
             }
+            if (!orgId) {
+                throw new Error('No org specified. Use --org <org_id> or set a default org in your profile.');
+            }
             const results = {
                 keys_registered: 0,
                 identities: [],
             };
+            // Add user to org first - this creates the user if they don't exist
+            if (orgId) {
+                const membership = await (0, client_1.requestJson)(context, `/orgs/${orgId}/members`, {
+                    method: 'POST',
+                    body: {
+                        email,
+                        role,
+                    },
+                });
+                results.membership = membership;
+            }
             // Fetch and register GitHub SSH keys if username provided
+            // Now that user exists (created via org membership), identity registration will work
             if (githubUsername) {
                 const keys = await fetchGitHubKeys(githubUsername);
                 if (keys.length === 0) {
@@ -41,24 +56,6 @@ async function handleAdmin(subcommand, positionals, flags, context) {
                     results.keys_registered += 1;
                 }
             }
-            // Add user to org if org_id provided
-            if (orgId) {
-                // Get user_id from the first registered identity, or look up by email
-                let userId;
-                if (results.identities.length > 0) {
-                    userId = results.identities[0].user_id;
-                }
-                if (userId) {
-                    const membership = await (0, client_1.requestJson)(context, `/orgs/${orgId}/members`, {
-                        method: 'POST',
-                        body: {
-                            user_id: userId,
-                            role,
-                        },
-                    });
-                    results.membership = membership;
-                }
-            }
             const summary = [
                 `Invited ${email}`,
                 results.keys_registered > 0 ? `${results.keys_registered} SSH key(s) registered` : null,

package/dist/commands/auth.js

@@ -275,11 +275,26 @@ async function handleAuth(subcommand, flags, context, credentials) {
             const claudeOnly = (0, args_1.getBooleanFlag)(flags, ['claude']) ?? false;
             const codexOnly = (0, args_1.getBooleanFlag)(flags, ['codex']) ?? false;
             const dryRun = (0, args_1.getBooleanFlag)(flags, ['dry-run']) ?? false;
-            const system = (0, args_1.getBooleanFlag)(flags, ['system']) ?? false;
+            const orgIdFlag = (0, args_1.getStringFlag)(flags, ['org']);
             const projectIdFlag = (0, args_1.getStringFlag)(flags, ['project']);
-            const projectId = projectIdFlag ?? context.projectId;
-            if (!system && !projectId) {
-                throw new Error('No project specified. Use --project <id> or set default in profile, or use --system for system secrets');
+            let scope;
+            if (projectIdFlag) {
+                scope = { type: 'project', projectId: projectIdFlag };
+            }
+            else if (orgIdFlag) {
+                scope = { type: 'org', orgId: orgIdFlag };
+            }
+            else {
+                // Default to user scope - need to fetch user ID
+                const meResponse = await (0, client_1.requestRaw)(context, '/auth/me', { allowError: true });
+                if (!meResponse.ok) {
+                    throw new Error('Not authenticated. Run "eve auth login" first.');
+                }
+                const meData = meResponse.data;
+                if (!meData.user_id) {
+                    throw new Error('Could not determine user ID. Try specifying --org or --project instead.');
+                }
+                scope = { type: 'user', userId: meData.user_id };
             }
             const extractClaude = !codexOnly; // Extract Claude unless --codex is specified
             const extractCodex = !claudeOnly; // Extract Codex unless --claude is specified
@@ -287,31 +302,42 @@ async function handleAuth(subcommand, flags, context, credentials) {
             const platform = process.platform;
             // Extract Claude OAuth tokens
             if (extractClaude) {
+                // Try macOS Keychain first
                 if (platform === 'darwin') {
-                    try {
-                        const output = (0, node_child_process_1.execSync)('security find-generic-password -s "anthropic.claude" -w', { encoding: 'utf8' }).trim();
-                        if (output) {
-                            extractedTokens.CLAUDE_OAUTH_TOKEN = output;
+                    for (const service of ['Claude Code-credentials', 'anthropic.claude']) {
+                        try {
+                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
+                            if (output) {
+                                extractedTokens.CLAUDE_CODE_OAUTH_TOKEN = output;
+                                break;
+                            }
+                        }
+                        catch {
+                            // Token not found in keychain, continue
                         }
-                    }
-                    catch (error) {
-                        // Token not found in keychain, continue
                     }
                 }
-                else {
-                    // Linux: Check various credential file locations
+                // Check credential files (all platforms)
+                if (!extractedTokens.CLAUDE_CODE_OAUTH_TOKEN) {
                     const credentialPaths = [
                         `${(0, node_os_1.homedir)()}/.claude/.credentials.json`,
                         `${(0, node_os_1.homedir)()}/.claude/credentials.json`,
