@ricsam/r5dctl 0.0.126 → 0.0.128

package/dist/mjs/cli.mjs

@@ -11,6 +11,7 @@ import {
   R5dctlClient
 } from "@ricsam/r5d-api";
 import { runR5dctlShell } from "./shell.mjs";
+import { ACCOUNT_HELP_ENTRIES, executeAccountCommand, getAccountHelp, parseAccountCommand } from "./account.mjs";
 const CHAT_MODES = /* @__PURE__ */ new Set(["plan", "agent", "large_diff_remediation"]);
 const R5DCTL_SESSION_MODES = /* @__PURE__ */ new Set(["plan", "agent"]);
 const R5DCTL_PROMPT_DELIVERIES = /* @__PURE__ */ new Set(["queue", "steer", "force"]);
@@ -58,20 +59,10 @@ const PS_HELP_TEXT = [
   "  r5dctl ps inspect <run-id>",
   "  r5dctl ps stop <run-id>",
   "",
-  "List, inspect, or gracefully stop r5d-managed worker processes.",
+  "List, inspect, or gracefully stop agent processes on workers.",
   "Use -p/--project, -b/--branch, or -s/--session to filter list and history.",
   ""
 ].join("\n");
-const K8S_HELP_TEXT = [
-  "Usage:",
-  "  r5dctl k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
-  "  r5dctl vcluster trusted-workflow add --repo <owner/repository> --workflow <.github/workflows/file.yml>",
-  "  r5dctl vcluster trusted-workflow list",
-  "  r5dctl vcluster trusted-workflow remove <workflow-id>",
-  "",
-  "Show current and rolling CPU and memory usage for managed-vCluster workload containers.",
-  ""
-].join("\n");
 const SESSION_RUN_HELP_TEXT = [
   "Usage:",
   '  r5dctl -p <project> session start --worker <label> --worktree <branch> --model <tier> [-f|--follow|--watch] [--tools] [--parent-session <session-id>] "<prompt>"',
@@ -104,6 +95,7 @@ const SESSION_RUN_HELP_TEXT = [
   ""
 ].join("\n");
 const SHARED_HELP_ENTRIES = [
+  ...ACCOUNT_HELP_ENTRIES.map((entry) => ({ ...entry, section: "account" })),
   { section: "auth", usage: "auth status", description: "Show the current authenticated user and credential source." },
   { section: "auth", usage: "auth logout", description: "Revoke the current credential and clear saved auth." },
   {
@@ -263,26 +255,10 @@ const SHARED_HELP_ENTRIES = [
     usage: "-s <session-id> answer-env-request --worker <label> --mode <mode> --model <tier> [-e KEY=value] [--context <text>]",
     description: "Answer a pending environment variable request with values, context, or both."
   },
-  {
-    section: "kubernetes",
-    usage: "k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
-    description: "Show current and rolling CPU and memory usage for managed-vCluster workload containers."
-  },
-  {
-    section: "kubernetes",
-    usage: "vcluster trusted-workflow add --repo <owner/repository> --workflow <.github/workflows/file.yml>",
-    description: "Trust an exact GitHub Actions workflow path to authenticate kubectl against your managed vCluster."
-  },
-  { section: "kubernetes", usage: "vcluster trusted-workflow list", description: "List trusted GitHub Actions workflows." },
-  {
-    section: "kubernetes",
-    usage: "vcluster trusted-workflow remove <workflow-id>",
-    description: "Revoke a trusted GitHub Actions workflow and its outstanding credentials."
-  },
   {
     section: "processes",
     usage: "ps list [--worker <label>]",
-    description: "List active r5d-managed worker processes; global project, branch, and session filters apply."
+    description: "List active agent processes on workers; global project, branch, and session filters apply."
