@iislee/opencodex 2.11.0

package/src/cli/status.ts

@@ -0,0 +1,321 @@
+import { durableBunRuntime } from "../lib/bun-runtime";
+import { codexAutoStartEnabled, getConfigPath, getPidPath, readConfigDiagnostics, readPid, readRuntimePort, type RuntimePortState } from "../config";
+import { diagnoseCodexBundledPlugins, type CodexPluginsDiagnostic } from "../codex/plugins-doctor";
+import { findLiveProxy, isOpencodexHealthz, probeHostname } from "../server/proxy-liveness";
+import type { OcxConfig } from "../types";
+import { diagnoseService, serviceLogPath } from "../service";
+import { collectStartupHealth, type StartupHealth } from "../codex/autostart-health";
+import { getCodexRoutingKind } from "../codex/inject";
+import { diagnoseCodexShim } from "../codex/shim";
+import { displayCodexRuntimePath, effortClampAppliesToRuntime, loadLastEffortClamp, resolveCodexRuntime } from "../codex/runtime";
+import { redactSecretString, redactUserPath } from "../lib/redact";
+import { collectOrcaCodexHomeDiagnostic, type OrcaCodexHomeDiagnostic } from "../codex/home";
+import { grokFenceEndpointDrift, readGrokStatus } from "../grok/status";
+
+type HealthCheck = {
+  ok: boolean;
+  url: string;
+  message: string;
+  label: string;
+};
+
+export type CliStatusJson = {
+  schemaVersion: 1;
+  proxy: {
+    running: boolean;
+    pid: number | null;
+    health: {
+      ok: boolean;
+      url: string;
+      message: string;
+    };
+  };
+  dashboard: { url: string };
+  listen: {
+    port: number;
+    hostname: string | null;
+    source: "runtime" | "config";
+  };
+  paths: {
+    config: string;
+    pid: string;
+    runtime: string;
+  };
+  runtime: {
+    source: string;
+    overrideEnv?: string;
+  };
+  codexAutostart: boolean;
+  startup: StartupHealth;
+  defaultProvider: string | null;
+  config: {
+    source: "default" | "file" | "fallback";
+    error: string | null;
+  };
+  service: { summary: string };
+  codexShim: { summary: string };
+  codexPlugins: CodexPluginsDiagnostic;
+  codexRuntime: {
+    path: string;
+    version: string | null;
+    source: string;
+    newerAvailable: { path: string; version: string | null } | null;
+    warning: string | null;
+    catalogClamp: {
+      active: boolean;
+      removedEfforts: string[];
+      runtimeVersion: string | null;
+    };
+  };
+  codexHome: OrcaCodexHomeDiagnostic;
+};
+
+export type CliStatusView = {
+  json: CliStatusJson;
+  proxyLabel: string;
+  healthLabel: string;
+};
+
+
+export type ListenTarget = {
+  port: number;
+  hostname?: string;
+  source: "runtime" | "config";
+  healthUrl: string;
+  dashboardUrl: string;
+};
+
+export function selectListenTarget(
+  config: Pick<OcxConfig, "port" | "hostname">,
+  pid: number | null,
+  runtimePort: RuntimePortState | null,
+): ListenTarget {
+  const currentRuntimePort = pid && runtimePort?.pid === pid ? runtimePort : null;
+  const port = currentRuntimePort ? currentRuntimePort.port : config.port ?? 10100;
+  const hostname = currentRuntimePort ? currentRuntimePort.hostname : config.hostname;
+  return {
+    port,
+    hostname,
+    source: currentRuntimePort ? "runtime" : "config",
+    healthUrl: `http://${probeHostname(hostname)}:${port}/healthz`,
+    dashboardUrl: `http://localhost:${port}/`,
+  };
+}
+
+/** Prefer live result (including authoritative null pid) over the on-disk pid file. */
+export function resolveStatusPid(
+  live: { pid: number | null } | null,
+  pidFile: number | null,
+): number | null {
+  return live ? live.pid : pidFile;
+}
+
+async function checkProxyHealth(target: ListenTarget): Promise<HealthCheck> {
+  const url = target.healthUrl;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 800);
+  try {
+    const response = await fetch(url, { signal: controller.signal });
+    if (!response.ok) {
+      const message = `returned HTTP ${response.status}`;
+      return { ok: false, url, message, label: `${url} ${message}` };
+    }
+    const body = await response.json().catch(() => null) as { service?: unknown; status?: unknown; version?: unknown; uptime?: unknown } | null;