                         `${(0, node_os_1.homedir)()}/.config/claude/credentials.json`,
                     ];
-                    for (const path of credentialPaths) {
-                        if ((0, node_fs_1.existsSync)(path)) {
+                    for (const credPath of credentialPaths) {
+                        if ((0, node_fs_1.existsSync)(credPath)) {
                             try {
-                                const content = (0, node_fs_1.readFileSync)(path, 'utf8');
+                                const content = (0, node_fs_1.readFileSync)(credPath, 'utf8');
                                 const creds = JSON.parse(content);
+                                // Handle nested claudeAiOauth format (current Claude Code format)
+                                const claudeOauth = creds.claudeAiOauth;
+                                if (claudeOauth?.accessToken) {
+                                    extractedTokens.CLAUDE_CODE_OAUTH_TOKEN = claudeOauth.accessToken;
+                                    break;
+                                }
+                                // Fallback to legacy root-level tokens
                                 if (creds.oauth_token || creds.access_token) {
-                                    extractedTokens.CLAUDE_OAUTH_TOKEN = creds.oauth_token || creds.access_token;
+                                    extractedTokens.CLAUDE_CODE_OAUTH_TOKEN = (creds.oauth_token || creds.access_token);
                                     break;
                                 }
                             }
@@ -322,48 +348,78 @@ async function handleAuth(subcommand, flags, context, credentials) {
                     }
                 }
             }
-            // Extract Codex OAuth tokens
+            // Extract Codex/Code OAuth tokens
             if (extractCodex) {
+                // Try macOS Keychain first
                 if (platform === 'darwin') {
-                    try {
-                        const output = (0, node_child_process_1.execSync)('security find-generic-password -s "openai.codex" -w', { encoding: 'utf8' }).trim();
-                        if (output) {
-                            extractedTokens.CODEX_OAUTH_TOKEN = output;
+                    for (const service of ['openai.codex', 'Code-credentials']) {
+                        try {
+                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
+                            if (output) {
+                                extractedTokens.CODEX_OAUTH_ACCESS_TOKEN = output;
+                                break;
+                            }
+                        }
+                        catch {
+                            // Token not found in keychain, continue
                         }
-                    }
-                    catch (error) {
-                        // Token not found in keychain, continue
                     }
                 }
-                // Check ~/.codex/auth.json for Codex tokens (all platforms)
-                const codexAuthPath = `${(0, node_os_1.homedir)()}/.codex/auth.json`;
-                if ((0, node_fs_1.existsSync)(codexAuthPath)) {
-                    try {
-                        const content = (0, node_fs_1.readFileSync)(codexAuthPath, 'utf8');
-                        const auth = JSON.parse(content);
-                        if (auth.oauth_token || auth.access_token) {
-                            extractedTokens.CODEX_OAUTH_TOKEN = auth.oauth_token || auth.access_token;
+                // Check auth files (all platforms): ~/.codex/auth.json and ~/.code/auth.json
+                if (!extractedTokens.CODEX_OAUTH_ACCESS_TOKEN) {
+                    const codexAuthPaths = [
+                        `${(0, node_os_1.homedir)()}/.codex/auth.json`,
+                        `${(0, node_os_1.homedir)()}/.code/auth.json`,
+                    ];
+                    for (const authPath of codexAuthPaths) {
+                        if ((0, node_fs_1.existsSync)(authPath)) {
+                            try {
+                                const content = (0, node_fs_1.readFileSync)(authPath, 'utf8');
+                                const auth = JSON.parse(content);
+                                // Handle nested tokens format (current Codex CLI format)
+                                const tokens = auth.tokens;
+                                if (tokens?.access_token) {
+                                    extractedTokens.CODEX_OAUTH_ACCESS_TOKEN = tokens.access_token;
+                                    break;
+                                }
+                                // Fallback to root-level tokens
+                                if (auth.oauth_token || auth.access_token) {
+                                    extractedTokens.CODEX_OAUTH_ACCESS_TOKEN = (auth.oauth_token || auth.access_token);
+                                    break;
+                                }
+                                // Also check for OPENAI_API_KEY in the auth file
+                                if (auth.OPENAI_API_KEY && typeof auth.OPENAI_API_KEY === 'string') {
+                                    extractedTokens.OPENAI_API_KEY = auth.OPENAI_API_KEY;
+                                    break;
+                                }
+                            }
+                            catch {
+                                // Failed to parse, continue
+                            }
                         }
                     }
-                    catch {
-                        // Failed to parse, continue
-                    }
                 }
             }
             if (Object.keys(extractedTokens).length === 0) {
                 (0, output_1.outputJson)({ extracted: 0, tokens: [] }, json, 'No tokens found on host machine');