   },
   {
     section: "processes",
@@ -298,23 +274,23 @@ const SHARED_HELP_ENTRIES = [
 ];
 const HELP_SECTION_ORDER = [
   "auth",
+  "account",
   "workspace",
   "projects",
   "branches",
   "envs",
   "sessions",
-  "kubernetes",
   "processes",
   "shell"
 ];
 const HELP_SECTION_TITLES = {
   auth: "Auth",
+  account: "Account instructions, environment variables, and secret files",
   workspace: "Canonical workspace",
   projects: "Projects",
   branches: "Branches",
   envs: "Environment variables",
   sessions: "Sessions",
-  kubernetes: "Kubernetes",
   processes: "Processes",
   shell: "Shell"
 };
@@ -638,7 +614,10 @@ async function deleteBranchThroughPlatform(client, projectRef, branchName, optio
   const branchId = branch.branchId;
   let accepted;
   try {
-    accepted = await requireServerRouteSupport("delete branch", () => client.projects.branches.delete(projectRef, branchName, { branchId }));
+    accepted = await requireServerRouteSupport(
+      "delete branch",
+      () => client.projects.branches.delete(projectRef, branchName, { branchId })
+    );
   } catch (error) {
     const landed = error instanceof R5dctlApiError ? await resolveUncertainAcceptance(client, projectRef, branchId, error) : null;
     if (!landed) throw error;
@@ -979,12 +958,31 @@ function parseGlobalArgs(argv) {
     version: false
   };
   const rest = [];
+  const seenGlobalFlags = /* @__PURE__ */ new Set();
+  let duplicateGlobalFlag;
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
+    if (rest[0] === "account" && (arg === "--value" || arg === "--file" || arg === "--description")) {
+      rest.push(arg);
+      if (i + 1 < argv.length) rest.push(argv[++i]);
+      continue;
+    }
+    if (rest[0] === "account" && arg === "") {
+      rest.push(arg);
+      continue;
+    }
     if (!arg) {
       continue;
     }
+    const globalName = { "-p": "--project", "-b": "--branch", "-s": "--session", "-h": "--help", "-v": "--version" }[arg] ?? arg.split("=", 1)[0];
+    if (["--base-url", "--json", "--config", "--token", "--api-key", "--project", "--branch", "--session", "--help", "--version"].includes(
+      globalName
+    )) {
+      if (seenGlobalFlags.has(globalName)) duplicateGlobalFlag ??= globalName;
+      seenGlobalFlags.add(globalName);
+    }
     if (arg === "--") {
+      if (rest[0] === "account") rest.push(arg);
       rest.push(...argv.slice(i + 1));
       break;
     }
@@ -1065,6 +1063,7 @@ function parseGlobalArgs(argv) {
     }
     rest.push(arg);
   }
+  if (rest[0] === "account" && duplicateGlobalFlag) throw new Error(`${duplicateGlobalFlag} may only be provided once`);
   return { options, rest };
 }
 function parseConfig(configPath) {
@@ -1553,36 +1552,6 @@ function parseRecentSessionArgs(args) {
   if (!Number.isInteger(limit) || limit < 1 || limit > 200) throw new Error("--limit must be an integer between 1 and 200");
   return { limit };
 }
-function parseK8sUsageArgs(args) {
-  const parsed = { window: "24h" };
-  const seen = /* @__PURE__ */ new Set();
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index];
-    if (!arg) continue;
-    const option = ["--namespace", "--workload", "--container", "--window"].find(
-      (candidate) => arg === candidate || arg.startsWith(`${candidate}=`)
-    );
-    if (!option) throw new Error(`Unknown k8s usage argument: ${arg}`);
-    if (seen.has(option)) throw new Error(`Use ${option} only once`);
-    seen.add(option);
-    const inlineValue = parseLongOptionWithEquals(arg, option);
-    const candidateValue = inlineValue ?? args[index + 1];
-    if (!candidateValue || candidateValue.startsWith("--")) throw new Error(`Missing value for ${option}`);
-    const value = candidateValue;
-    if (inlineValue === void 0) index += 1;
-    if (option === "--window") {
-      if (value !== "24h" && value !== "7d") throw new Error("--window must be 24h or 7d");
-      parsed.window = value;
-    } else if (option === "--namespace") {
-      parsed.namespace = value;
-    } else if (option === "--workload") {
-      parsed.workload = value;
-    } else {
-      parsed.container = value;
-    }
-  }