+    if (!isOpencodexHealthz(body)) {
+      const message = "responded, but not an opencodex proxy";
+      return { ok: false, url, message, label: `${url} ${message}` };
+    }
+    const version = typeof body?.version === "string" ? ` v${body.version}` : "";
+    const uptime = typeof body?.uptime === "number" ? `, uptime ${Math.round(body.uptime)}s` : "";
+    const message = `ok${version}${uptime}`;
+    return { ok: true, url, message, label: `${url} ${message}` };
+  } catch (error) {
+    const reason = error instanceof Error && error.name === "AbortError" ? "timed out" : "unreachable";
+    return { ok: false, url, message: reason, label: `${url} ${reason}` };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function collectStatus(): Promise<CliStatusView> {
+  const configDiagnostics = readConfigDiagnostics();
+  const config = configDiagnostics.config;
+  // Prefer identity-verified liveness (runtime-port + /healthz) over ocx.pid alone (#618).
+  // Pass the already-resolved diagnostics config so findLiveProxy does not re-load and
+  // warn on malformed config.json (status --json must stay stderr-clean).
+  const live = await findLiveProxy({
+    configFn: () => ({ port: config.port, hostname: config.hostname }),
+  });
+  const pidFile = readPid();
+  // Preserve an authoritative null from orphan/legacy liveness — do not restore pidFile.
+  const pid = resolveStatusPid(live, pidFile);
+  const listen = live
+    ? {
+      port: live.port,
+      hostname: live.hostname,
+      source: live.source,
+      healthUrl: `http://${probeHostname(live.hostname)}:${live.port}/healthz`,
+      dashboardUrl: `http://localhost:${live.port}/`,
+    }
+    : selectListenTarget(config, pidFile, pidFile ? readRuntimePort(pidFile) : null);
+  // findLiveProxy already identity-probed /healthz; avoid a second fetch that can race.
+  const health = live
+    ? {
+      ok: true,
+      url: listen.healthUrl,
+      message: `ok (pid ${live.pid ?? "unknown"})`,
+      label: `${listen.healthUrl} ok (live)`,
+    }
+    : await checkProxyHealth(listen);
+  const bunRuntime = durableBunRuntime();
+  const service = diagnoseService();
+  // A service can be registered and still not serve: the manager reports the job
+  // either way. `live` was already identity-probed a few lines above, so cross-check
+  // rather than print registration as if it were service.
+  const serviceSummary = service.installed && !live
+    ? `${service.summary} — registered but NOT serving; see ${serviceLogPath()} and re-run 'ocx service install'`
+    : service.summary;
+  const codexShim = diagnoseCodexShim();
+  const codexShimSummary = codexShim.summary;
+  const startup = collectStartupHealth(config, {
+    service,
+    shim: codexShim,
+    routingKind: getCodexRoutingKind(),
+  });
+  const codexPlugins = diagnoseCodexBundledPlugins();
+  const resolvedRuntime = (() => {
+    try {
+      return resolveCodexRuntime();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const redacted = redactUserPath(redactSecretString(message)).slice(0, 160);
+      return {
+        runtime: { command: "codex", version: null, source: "fallback" as const },
+        failures: [{
+          command: "codex",
+          source: "fallback" as const,
+          reason: `resolve threw: ${redacted}`,
+        }],
+        replacedConfigured: undefined,
+        newerAvailable: undefined,
+      };
+    }
+  })();
+  const lastClamp = loadLastEffortClamp();
+  const clampActive = effortClampAppliesToRuntime(lastClamp, resolvedRuntime.runtime);
+  const codexHome = collectOrcaCodexHomeDiagnostic();
+  const warningParts: string[] = [];
+  if (
+    resolvedRuntime.replacedConfigured
+    && resolvedRuntime.replacedConfigured.from.command !== resolvedRuntime.runtime.command
+  ) {
+    warningParts.push(
+      `Preferred Codex runtime is unavailable; using ${displayCodexRuntimePath(resolvedRuntime.runtime.command)} instead. Run ocx doctor for diagnosis and recovery.`,