                 return;
             }
+            // Build target label for output
+            const targetLabel = scope.type === 'user' ? 'user' :
+                scope.type === 'org' ? `org ${scope.orgId}` :
+                    `project ${scope.projectId}`;
             if (dryRun) {
                 const tokenList = Object.keys(extractedTokens).map(key => ({
                     name: key,
                     value: `${extractedTokens[key].substring(0, 10)}...`,
                 }));
-                (0, output_1.outputJson)({ dry_run: true, would_set: tokenList, target: system ? 'system' : `project ${projectId}` }, json, `Would set ${tokenList.length} token(s) on ${system ? 'system' : `project ${projectId}`}:\n${tokenList.map(t => `  - ${t.name}`).join('\n')}`);
+                (0, output_1.outputJson)({ dry_run: true, would_set: tokenList, target: targetLabel, scope }, json, `Would set ${tokenList.length} token(s) on ${targetLabel}:\n${tokenList.map(t => `  - ${t.name}`).join('\n')}`);
                 return;
             }
-            // Set secrets via API
-            const endpoint = system ? '/system/secrets' : `/projects/${projectId}/secrets`;
+            // Set secrets via API - endpoint depends on scope
+            const endpoint = scope.type === 'user' ? `/users/${scope.userId}/secrets` :
+                scope.type === 'org' ? `/orgs/${scope.orgId}/secrets` :
+                    `/projects/${scope.projectId}/secrets`;
             const results = [];
             for (const [name, value] of Object.entries(extractedTokens)) {
                 try {
@@ -387,15 +443,194 @@ async function handleAuth(subcommand, flags, context, credentials) {
             const successCount = results.filter(r => r.success).length;
             const failCount = results.filter(r => !r.success).length;
             (0, output_1.outputJson)({
-                target: system ? 'system' : `project ${projectId}`,
+                target: targetLabel,
+                scope,
                 results,
                 success: successCount,
                 failed: failCount,
-            }, json, `✓ Set ${successCount} secret(s) on ${system ? 'system' : `project ${projectId}`}${failCount > 0 ? ` (${failCount} failed)` : ''}`);
+            }, json, `✓ Set ${successCount} secret(s) on ${targetLabel}${failCount > 0 ? ` (${failCount} failed)` : ''}`);
+            return;
+        }
+        case 'creds': {
+            // Show local credential status without syncing
+            const claudeOnly = (0, args_1.getBooleanFlag)(flags, ['claude']) ?? false;
+            const codexOnly = (0, args_1.getBooleanFlag)(flags, ['codex']) ?? false;
+            const checkClaude = !codexOnly;
+            const checkCodex = !claudeOnly;
+            const credentials = [];
+            const plat = process.platform;
+            // Check Claude credentials
+            if (checkClaude) {
+                let claudeFound = false;
+                let claudeSource = '';
+                let claudePreview = '';
+                let claudeExpires;
+                // Try macOS Keychain
+                if (plat === 'darwin' && !claudeFound) {
+                    for (const service of ['Claude Code-credentials', 'anthropic.claude']) {
+                        try {
+                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
+                            if (output) {
+                                claudeFound = true;
+                                claudeSource = `macOS Keychain (${service})`;
+                                claudePreview = output.substring(0, 15) + '...';
+                                break;
+                            }
+                        }
+                        catch {
+                            // Not found
+                        }
+                    }
+                }
+                // Check credential files
+                if (!claudeFound) {
+                    const credentialPaths = [
+                        `${(0, node_os_1.homedir)()}/.claude/.credentials.json`,
+                        `${(0, node_os_1.homedir)()}/.claude/credentials.json`,
+                        `${(0, node_os_1.homedir)()}/.config/claude/credentials.json`,
+                    ];
+                    for (const credPath of credentialPaths) {
+                        if ((0, node_fs_1.existsSync)(credPath)) {
+                            try {
+                                const content = (0, node_fs_1.readFileSync)(credPath, 'utf8');
+                                const creds = JSON.parse(content);
+                                const claudeOauth = creds.claudeAiOauth;
+                                if (claudeOauth?.accessToken) {
+                                    claudeFound = true;
+                                    claudeSource = credPath.replace((0, node_os_1.homedir)(), '~');
+                                    claudePreview = claudeOauth.accessToken.substring(0, 15) + '...';
+                                    if (claudeOauth.expiresAt) {
+                                        const expDate = new Date(claudeOauth.expiresAt);
+                                        claudeExpires = expDate.toISOString();
+                                    }
+                                    break;
+                                }
+                                if (creds.oauth_token || creds.access_token) {
+                                    claudeFound = true;
+                                    claudeSource = credPath.replace((0, node_os_1.homedir)(), '~');
+                                    const token = (creds.oauth_token || creds.access_token);
+                                    claudePreview = token.substring(0, 15) + '...';
+                                    break;