-  return parsed;
-}
 async function openInBrowser(url) {
   if (process.platform === "darwin") {
     spawn("open", [url], { stdio: "ignore", detached: true }).unref();
@@ -1773,7 +1742,9 @@ function renderSessionList(sessions, nowMs = Date.now()) {
   if (sessions.length === 0) {
     return "No sessions found.\n";
   }
-  return `${sessions.map((session) => [session.id, session.branchName, formatSessionActivity(session, nowMs), session.name ?? "(unnamed)"].filter(Boolean).join("  ")).join("\n")}
+  return `${sessions.map(
+    (session) => [session.id, session.branchName, formatSessionActivity(session, nowMs), session.name ?? "(unnamed)"].filter(Boolean).join("  ")
+  ).join("\n")}
 `;
 }
 function renderRecentSessionList(sessions) {
@@ -1845,171 +1816,6 @@ Error: ${result.error}` : "";
   return `Workspace sync ${result.outcome} on ${result.workerLabel}; HEAD ${head}; ${result.diffSizeBytes} bytes.${discarded}${error}
 `;
 }
-function summarizeK8sHistory(history) {
-  if (history.envelope.length === 0) {
-    return {
-      cpuMinNanoCores: null,
-      cpuMaxNanoCores: null,
-      memoryMinBytes: null,
-      memoryMaxBytes: null,
-      sampleCount: 0
-    };
-  }
-  return {
-    cpuMinNanoCores: Math.min(...history.envelope.map((point) => point.cpuMinNanoCores)),
-    cpuMaxNanoCores: Math.max(...history.envelope.map((point) => point.cpuMaxNanoCores)),
-    memoryMinBytes: Math.min(...history.envelope.map((point) => point.memoryMinBytes)),
-    memoryMaxBytes: Math.max(...history.envelope.map((point) => point.memoryMaxBytes)),
-    sampleCount: history.envelope.reduce((total, point) => total + point.sampleCount, 0)
-  };
-}
-async function mapWithConcurrency(items, concurrency, fn) {
-  const results = new Array(items.length);
-  let nextIndex = 0;
-  await Promise.all(
-    Array.from({ length: Math.min(concurrency, items.length) }, async () => {
-      while (nextIndex < items.length) {
-        const index = nextIndex++;
-        const item = items[index];
-        if (item !== void 0) results[index] = await fn(item);
-      }
-    })
-  );
-  return results;
-}
-async function collectK8sUsage(client, options) {
-  const resources = await client.k8s.resources();
-  const candidates = resources.workloads.flatMap((workload) => workload.containers.map((container) => ({ workload, container }))).filter(({ workload, container }) => {
-    const workloadMatches = !options.workload || options.workload === workload.name || options.workload === `${workload.namespace}/${workload.name}` || options.workload === workload.uid;
-    return (!options.namespace || options.namespace === workload.namespace) && workloadMatches && (!options.container || options.container === container.name);
-  }).sort(
-    (left, right) => left.workload.namespace.localeCompare(right.workload.namespace) || left.workload.name.localeCompare(right.workload.name) || left.container.name.localeCompare(right.container.name)
-  );
-  if (candidates.length === 0 && (options.namespace || options.workload || options.container)) {
-    throw new Error("No managed-vCluster workload containers matched the requested filters");
-  }
-  const entries = await mapWithConcurrency(candidates, 8, async ({ workload, container }) => {
-    const history = await client.k8s.resourceHistory({ workloadUid: workload.uid, containerName: container.name, window: options.window });
-    return {
-      workload: {
-        uid: workload.uid,
-        kind: workload.kind,
-        namespace: workload.namespace,
-        name: workload.name,
-        replicas: workload.replicas,
-        readyReplicas: workload.readyReplicas
-      },
-      container: {
-        name: container.name,
-        currentUsage: container.currentUsage,
-        pods: container.pods
-      },
-      sampledPodCount: container.pods.filter((pod) => pod.cpuNanoCores !== null || pod.memoryBytes !== null).length,
-      summary: summarizeK8sHistory(history),
-      history
-    };
-  });
-  return {
-    window: options.window,
-    collectedAt: resources.collectedAt,
-    metricsFreshAt: resources.metricsFreshAt,
-    metricsStale: resources.metricsStale,