+    );
+  } else if (
+    resolvedRuntime.runtime.source === "fallback"
+    && resolvedRuntime.failures.length > 0
+    && !resolvedRuntime.runtime.version
+  ) {
+    const detail = resolvedRuntime.failures[0]?.reason;
+    warningParts.push(
+      detail
+        ? `No validated Codex runtime found (${detail}); falling back to \`codex\`. Run ocx doctor for diagnosis and recovery.`
+        : "No validated Codex runtime found; falling back to `codex`. Run ocx doctor for diagnosis and recovery.",
+    );
+  }
+  if (resolvedRuntime.newerAvailable) {
+    warningParts.push("OpenCodex is using an older Codex binary. Run ocx doctor for diagnosis and recovery.");
+  }
+  if (clampActive) {
+    warningParts.push(
+      `Catalog clamp removed: ${lastClamp!.removedEfforts.join(", ")}. Run ocx doctor for diagnosis and recovery.`,
+    );
+  }
+  // A Grok fence naming a port we are not listening on is invisible everywhere else:
+  // grok retries the refused connection on its own side, so no request — and therefore
+  // no log line — ever reaches us. Surface it here, where the live port is already known.
+  const grokDrift = (() => {
+    try {
+      return grokFenceEndpointDrift(readGrokStatus(), health.ok ? listen.port : undefined);
+    } catch {
+      return null; // reading grok's config must never break `ocx status`
+    }
+  })();
+  if (grokDrift) {
+    warningParts.push(
+      `Grok Build config points at port ${grokDrift.fencePort}, but the proxy is on `
+      + `${grokDrift.livePort}; grok turns will retry against a closed port. Run 'ocx ensure' to repoint it.`,
+    );
+  }
+  const codexRuntime = {
+    path: displayCodexRuntimePath(resolvedRuntime.runtime.command),
+    version: resolvedRuntime.runtime.version,
+    source: resolvedRuntime.runtime.source,
+    newerAvailable: resolvedRuntime.newerAvailable
+      ? {
+        path: displayCodexRuntimePath(resolvedRuntime.newerAvailable.command),
+        version: resolvedRuntime.newerAvailable.version,
+      }
+      : null,
+    warning: warningParts.length > 0 ? warningParts.join(" ") : null,
+    catalogClamp: {
+      active: clampActive,
+      removedEfforts: clampActive ? (lastClamp?.removedEfforts ?? []) : [],
+      runtimeVersion: clampActive ? (lastClamp?.runtimeVersion ?? null) : null,
+    },
+  };
+  const proxyLabel = live
+    ? `running (PID ${live.pid ?? pid ?? "unknown"})`
+    : pid && health.ok
+      ? `running (PID ${pid})`
+      : pid
+        ? `PID file points to PID ${pid}, but health check failed`
+        : health.ok
+          ? "reachable, but PID file is missing or stale"
+          : "not running";
+
+  return {
+    proxyLabel,
+    healthLabel: health.label,
+    json: {
+      schemaVersion: 1,
+      proxy: {
+        running: Boolean(live) || Boolean(pid && health.ok),
+        pid: live?.pid ?? pid,
+        health: {
+          ok: health.ok,
+          url: health.url,
+          message: health.message,
+        },
+      },
+      dashboard: { url: listen.dashboardUrl },
+      listen: {
+        port: listen.port,
+        hostname: listen.hostname ?? null,
+        source: listen.source,
+      },
+      paths: {
+        config: getConfigPath(),
+        pid: getPidPath(),
+        runtime: bunRuntime.path,
+      },
+      runtime: {
+        source: bunRuntime.source,
+        ...(bunRuntime.source === "override" ? { overrideEnv: bunRuntime.overrideEnv } : {}),
+      },
+      codexAutostart: codexAutoStartEnabled(config),
+      startup,
+      defaultProvider: typeof config.defaultProvider === "string" ? config.defaultProvider : null,
+      config: {
+        source: configDiagnostics.source,
+        error: configDiagnostics.error,
+      },
+      service: { summary: serviceSummary },
+      codexShim: { summary: codexShimSummary },
+      codexPlugins,
+      codexRuntime,
+      codexHome,
+    },
+  };
+}

package/src/cli/sync-cloud.ts

@@ -0,0 +1,283 @@
+/**
+ * ocx sync-cloud — OneDrive cloud backup/restore for OpenCodex local state.