+                                }
+                            }
+                            catch {
+                                // Failed to parse
+                            }
+                        }
+                    }
+                }
+                credentials.push({
+                    name: 'Claude Code OAuth',
+                    source: claudeFound ? claudeSource : 'not found',
+                    found: claudeFound,
+                    preview: claudePreview || undefined,
+                    expiresAt: claudeExpires,
+                });
+            }
+            // Check Codex credentials
+            if (checkCodex) {
+                let codexFound = false;
+                let codexSource = '';
+                let codexPreview = '';
+                // Try macOS Keychain
+                if (plat === 'darwin' && !codexFound) {
+                    for (const service of ['openai.codex', 'Code-credentials']) {
+                        try {
+                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
+                            if (output) {
+                                codexFound = true;
+                                codexSource = `macOS Keychain (${service})`;
+                                codexPreview = output.substring(0, 15) + '...';
+                                break;
+                            }
+                        }
+                        catch {
+                            // Not found
+                        }
+                    }
+                }
+                // Check auth files
+                if (!codexFound) {
+                    const codexAuthPaths = [
+                        `${(0, node_os_1.homedir)()}/.codex/auth.json`,
+                        `${(0, node_os_1.homedir)()}/.code/auth.json`,
+                    ];
+                    for (const authPath of codexAuthPaths) {
+                        if ((0, node_fs_1.existsSync)(authPath)) {
+                            try {
+                                const content = (0, node_fs_1.readFileSync)(authPath, 'utf8');
+                                const auth = JSON.parse(content);
+                                const tokens = auth.tokens;
+                                if (tokens?.access_token) {
+                                    codexFound = true;
+                                    codexSource = authPath.replace((0, node_os_1.homedir)(), '~');
+                                    codexPreview = tokens.access_token.substring(0, 15) + '...';
+                                    break;
+                                }
+                                if (auth.oauth_token || auth.access_token) {
+                                    codexFound = true;
+                                    codexSource = authPath.replace((0, node_os_1.homedir)(), '~');
+                                    const token = (auth.oauth_token || auth.access_token);
+                                    codexPreview = token.substring(0, 15) + '...';
+                                    break;
+                                }
+                                if (auth.OPENAI_API_KEY && typeof auth.OPENAI_API_KEY === 'string') {
+                                    codexFound = true;
+                                    codexSource = authPath.replace((0, node_os_1.homedir)(), '~') + ' (API key)';
+                                    codexPreview = auth.OPENAI_API_KEY.substring(0, 10) + '...';
+                                    break;
+                                }
+                            }
+                            catch {
+                                // Failed to parse
+                            }
+                        }
+                    }
+                }
+                credentials.push({
+                    name: 'Codex/Code OAuth',
+                    source: codexFound ? codexSource : 'not found',
+                    found: codexFound,
+                    preview: codexPreview || undefined,
+                });
+            }
+            const foundCount = credentials.filter(c => c.found).length;
+            if (json) {
+                (0, output_1.outputJson)({ credentials, found: foundCount }, json);
+                return;
+            }
+            console.log('Local AI Tool Credentials:');
+            console.log('');
+            for (const cred of credentials) {
+                const status = cred.found ? '✓' : '✗';
+                console.log(`  ${status} ${cred.name}`);
+                console.log(`    Source: ${cred.source}`);
+                if (cred.preview) {
+                    console.log(`    Token:  ${cred.preview}`);
+                }
+                if (cred.expiresAt) {
+                    const expDate = new Date(cred.expiresAt);
+                    const now = new Date();
+                    const isExpired = expDate < now;
+                    const expLabel = isExpired ? '(expired)' : '';
+                    console.log(`    Expires: ${cred.expiresAt} ${expLabel}`);
+                }
+                console.log('');
+            }
+            if (foundCount > 0) {
+                console.log(`Found ${foundCount} credential(s). Run 'eve auth sync' to sync to Eve.`);
+            }
+            else {
+                console.log('No local credentials found.');
+                console.log('');
+                console.log('To set up credentials:');
+                console.log('  Claude: Run "claude" CLI and log in');
+                console.log('  Codex:  Run "codex" CLI and log in');
+            }
             return;
         }
         default:
-            throw new Error('Usage: eve auth <login|logout|status|whoami|bootstrap|sync|token>');
+            throw new Error('Usage: eve auth <login|logout|status|whoami|bootstrap|sync|creds|token>');