-    filters: {
-      namespace: options.namespace,
-      workload: options.workload,
-      container: options.container
-    },
-    entries
-  };
-}
-function formatDecimal(value) {
-  if (value >= 100) return value.toFixed(0);
-  if (value >= 10) return value.toFixed(1).replace(/\.0$/, "");
-  return value.toFixed(2).replace(/\.0+$/, "").replace(/(\.\d)0$/, "$1");
-}
-function formatK8sCpu(value) {
-  if (value === null) return "-";
-  const milliCores = value / 1e6;
-  return `${formatDecimal(milliCores)}m`;
-}
-function formatK8sMemory(value) {
-  if (value === null) return "-";
-  const units = ["B", "Ki", "Mi", "Gi", "Ti"];
-  let amount = value;
-  let unitIndex = 0;
-  while (amount >= 1024 && unitIndex < units.length - 1) {
-    amount /= 1024;
-    unitIndex += 1;
-  }
-  return `${formatDecimal(amount)}${units[unitIndex]}`;
-}
-function getK8sUsageState(entry) {
-  const hasHistory = entry.history.envelope.length > 0;
-  const terminalPods = entry.container.pods.filter((pod) => pod.phase === "Succeeded" || pod.phase === "Failed").length;
-  const inactive = entry.sampledPodCount === 0 && (entry.workload.replicas === 0 || entry.container.pods.length > 0 && terminalPods === entry.container.pods.length || entry.workload.kind === "CronJob" && entry.container.pods.length === 0);
-  if (inactive) return "inactive";
-  if (entry.sampledPodCount === 0) return hasHistory ? entry.history.stale ? "stale" : "no current" : "no data";
-  if (!hasHistory) return "warming";
-  if (entry.history.stale) return "stale";
-  if (entry.history.incomplete) return "partial";
-  return "healthy";
-}
-function abbreviatedK8sKind(kind) {
-  switch (kind) {
-    case "Deployment":
-      return "deploy";
-    case "StatefulSet":
-      return "sts";
-    case "DaemonSet":
-      return "ds";
-    case "CronJob":
-      return "cron";
-    case "ReplicaSet":
-      return "rs";
-    case "Job":
-      return "job";
-    case "Pod":
-      return "pod";
-  }
-}
-function renderK8sUsageReport(report) {
-  const freshness = report.metricsFreshAt ?? "unavailable";
-  const lines = [
-    `Window: ${report.window}  Collector: ${report.metricsStale ? "stale" : "current"}  Fresh: ${freshness}`,
-    "PODS counts pods with current metrics."
-  ];
-  if (report.entries.length === 0) return `${lines.join("\n")}
-No managed-vCluster workload containers found.
-`;
-  const headers = ["WORKLOAD", "CONTAINER", "PODS", "CPU NOW", "CPU MAX", "MEM NOW", "MEM MAX", "STATE"];
-  const grouped = /* @__PURE__ */ new Map();
-  for (const entry of report.entries) {
-    const entries = grouped.get(entry.workload.namespace) ?? [];
-    entries.push(entry);
-    grouped.set(entry.workload.namespace, entries);
-  }
-  for (const [namespace, entries] of grouped) {
-    const rows = entries.map((entry) => {
-      const state = getK8sUsageState(entry);
-      return [
-        `${abbreviatedK8sKind(entry.workload.kind)}/${entry.workload.name}`,
-        entry.container.name,
-        String(entry.sampledPodCount),
-        formatK8sCpu(entry.container.currentUsage.cpuNanoCores),
-        formatK8sCpu(entry.summary.cpuMaxNanoCores),
-        formatK8sMemory(entry.container.currentUsage.memoryBytes),
-        formatK8sMemory(entry.summary.memoryMaxBytes),
-        state === "healthy" ? "-" : state
-      ];
-    });
-    const widths = headers.map((header, column) => Math.max(header.length, ...rows.map((row) => row[column]?.length ?? 0)));
-    const formatRow = (row) => row.map((value, column) => column === row.length - 1 ? value : value.padEnd(widths[column] ?? value.length)).join("  ");
-    const separator = widths.map((width) => "-".repeat(width)).join("  ");
-    lines.push("", `Namespace: ${namespace}`, formatRow(headers), separator, ...rows.map(formatRow));
-  }
-  return `${lines.join("\n")}
-`;
-}
 function renderSessionDescription(session) {
   return [`Session: ${session.id}`, `Project: ${session.projectPath}`, `Branch: ${session.branchName}`].join("\n") + "\n";
 }
@@ -2936,45 +2742,6 @@ async function executeR5dctlCommand(client, json, args) {
     write(result, renderWorkspaceSync(result));