+ */
+import { openUrl } from "../lib/open-url";
+import {
+  clearOneDriveToken,
+  fetchOneDriveAccountEmail,
+  loginWithBrowserLoopback,
+  pollDeviceCodeToken,
+  readOneDriveToken,
+  startDeviceCodeLogin,
+  writeOneDriveToken,
+} from "../cloud/onedrive-auth";
+import { remoteSyncRootDescription } from "../cloud/onedrive-graph";
+import { pullFromOneDrive, pushToOneDrive, readRemoteManifest } from "../cloud/sync";
+import {
+  getDeviceName,
+  getOrCreateDeviceId,
+  readCloudSyncSettings,
+  resolveClientId,
+  writeCloudSyncSettings,
+} from "../cloud/settings";
+import { CliUsageError, printData, rejectArgs, runCliAction, takeFlag, takeOption } from "./runtime-api";
+
+const USAGE = `Usage:
+  ocx sync-cloud login [--client-id <id>] [--device] [--json]
+  ocx sync-cloud logout [--json]
+  ocx sync-cloud status [--json]
+  ocx sync-cloud set-client-id <id> [--secret <secret>] [--json]
+  ocx sync-cloud push [--passphrase <p>] [--include-usage] [--no-vault] [--json]
+  ocx sync-cloud pull --yes [--passphrase <p>] [--include-usage] [--json]
+
+Microsoft OneDrive sync for ~/.opencodex (config + optional encrypted auth vault).
+Default login is browser loopback PKCE.
+If Azure requires client_secret (AADSTS70002), pass --secret or set OPENCODEX_MS_CLIENT_SECRET.
+
+Environment:
+  OPENCODEX_MS_CLIENT_ID       Microsoft application (client) ID
+  OPENCODEX_MS_CLIENT_SECRET   Optional client secret (confidential/Web apps)
+  OPENCODEX_MS_AUTHORITY       common | consumers | organizations (default consumers)
+  OPENCODEX_MS_LOOPBACK_PORT   Default 18765 — register http://localhost:<port> in Azure`;
+
+function readPassphrase(args: string[]): string | undefined {
+  const fromFlag = takeOption(args, "--passphrase");
+  if (fromFlag) return fromFlag;
+  return process.env.OPENCODEX_SYNC_PASSPHRASE?.trim() || undefined;
+}
+
+async function handleLogin(argv: string[]): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const useDevice = takeFlag(args, "--device");
+  const clientIdFlag = takeOption(args, "--client-id");
+  rejectArgs(args, USAGE);
+  const clientId = resolveClientId(clientIdFlag ?? undefined);
+
+  // Persist client id for later refresh/login
+  const settings = readCloudSyncSettings();
+  writeCloudSyncSettings({ ...settings, clientId });
+
+  let store;
+  if (useDevice) {
+    const start = await startDeviceCodeLogin(clientId);
+    if (wantsJson) {
+      console.log(JSON.stringify({
+        mode: "device",
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        verificationUriComplete: start.verificationUriComplete,
+        message: start.message,
+        expiresIn: start.expiresIn,
+        msAuthority: start.authority,
+      }, null, 2));
+    } else {
+      console.log("\n☁️  OneDrive login (Microsoft device code)\n");
+      console.log(`  1. Open: ${start.verificationUri}`);
+      console.log(`  2. Enter code: ${start.userCode}`);
+      if (start.verificationUriComplete) {
+        console.log(`  Or open: ${start.verificationUriComplete}`);
+      }
+      console.log(`\n  ${start.message}\n`);
+    }
+    try {
+      openUrl(start.verificationUriComplete || start.verificationUri);
+    } catch { /* optional */ }
+    store = await pollDeviceCodeToken(
+      clientId,
+      start.deviceCode,
+      start.interval,
+      start.expiresIn,
+      msg => { if (!wantsJson) console.log(`   ${msg}`); },
+      start.authority,
+    );
+  } else {
+    if (!wantsJson) {
+      console.log("\n☁️  OneDrive login (browser loopback PKCE)\n");