     }
 }
 function signNonceWithSsh(keyPath, nonce) {

package/dist/commands/env.js

@@ -55,6 +55,8 @@ async function handleEnv(subcommand, positionals, flags, context) {
             return handleDeploy(positionals, flags, context, json);
         case 'logs':
             return handleLogs(positionals, flags, context, json);
+        case 'diagnose':
+            return handleDiagnose(positionals, flags, context, json);
         case 'delete':
             return handleDelete(positionals, flags, context, json);
         default:
@@ -64,6 +66,7 @@ async function handleEnv(subcommand, positionals, flags, context) {
                 '  create <name> --type=<type> [options]   - create an environment\n' +
                 '  deploy <env> --ref <sha> [--direct] [--inputs <json>]   - deploy to an environment\n' +
                 '  logs <project> <env> <service> [--since <seconds>] [--tail <n>] [--grep <text>] - get service logs\n' +
+                '  diagnose <project> <env>                - diagnose deployment health and events\n' +
                 '  delete <name> [--project=<id>] [--force] - delete an environment');
     }
 }
@@ -106,11 +109,12 @@ async function handleShow(positionals, flags, context, json) {
         throw new Error('Usage: eve env show <project> <name> [--project=<id>] [--name=<name>]');
     }
     const response = await (0, client_1.requestJson)(context, `/projects/${projectId}/envs/${envName}`);
+    const health = await (0, client_1.requestJson)(context, `/projects/${projectId}/envs/${envName}/health`);
     if (json) {
-        (0, output_1.outputJson)(response, json);
+        (0, output_1.outputJson)({ ...response, health }, json);
     }
     else {
-        formatEnvironmentDetails(response);
+        formatEnvironmentDetails(response, health);
     }
 }
 /**
@@ -241,11 +245,46 @@ async function handleDeploy(positionals, flags, context, json) {
         (0, output_1.outputJson)(response, json);
     }
     else {
+        if (response.pipeline_run) {
+            console.log('');
+            console.log('Pipeline deployment queued.');
+            console.log(`  Pipeline Run: ${response.pipeline_run.run.id}`);
+            console.log(`  Pipeline:     ${response.pipeline_run.run.pipeline_name}`);
+            console.log(`  Status:       ${response.pipeline_run.run.status}`);
+            console.log(`  Environment:  ${response.environment.name}`);
+            return;
+        }
         console.log('');
-        console.log(`Deployment successful!`);
-        console.log(`  Release ID:  ${response.release.id}`);
+        console.log(`Deployment submitted.`);
+        if (response.release) {
+            console.log(`  Release ID:  ${response.release.id}`);
+        }
         console.log(`  Environment: ${response.environment.name}`);
         console.log(`  Namespace:   ${response.environment.namespace || '(none)'}`);
+        if (response.deployment_status?.k8s_status) {
+            const status = response.deployment_status.k8s_status;
+            const readiness = `${status.available_replicas}/${status.desired_replicas}`;
+            console.log(`  Status:      ${response.deployment_status.state} (${readiness} ready)`);
+        }
+        else if (response.deployment_status?.state) {
+            console.log(`  Status:      ${response.deployment_status.state}`);
+        }
+        const warnings = response.warnings ?? getDeploymentWarnings(response.deployment_status);
+        if (warnings.length > 0) {
+            console.log('');
+            console.log('Warnings:');
+            for (const warning of warnings) {
+                console.log(`  - ${warning}`);
+            }
+        }
+        const watchFlag = (0, args_1.toBoolean)(flags.watch);
+        const shouldWatch = (watchFlag ?? true)
+            && response.deployment_status?.state !== 'ready';
+        if (shouldWatch) {
+            const timeoutRaw = (0, args_1.getStringFlag)(flags, ['timeout']);
+            const timeoutSeconds = timeoutRaw ? parseInt(timeoutRaw, 10) : 120;
+            await watchDeploymentStatus(context, projectId, envName, Number.isFinite(timeoutSeconds) ? timeoutSeconds : 120);
+        }
     }
 }
 /**
@@ -277,6 +316,26 @@ async function handleLogs(positionals, flags, context, json) {
         console.log(`[${entry.timestamp}] ${entry.line}`);
     }
 }
+/**
+ * eve env diagnose <project> <env>
+ * Diagnose deployment health for an environment (k8s-only)
+ */
+async function handleDiagnose(positionals, flags, context, json) {
+    const projectId = positionals[0] ?? (0, args_1.getStringFlag)(flags, ['project']) ?? context.projectId;
+    const envName = positionals[1] ?? (0, args_1.getStringFlag)(flags, ['env', 'name']);
+    if (!projectId || !envName) {
+        throw new Error('Usage: eve env diagnose <project> <env> [--events <n>]');
+    }
+    const query = buildQuery({
+        events: (0, args_1.getStringFlag)(flags, ['events']),
+    });
+    const response = await (0, client_1.requestJson)(context, `/projects/${projectId}/envs/${envName}/diagnose${query}`);
+    if (json) {
+        (0, output_1.outputJson)(response, json);
+        return;
+    }
+    formatEnvDiagnose(response);
+}
 /**
  * eve env delete <name> [--project=<id>] [--force]
  * Delete an environment
@@ -399,7 +458,7 @@ function formatEnvironmentsTable(environments) {
 /**
  * Format a single environment's details
  */
-function formatEnvironmentDetails(env) {
+function formatEnvironmentDetails(env, health) {
     console.log(`Environment: ${env.name}`);
     console.log('');
     console.log(`  ID:              ${env.id}`);
@@ -408,6 +467,19 @@ function formatEnvironmentDetails(env) {
     console.log(`  Namespace:       ${env.namespace || '(none)'}`);
     console.log(`  Database Ref:    ${env.db_ref || '(none)'}`);