     return;
   }
-  if (first === "k8s" && second === "usage") {
-    const report = await collectK8sUsage(client, parseK8sUsageArgs(args.slice(2)));
-    write(report, renderK8sUsageReport(report));
-    return;
-  }
-  if (first === "vcluster" && second === "trusted-workflow") {
-    const subcommand = requireValue(args[2], "Missing trusted-workflow command");
-    if (subcommand === "add") {
-      const parsed = parseCommandOperands(args.slice(3), /* @__PURE__ */ new Set(["--repo", "--workflow"]), /* @__PURE__ */ new Map(), "trusted-workflow add");
-      if (parsed.positionals.length > 0) throw new Error(`Unexpected trusted-workflow add value: ${parsed.positionals[0]}`);
-      const workflow = await client.k8s.trustedWorkflows.add({
-        repository: requireValue(parsed.values.get("--repo"), "--repo <owner/repository> is required"),
-        workflowPath: requireValue(parsed.values.get("--workflow"), "--workflow <path> is required")
-      });
-      write(workflow, "Trusted GitHub workflow configured successfully.\n");
-      return;
-    }
-    if (subcommand === "list") {
-      if (args.length > 3) throw new Error(`Unexpected trusted-workflow list value: ${args[3]}`);
-      const workflows = await client.k8s.trustedWorkflows.list();
-      write(
-        workflows,
-        workflows.length === 0 ? "No trusted GitHub workflows.\n" : `${workflows.map(
-          (workflow) => `${workflow.id}  ${workflow.repository}  ${workflow.workflowPath}  ${workflow.revokedAt ? "revoked" : "active"}`
-        ).join("\n")}
-`
-      );
-      return;
-    }
-    if (subcommand === "remove") {
-      const workflowId = requireValue(args[3], "Missing trusted workflow id");
-      if (args.length > 4) throw new Error(`Unexpected trusted-workflow remove value: ${args[4]}`);
-      const result = await client.k8s.trustedWorkflows.revoke(workflowId);
-      if (!result.success) throw new Error("Trusted GitHub workflow was not found or was already revoked");
-      write(result, "Trusted GitHub workflow revoked.\n");
-      return;
-    }
-    throw new Error(`Unknown trusted-workflow command: ${subcommand}`);
-  }
   if (first === "ps" && second === "list") {
     const processes = await client.processes.list(parsePsListArgs(args.slice(2)));
     write(processes, renderProcessList(processes));
@@ -3010,7 +2777,9 @@ async function executeR5dctlCommand(client, json, args) {
       });
       write(result2, renderSessionClaimResponse(result2, nowMs));
       if (result2.outcome === "held_by_other") {
-        throw new Error(`Claim ${claim.topic} is held by session ${result2.claim.holderSessionId} until ${result2.claim.expiresAt}; not acquired`);
+        throw new Error(
+          `Claim ${claim.topic} is held by session ${result2.claim.holderSessionId} until ${result2.claim.expiresAt}; not acquired`
+        );
       }
       return;
     }
@@ -3030,12 +2799,20 @@ async function executeR5dctlCommand(client, json, args) {
         return;
       }
       if (!current.heldByActor) {
-        write({ outcome: "not_holder", actorSessionId: list.actorSessionId, claim: current }, renderSessionClaimResponse({ outcome: "not_holder", actorSessionId: list.actorSessionId, claim: current }, nowMs));
+        write(
+          { outcome: "not_holder", actorSessionId: list.actorSessionId, claim: current },
+          renderSessionClaimResponse({ outcome: "not_holder", actorSessionId: list.actorSessionId, claim: current }, nowMs)
+        );
         throw new Error(`Claim ${claim.topic} is held by session ${current.holderSessionId}, not by ${list.actorSessionId}`);
       }
       generation = current.generation;
     }
-    const result = claim.action === "renew" ? await client.claims.renew({ topic: claim.topic, ...scope, generation, ...claim.ttlSeconds !== void 0 ? { ttlSeconds: claim.ttlSeconds } : {} }) : await client.claims.release({ topic: claim.topic, ...scope, generation });
+    const result = claim.action === "renew" ? await client.claims.renew({
+      topic: claim.topic,
+      ...scope,
+      generation,
+      ...claim.ttlSeconds !== void 0 ? { ttlSeconds: claim.ttlSeconds } : {}