+      console.log("  Azure app needs: Mobile and desktop platform + redirect http://localhost");
+      console.log("  Opening browser…\n");
+    }
+    store = await loginWithBrowserLoopback(clientId, undefined, info => {
+      if (wantsJson) {
+        console.log(JSON.stringify({ mode: "browser", authUrl: info.authUrl, redirectUri: info.redirectUri }, null, 2));
+      } else {
+        console.log(`  Auth URL: ${info.authUrl}`);
+        console.log(`  Redirect: ${info.redirectUri}\n`);
+      }
+      try { openUrl(info.authUrl); } catch { /* optional */ }
+    });
+  }
+
+  const email = await fetchOneDriveAccountEmail(store.accessToken);
+  if (email) {
+    store.account = email;
+    writeOneDriveToken(store);
+  }
+
+  if (wantsJson) {
+    console.log(JSON.stringify({ ok: true, account: email ?? null, remoteRoot: remoteSyncRootDescription() }, null, 2));
+  } else {
+    console.log(`\n✅ Logged in to OneDrive${email ? ` as ${email}` : ""}.`);
+    console.log(`   Remote folder: ${remoteSyncRootDescription()}`);
+    console.log(`   Next: ocx sync-cloud push --passphrase 'your-secret-passphrase'`);
+  }
+}
+
+async function handleLogout(argv: string[]): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  rejectArgs(args, USAGE);
+  clearOneDriveToken();
+  printData({ ok: true }, wantsJson, ["Logged out of OneDrive (local token removed)."]);
+}
+
+async function handleStatus(argv: string[]): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  rejectArgs(args, USAGE);
+  const settings = readCloudSyncSettings();
+  const token = readOneDriveToken();
+  let remote: Awaited<ReturnType<typeof readRemoteManifest>> | null = null;
+  let remoteError: string | undefined;
+  if (token) {
+    try {
+      remote = await readRemoteManifest();
+    } catch (e) {
+      remoteError = e instanceof Error ? e.message : String(e);
+    }
+  }
+  const payload = {
+    clientId: settings.clientId ?? process.env.OPENCODEX_MS_CLIENT_ID ?? null,
+    loggedIn: Boolean(token),
+    account: token?.account ?? null,
+    deviceId: getOrCreateDeviceId(),
+    deviceName: getDeviceName(),
+    lastSyncAt: settings.lastSyncAt ?? null,
+    lastSyncDirection: settings.lastSyncDirection ?? null,
+    remoteRoot: remoteSyncRootDescription(),
+    remoteManifest: remote,
+    remoteError: remoteError ?? null,
+  };
+  if (wantsJson) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  console.log("\n☁️  Cloud sync (OneDrive)\n");
+  console.log(`  Client ID:   ${payload.clientId ?? "(not set — ocx sync-cloud set-client-id …)"}`);
+  console.log(`  Logged in:   ${payload.loggedIn ? "yes" : "no"}`);
+  if (payload.account) console.log(`  Account:     ${payload.account}`);
+  console.log(`  Device:      ${payload.deviceName} (${payload.deviceId})`);
+  console.log(`  Remote:      ${payload.remoteRoot}`);
+  console.log(`  Last sync:   ${payload.lastSyncAt ?? "never"} ${payload.lastSyncDirection ? `(${payload.lastSyncDirection})` : ""}`);
+  if (remote) {
+    console.log(`  Remote at:   ${remote.updatedAt} from ${remote.deviceName}`);
+    console.log(`  Remote files:${remote.files.join(", ")}`);
+    console.log(`  Has vault:   ${remote.hasVault ? "yes" : "no"}`);
+  } else if (remoteError) {
+    console.log(`  Remote:      error — ${remoteError}`);
+  } else if (payload.loggedIn) {
+    console.log("  Remote:      (no manifest yet — push first)");
+  }
+  console.log();
+}
+
+async function handleSetClientId(argv: string[]): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const secret = takeOption(args, "--secret");
+  const id = args.shift()?.trim();