     console.log(`  Current Release: ${env.current_release_id || '(none)'}`);
+    if (health) {
+        console.log('');
+        console.log(`  Deployment Status: ${health.status}`);
+        if (health.deployment) {
+            console.log(`  Deployment Ready:  ${health.deployment.available_replicas}/${health.deployment.desired_replicas}`);
+        }
+        if (health.warnings && health.warnings.length > 0) {
+            console.log('  Warnings:');
+            for (const warning of health.warnings) {
+                console.log(`    - ${warning}`);
+            }
+        }
+    }
     if (env.overrides && Object.keys(env.overrides).length > 0) {
         console.log('');
         console.log('  Overrides:');
@@ -419,6 +491,118 @@ function formatEnvironmentDetails(env) {
     console.log(`  Created:         ${formatDate(env.created_at)}`);
     console.log(`  Updated:         ${formatDate(env.updated_at)}`);
 }
+function formatEnvDiagnose(report) {
+    console.log(`Environment Diagnose: ${report.env_name}`);
+    console.log('');
+    console.log(`  Namespace: ${report.namespace || '(none)'}`);
+    console.log(`  Status:    ${report.status}`);
+    console.log(`  Ready:     ${report.ready ? 'yes' : 'no'}`);
+    console.log(`  K8s:       ${report.k8s_available ? 'available' : 'unavailable'}`);
+    if (report.warnings && report.warnings.length > 0) {
+        console.log('');
+        console.log('Warnings:');
+        for (const warning of report.warnings) {
+            console.log(`  - ${warning}`);
+        }
+    }
+    if (report.deployments.length > 0) {
+        console.log('');
+        console.log('Deployments:');
+        const nameWidth = Math.max(4, ...report.deployments.map((d) => d.name.length));
+        const readyWidth = Math.max(5, ...report.deployments.map((d) => `${d.available_replicas}/${d.desired_replicas}`.length));
+        const header = [
+            padRight('Name', nameWidth),
+            padRight('Ready', readyWidth),
+            'Status',
+        ].join('  ');
+        console.log(header);
+        console.log('-'.repeat(header.length));
+        for (const deployment of report.deployments) {
+            const readiness = `${deployment.available_replicas}/${deployment.desired_replicas}`;
+            const status = deployment.ready ? 'ready' : 'not-ready';
+            console.log([
+                padRight(deployment.name, nameWidth),
+                padRight(readiness, readyWidth),
+                status,
+            ].join('  '));
+        }
+    }
+    if (report.pods.length > 0) {
+        console.log('');
+        console.log('Pods:');
+        const nameWidth = Math.max(4, ...report.pods.map((p) => p.name.length));
+        const phaseWidth = Math.max(5, ...report.pods.map((p) => p.phase.length));
+        const restartsWidth = Math.max(8, ...report.pods.map((p) => String(p.restarts).length));
+        const header = [
+            padRight('Name', nameWidth),
+            padRight('Phase', phaseWidth),
+            padRight('Restarts', restartsWidth),
+            'Ready',
+            'Age',
+        ].join('  ');
+        console.log(header);
+        console.log('-'.repeat(header.length));
+        for (const pod of report.pods) {
+            console.log([
+                padRight(pod.name, nameWidth),
+                padRight(pod.phase, phaseWidth),
+                padRight(String(pod.restarts), restartsWidth),
+                pod.ready ? 'yes' : 'no',
+                pod.age,
+            ].join('  '));
+        }
+    }
+    if (report.events.length > 0) {
+        console.log('');
+        console.log('Events:');
+        for (const event of report.events) {
+            const timestamp = event.timestamp ?? 'unknown';
+            const reason = event.reason ?? 'Unknown';
+            const message = event.message ?? '';
+            console.log(`  [${timestamp}] ${event.type} ${reason}: ${message}`);
+        }
+    }
+}
+function getDeploymentWarnings(status) {
+    if (!status)
+        return [];
+    const warnings = [];
+    if (status.state !== 'ready') {
+        warnings.push(`Deployment state: ${status.state}`);
+    }
+    if (status.k8s_status) {
+        const { available_replicas, desired_replicas, ready, conditions } = status.k8s_status;
+        if (!ready) {
+            warnings.push(`Deployment replicas not ready (${available_replicas}/${desired_replicas})`);
+        }
+        for (const condition of conditions) {
+            if (condition.status !== 'True' && condition.message) {
+                warnings.push(`${condition.type}: ${condition.message}`);
+            }
+        }
+    }
+    return Array.from(new Set(warnings));
+}
+async function watchDeploymentStatus(context, projectId, envName, timeoutSeconds) {
+    const start = Date.now();
+    const pollIntervalMs = 3000;
+    console.log('');
+    console.log('Watching deployment status...');
+    while ((Date.now() - start) / 1000 < timeoutSeconds) {
+        const health = await (0, client_1.requestJson)(context, `/projects/${projectId}/envs/${envName}/health`);
+        const elapsed = Math.floor((Date.now() - start) / 1000);
+        const readiness = health.deployment
+            ? `${health.deployment.available_replicas}/${health.deployment.desired_replicas}`
+            : 'n/a';
+        console.log(`  [${elapsed}s] ${health.status} (${readiness} ready)`);
+        if (health.ready) {
+            console.log('  Deployment is ready.');
+            return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+    console.log(`  Timeout after ${timeoutSeconds}s. Run "eve env diagnose ${projectId} ${envName}" for details.`);
+}
 /**
  * Format a date string for display
  */

package/dist/commands/manifest.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleManifest = handleManifest;