+    }) : await client.claims.release({ topic: claim.topic, ...scope, generation });
     write(result, renderSessionClaimResponse(result, nowMs));
     const succeeded = result.outcome === "renewed" || result.outcome === "released" || claim.action === "release" && result.outcome === "missing";
     if (!succeeded) throw new Error(`Claim ${claim.topic}: ${CLAIM_OUTCOME_TEXT[result.outcome] ?? result.outcome}`);
@@ -3152,7 +2929,10 @@ ${result.deletion ? `Deletion: ${result.deletion.status}${result.deletion.error
     const offset = first === "describe" ? 2 : 3;
     const projectRef = requireValue(args[offset], "Missing project reference");
     const branchId = requireValue(args[offset + 1], "Missing branch id");
-    const status = await requireServerRouteSupport("describe branch-deletion", () => client.projects.branches.describeDeletion(projectRef, branchId));
+    const status = await requireServerRouteSupport(
+      "describe branch-deletion",
+      () => client.projects.branches.describeDeletion(projectRef, branchId)
+    );
     write(status, renderBranchDeletionStatus(status));
     return;
   }
@@ -3297,25 +3077,26 @@ ${result.deletion ? `Deletion: ${result.deletion.status}${result.deletion.error
   throw new Error(`Unknown command: ${args.join(" ")}`);
 }
 function resolveCommandExecution(options, rest) {
-  const trailingHelp = isHelpFlag(rest.at(-1));
+  const accountLiteralHelp = rest[0] === "account" && ["--value", "--file", "--description"].includes(rest.at(-2) ?? "");
+  const trailingHelp = isHelpFlag(rest.at(-1)) && !accountLiteralHelp;
   const normalizedRest = trailingHelp ? rest.slice(0, -1) : rest;
   const command = normalizedRest[0];
   if (!command) {
     throw new Error("Missing command");
   }
   const commandArgs = normalizedRest.slice(1);
+  if (command === "account") {
+    if (trailingHelp || commandArgs.length <= 1) {
+      return { kind: "cli-help", text: getAccountHelp(commandArgs.slice(0, 2)) };
+    }
+    return { kind: "account", command: parseAccountCommand(commandArgs) };
+  }
   if (command === "ps" && commandArgs.length === 0) {
     return {
       kind: "cli-help",
       text: PS_HELP_TEXT
     };
   }
-  if (command === "k8s" && commandArgs.length === 0) {
-    return {
-      kind: "cli-help",
-      text: K8S_HELP_TEXT
-    };
-  }
   if (command === "session" && commandArgs.length === 0) {
     return {
       kind: "cli-help",
@@ -3337,10 +3118,7 @@ function resolveCommandExecution(options, rest) {
         text: sharedHelp
       };
     }
-    return {
-      kind: "plugin",
-      pluginArgs: [...normalizedRest, "--help"]
-    };
+    throw new Error(`Unknown command: ${normalizedRest.join(" ")}`);
   }
   if (command === "projects" || command === "sessions" || command === "workspace") {
     return {
@@ -3450,26 +3228,6 @@ function resolveCommandExecution(options, rest) {
     }
     throw new Error(`Unknown ps command: ${subcommand ?? ""}`.trim());
   }
-  if (command === "k8s") {
-    const subcommand = commandArgs[0];
-    if (options.project || options.branch || options.session) {
-      throw new Error("Project, branch, and session scopes are not supported for `k8s`");
-    }
-    if (subcommand === "usage") {
-      parseK8sUsageArgs(commandArgs.slice(1));
-      return { kind: "plugin", pluginArgs: ["k8s", "usage", ...commandArgs.slice(1)] };
-    }
-    throw new Error(`Unknown k8s command: ${subcommand ?? ""}`.trim());
-  }
-  if (command === "vcluster") {
-    if (options.project || options.branch || options.session) {
-      throw new Error("Project, branch, and session scopes are not supported for `vcluster`");
-    }
-    if (commandArgs[0] !== "trusted-workflow") {
-      throw new Error(`Unknown vcluster command: ${commandArgs[0] ?? ""}`.trim());
-    }
-    return { kind: "plugin", pluginArgs: ["vcluster", "trusted-workflow", ...commandArgs.slice(1)] };
-  }
   if (command === "get") {
     const target = commandArgs[0];
     if (target === "projects") {
@@ -3844,6 +3602,10 @@ async function runCommand(argv) {
   const clientOptions = resolveClientOptions(options, config);