+  rejectArgs(args, USAGE);
+  if (!id) throw new CliUsageError("client id is required", USAGE);
+  const settings = readCloudSyncSettings();
+  const next = { ...settings, clientId: id };
+  if (secret !== undefined) {
+    const s = secret.trim();
+    if (s) next.clientSecret = s;
+    else delete next.clientSecret;
+  }
+  writeCloudSyncSettings(next);
+  printData(
+    { ok: true, clientId: id, hasClientSecret: Boolean(next.clientSecret) },
+    wantsJson,
+    [
+      `Saved Microsoft client_id (${id.slice(0, 8)}…)`
+      + (next.clientSecret ? " + client secret." : "."),
+    ],
+  );
+}
+
+async function handlePush(argv: string[]): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const includeUsage = takeFlag(args, "--include-usage");
+  const noVault = takeFlag(args, "--no-vault");
+  const passphrase = readPassphrase(args);
+  rejectArgs(args, USAGE);
+  // Ensure client id exists for refresh path
+  resolveClientId();
+  const result = await pushToOneDrive({
+    passphrase: noVault ? undefined : passphrase,
+    includeUsage,
+    includeVault: !noVault && Boolean(passphrase),
+  });
+  if (wantsJson) {
+    console.log(JSON.stringify({ ok: true, ...result }, null, 2));
+    return;
+  }
+  console.log("\n✅ Pushed to OneDrive");
+  console.log(`   ${result.remoteRoot}`);
+  console.log(`   Files: ${result.files.join(", ")}`);
+  console.log(`   Vault: ${result.hasVault ? "yes (encrypted)" : "no"}`);
+  console.log(`   At:    ${result.updatedAt}\n`);
+}
+
+async function handlePull(argv: string[]): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const yes = takeFlag(args, "--yes");
+  const includeUsage = takeFlag(args, "--include-usage");
+  const passphrase = readPassphrase(args);
+  rejectArgs(args, USAGE);
+  resolveClientId();
+  const result = await pullFromOneDrive({ yes, passphrase, includeUsage });
+  if (wantsJson) {
+    console.log(JSON.stringify({ ok: true, ...result }, null, 2));
+    return;
+  }
+  console.log("\n✅ Pulled from OneDrive");
+  console.log(`   ${result.remoteRoot}`);
+  console.log(`   Applied: ${result.files.join(", ")}`);
+  console.log(`   Vault restored: ${result.hasVault ? "yes" : "no"}`);
+  console.log(`   Remote timestamp: ${result.updatedAt}\n`);
+  console.log("   Tip: run `ocx sync` to refresh Codex catalog after config pull.\n");
+}
+
+export async function handleSyncCloudCommand(argv: string[]): Promise<number> {
+  return runCliAction(async () => {
+    const args = [...argv];
+    const sub = (args.shift() ?? "").toLowerCase();
+    if (!sub || sub === "help" || sub === "--help" || sub === "-h") {
+      console.log(USAGE);
+      console.log(`
+Azure app registration (once):
+  1. https://portal.azure.com → Microsoft Entra ID → App registrations → New
+  2. Name: OpenCodex Sync (any)
+  3. Supported account types: personal + work/school
+  4. Authentication → Advanced → Allow public client flows = Yes
+  5. API permissions → Microsoft Graph delegated:
+       User.Read, Files.ReadWrite, offline_access
+  6. Copy Application (client) ID → ocx sync-cloud set-client-id <id>
+`);
+      return;
+    }
+    if (sub === "login") return handleLogin(args);
+    if (sub === "logout") return handleLogout(args);
+    if (sub === "status") return handleStatus(args);
+    if (sub === "set-client-id") return handleSetClientId(args);
+    if (sub === "push") return handlePush(args);
+    if (sub === "pull") return handlePull(args);
+    throw new CliUsageError(`unknown sync-cloud subcommand: ${sub}`, USAGE);
+  });
+}
+
+export const SYNC_CLOUD_USAGE = USAGE;