+const args_1 = require("../lib/args");
+const client_1 = require("../lib/client");
+const output_1 = require("../lib/output");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+async function handleManifest(subcommand, positionals, flags, context) {
+    const json = Boolean(flags.json);
+    switch (subcommand) {
+        case 'validate': {
+            const useLatest = (0, args_1.toBoolean)(flags.latest) ?? false;
+            const strict = (0, args_1.toBoolean)(flags.strict) ?? false;
+            const validateSecretsFlag = flags['validate-secrets'] ?? flags.validate_secrets;
+            const validateSecrets = (0, args_1.toBoolean)(validateSecretsFlag) ?? false;
+            const dir = typeof flags.dir === 'string' ? flags.dir : process.cwd();
+            const manifestPath = (0, args_1.getStringFlag)(flags, ['path']) ?? (0, node_path_1.join)(dir, '.eve', 'manifest.yaml');
+            let manifestYaml;
+            if (!useLatest) {
+                try {
+                    manifestYaml = (0, node_fs_1.readFileSync)(manifestPath, 'utf-8');
+                }
+                catch (error) {
+                    throw new Error(`Failed to read manifest at ${manifestPath}: ${error.message}`);
+                }
+            }
+            let projectId = (0, args_1.getStringFlag)(flags, ['project']) ?? context.projectId;
+            if (!projectId && manifestYaml) {
+                const match = manifestYaml.match(/^project:\s*(\S+)/m);
+                if (match) {
+                    projectId = match[1];
+                }
+            }
+            if (!projectId) {
+                throw new Error('Missing project id. Provide --project, set a profile default, or add "project: proj_xxx" to manifest.');
+            }
+            const response = await (0, client_1.requestJson)(context, `/projects/${projectId}/manifest/validate`, {
+                method: 'POST',
+                body: {
+                    manifest_yaml: manifestYaml,
+                    validate_secrets: validateSecrets || strict,
+                    strict,
+                },
+            });
+            if (json) {
+                (0, output_1.outputJson)(response, json);
+            }
+            else {
+                if (response.valid) {
+                    console.log('✓ Manifest valid');
+                }
+                else {
+                    console.log('✗ Manifest invalid');
+                }
+                if (response.manifest_hash) {
+                    console.log(`  Hash: ${response.manifest_hash.substring(0, 12)}...`);
+                }
+                if (response.errors && response.errors.length > 0) {
+                    console.log('');
+                    console.log('Errors:');
+                    response.errors.forEach((error) => console.log(`  - ${error}`));
+                }
+                if (response.warnings && response.warnings.length > 0) {
+                    console.log('');
+                    console.log('Warnings:');
+                    response.warnings.forEach((warning) => console.log(`  - ${warning}`));
+                }
+                if (response.secret_validation?.missing?.length) {
+                    console.log('');
+                    console.log('Missing secrets:');
+                    response.secret_validation.missing.forEach((item) => {
+                        const hint = item.hints?.[0] ? ` (${item.hints[0]})` : '';
+                        console.log(`  - ${item.key}${hint}`);
+                    });
+                }
+            }
+            if (!response.valid) {
+                process.exitCode = 1;
+            }
+            return;
+        }
+        default:
+            throw new Error('Usage: eve manifest <validate>');
+    }
+}

package/dist/index.js

@@ -24,6 +24,7 @@ const admin_1 = require("./commands/admin");
 const agents_1 = require("./commands/agents");
 const init_1 = require("./commands/init");
 const release_1 = require("./commands/release");
+const manifest_1 = require("./commands/manifest");
 async function main() {
     const { flags, positionals } = (0, args_1.parseArgs)(process.argv.slice(2));
     const command = positionals[0];
@@ -107,6 +108,9 @@ async function main() {
         case 'release':
             await (0, release_1.handleRelease)(subcommand, rest, flags, context);
             return;
+        case 'manifest':
+            await (0, manifest_1.handleManifest)(subcommand, rest, flags, context);
+            return;
         default:
             (0, help_1.showMainHelp)();
     }

package/dist/lib/help.js

@@ -106,6 +106,28 @@ exports.HELP = {
             },
         },
     },
+    manifest: {
+        description: 'Validate project manifests for schema and required secrets.',
+        usage: 'eve manifest <subcommand> [options]',
+        subcommands: {
+            validate: {
+                description: 'Validate a manifest (schema + secrets)',
+                usage: 'eve manifest validate [--project <id>] [--path <path>] [--latest]',
+                options: [
+                    '--project <id>       Project ID (uses profile default)',
+                    '--path <path>        Path to manifest (default: .eve/manifest.yaml)',
+                    '--latest             Validate latest synced manifest instead of local file',
+                    '--validate-secrets   Validate required secrets (from manifest)',
+                    '--strict             Fail validation if required secrets are missing',
+                ],
+                examples: [
+                    'eve manifest validate',
+                    'eve manifest validate --project proj_xxx',
+                    'eve manifest validate --latest --project proj_xxx',
+                ],
+            },
+        },
+    },
     secrets: {