   const client = new R5dctlClient(clientOptions);
   const execution = resolveCommandExecution(options, rest);
+  if (execution.kind === "account") {
+    await executeAccountCommand(client, execution.command, options.json);
+    return 0;
+  }
   if (execution.kind === "auth-login") {
     await handleAuthLogin(client, options, execution.commandArgs, config);
     return 0;
@@ -3951,18 +3713,14 @@ export {
   branchDeletionConfirmationMessage,
   branchDeletionsConfirmationMessage,
   branchDeletionsFailureMessage,
-  collectK8sUsage,
   createBranchThroughPlatform,
   deleteBranchThroughPlatform,
   deleteBranchesThroughPlatform,
   dispatchSessionRunCommand,
   followR5dctlSession,
-  formatK8sCpu,
-  formatK8sMemory,
   formatProcessAge,
   formatProcessLane,
   getCliHelpText,
-  getK8sUsageState,
   getProjectEnvValue,
   getR5dctlVersion,
   getTransientDevicePollDelay,
@@ -3983,7 +3741,6 @@ export {
   parseEnvRequestResponseArgs,
   parseGetEnvsArgs,
   parseGlobalArgs,
-  parseK8sUsageArgs,
   parsePromptArgs,
   parsePsHistoryArgs,
   parsePsListArgs,
@@ -4008,7 +3765,6 @@ export {
   renderConversationWorkResponse,
   renderDeviceAuthorizationPrompt,
   renderEnvValues,
-  renderK8sUsageReport,
   renderProcessHistory,
   renderProcessInspection,
   renderProcessList,

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.126",
+  "version": "0.0.128",
   "type": "module"
 }

package/dist/types/account.d.ts

@@ -0,0 +1,67 @@
+import { type R5dctlClient } from "@ricsam/r5d-api";
+export declare const ACCOUNT_HELP_ENTRIES: readonly [{
+    readonly usage: "account instructions get";
+    readonly description: "Write account AGENTS.md exactly to stdout; --json prints its metadata and content.";
+}, {
+    readonly usage: "account instructions set (--file <path>|--stdin)";
+    readonly description: "Replace account AGENTS.md, including clearing it with empty input.";
+}, {
+    readonly usage: "account env list";
+    readonly description: "List account environment variable metadata without revealing values.";
+}, {
+    readonly usage: "account env set <name> [--description <text>] [--value <value>|--file <path>|--stdin]";
+    readonly description: "Set an account environment variable, or edit an existing entry's description.";
+}, {
+    readonly usage: "account env revoke <name>";
+    readonly description: "Remove the stored value while retaining its name and description.";
+}, {
+    readonly usage: "account env delete <name>";
+    readonly description: "Delete an account environment entry.";
+}, {
+    readonly usage: "account secrets list";
+    readonly description: "List account secret-file metadata without revealing contents.";
+}, {
+    readonly usage: "account secrets set <name> [--description <text>] [--file <path>|--stdin]";
+    readonly description: "Store a secret file whose path is delivered through the named environment variable.";
+}, {
+    readonly usage: "account secrets revoke <name>";
+    readonly description: "Remove a stored secret file's contents while retaining its metadata.";
+}, {
+    readonly usage: "account secrets delete <name>";
+    readonly description: "Delete an account secret-file entry.";
+}];
+type ValueSource = {
+    kind: "value";
+    value: string;
+} | {
+    kind: "file";
+    path: string;
+} | {
+    kind: "stdin";
+};
+export type AccountCommand = {
+    group: "instructions";
+    action: "get";
+} | {
+    group: "instructions";
+    action: "set";
+    source: ValueSource;
+} | {
+    group: "env" | "secrets";
+    action: "list";
+} | {
+    group: "env" | "secrets";
+    action: "set";
+    name: string;
+    description?: string;
+    source?: ValueSource;
+} | {
+    group: "env" | "secrets";
+    action: "revoke" | "delete";
+    name: string;
+};
+/** Keep input values out of every parser error, including unknown flags and operands. */
+export declare function parseAccountCommand(args: string[]): AccountCommand;
+export declare function getAccountHelp(args: string[]): string;
+export declare function executeAccountCommand(client: R5dctlClient, command: AccountCommand, json: boolean): Promise<void>;
+export {};