         description: 'Manage secrets at system/org/user/project scope. Values are never returned in plaintext.',
         usage: 'eve secrets <subcommand> [options]',
@@ -576,7 +598,7 @@ have to specify them on every command. Useful when working with multiple environ
     auth: {
         description: `Authenticate with Eve Horizon. Auth is optional for local development but required
 for cloud deployments. Credentials are stored per-profile.`,
-        usage: 'eve auth <login|logout|status|whoami|bootstrap|sync|token>',
+        usage: 'eve auth <login|logout|status|whoami|bootstrap|sync|creds|token>',
         subcommands: {
             login: {
                 description: 'Login via GitHub SSH challenge (default) or Supabase (legacy)',
@@ -647,18 +669,35 @@ for cloud deployments. Credentials are stored per-profile.`,
             },
             sync: {
                 description: 'Extract OAuth tokens from host and set as Eve secrets',
-                usage: 'eve auth sync [--claude] [--codex] [--project <id>] [--system] [--dry-run]',
+                usage: 'eve auth sync [--claude] [--codex] [--org <id>] [--project <id>] [--dry-run]',
                 options: [
                     '--claude           Only extract Claude/Anthropic tokens',
                     '--codex            Only extract Codex/OpenAI tokens',
-                    '--project <id>     Project to set secrets on (uses profile default)',
-                    '--system           Set as system secrets instead of project secrets',
+                    '--org <id>         Set as org-level secrets',
+                    '--project <id>     Set as project-level secrets',
                     '--dry-run          Show what would be set without actually setting',
+                    '',
+                    'Scope priority: --project > --org > user (default)',
+                    'Default scope is user-level, so credentials are available to all your jobs.',
                 ],
                 examples: [
-                    'eve auth sync',
-                    'eve auth sync --claude --dry-run',
-                    'eve auth sync --project proj_xxx',
+                    'eve auth sync                    # Sync to user-level (default)',
+                    'eve auth sync --org org_xxx      # Sync to org-level',
+                    'eve auth sync --project proj_xxx # Sync to project-level',
+                    'eve auth sync --dry-run          # Preview without syncing',
+                ],
+            },
+            creds: {
+                description: 'Show local AI tool credentials (Claude Code, Codex/Code) without syncing',
+                usage: 'eve auth creds [--claude] [--codex]',
+                options: [
+                    '--claude           Only check Claude/Anthropic credentials',
+                    '--codex            Only check Codex/OpenAI credentials',
+                ],
+                examples: [
+                    'eve auth creds',
+                    'eve auth creds --claude',
+                    'eve auth creds --json',
                 ],
             },
         },
@@ -704,6 +743,8 @@ for cloud deployments. Credentials are stored per-profile.`,
                     '--direct               Bypass pipeline and do direct deploy',
                     '--inputs <json>        JSON inputs for the deployment (e.g., \'{"release_id":"rel_xxx"}\')',
                     '--project <id>         Project ID or slug (uses profile default if omitted)',
+                    '--watch                Poll deployment status until ready (default: true)',
+                    '--timeout <seconds>    Watch timeout in seconds (default: 120)',
                 ],
                 examples: [
                     'eve env deploy staging --ref abc123',
@@ -712,6 +753,19 @@ for cloud deployments. Credentials are stored per-profile.`,
                     'eve env deploy staging --ref abc123 --direct --inputs \'{"release_id":"rel_xxx"}\'',
                 ],
             },
+            diagnose: {
+                description: 'Diagnose environment deployments (k8s-only)',
+                usage: 'eve env diagnose <project> <env> [--events <n>]',
+                options: [
+                    '<project>             Project ID or slug',
+                    '<env>                 Environment name',
+                    '--events <n>          Limit number of recent events',
+                ],
+                examples: [
+                    'eve env diagnose proj_xxx staging',
+                    'eve env diagnose proj_xxx staging --events 20',
+                ],
+            },
             logs: {
                 description: 'Fetch logs for a service in an environment (k8s-only)',
                 usage: 'eve env logs <project> <env> <service> [--since <seconds>] [--tail <n>] [--grep <text>]',
@@ -748,6 +802,7 @@ for cloud deployments. Credentials are stored per-profile.`,
             'eve env create test --type=persistent',
             'eve env deploy staging --ref abc123',
             'eve env logs proj_xxx staging api --tail 200',
+            'eve env diagnose proj_xxx staging',
         ],
     },
     api: {
@@ -1162,6 +1217,7 @@ function showMainHelp() {
     console.log('Commands:');
     console.log('  org        Manage organizations');
     console.log('  project    Manage projects');
+    console.log('  manifest   Validate manifests (schema, secrets)');
     console.log('  job        Manage jobs (create, list, show, update, claim, etc.)');
     console.log('  env        Manage environments (list, show, deploy)');
     console.log('  release    Manage and inspect releases');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eve-horizon/cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Eve Horizon CLI",
   "license": "MIT",
   "repository": {