@ricsam/r5dctl 0.0.50 → 0.0.53

package/README.md

@@ -14,9 +14,13 @@ npm install -g @ricsam/r5dctl
 r5dctl auth login
 ```
 
-This starts a device-style flow and opens:
+This starts a device-authorization flow, prints an eight-character code and QR,
+and opens `https://r5d.dev/auth`. Approve the matching device details in the
+browser before the credential is saved.
 
-- `https://r5d.dev/r5dctl/login/<requestId>`
+Use `--no-open` when no host browser is available, `--no-qr` to print only the
+short code, `--device-name <name>` to label the authorized device, and
+`--worker-label <label>` to record the worker it is intended to run.
 
 Credentials are stored in:
 
@@ -50,6 +54,8 @@ r5dctl delete project <namespace/name|id>
 r5dctl -p <project> get branches
 r5dctl -p <project> describe branch <branch>
 r5dctl -p <project> get envs
+r5dctl -p <project> get envs --show-values
+r5dctl -p <project> get env API_KEY
 r5dctl -p <project> set envs --from-env-file ~/.env --only-missing
 r5dctl -p <project> set envs -e API_KEY=value --description "API credential"
 r5dctl -p <project> get sessions --branch <branch>
@@ -82,16 +88,24 @@ r5dctl ps stop <run-id>
 
 r5dctl k8s usage
 r5dctl k8s usage --namespace default --workload api --container server
-r5dctl k8s usage --workload default/api --window 24h --json
+r5dctl k8s usage --window 7d
+r5dctl k8s usage --workload default/api --window 7d --json
 ```
 
 `shell` connects to the same live worker PTY as the web Shell tab. Without `-c` it attaches the local terminal interactively. With `-c`/`--command`, it runs the supplied shell expression, streams combined PTY output, and exits with the remote command's status. Because command output uses a PTY, stdout and stderr are combined and programs may emit colors or other terminal control sequences.
 
 `ps list` shows active long-running commands managed by r5d. It does not expose the worker host's general OS process table or interactive PTYs. Global project, branch, and session options filter the list, while `--worker` selects a worker label. `ps stop` sends `SIGTERM` to the selected run. Inside an r5d-provided worker shell, the temporary credential can only list and stop runs on that shell's worker.
 
-`k8s usage` shows current and 24-hour CPU and memory usage for every workload container in your managed vCluster. Filter with `--namespace`, `--workload`, or `--container`; a workload may be identified by name, `namespace/name`, or Kubernetes UID. Human-readable output summarizes the 24-hour minimum and maximum across replicas, while global `--json` includes the complete five-minute history envelope and per-pod series. The only currently supported `--window` value is `24h`.
+`k8s usage` shows current and rolling CPU and memory usage for every workload container in your managed vCluster. The default window is `24h`; pass `--window 7d` for seven days. Filter with `--namespace`, `--workload`, or `--container`; a workload may be identified by name, `namespace/name`, or Kubernetes UID. Human-readable output shows current totals across sampled replicas and the selected window's maximum. Global `--json` includes min/max summaries, the complete five-minute history envelope, per-pod series, coverage, and freshness metadata.
 
-`get envs` reports names and whether values are set, but never prints the values. Prefer `--from-env-file` for bulk imports so secret values do not appear in shell arguments or history. Empty dotenv values are skipped unless `--include-empty` is passed, and `--only-missing` preserves values that are already set.
+`get envs` reports names and whether values are set without revealing the values by default. Add `--show-values` to reveal every value; multiline and control characters are escaped for readable output. Without the global `--json` flag, `get env <name>` writes only that value to stdout, with no added newline or labels, so it works directly with command substitution and pipelines:
+
+```bash
+export API_KEY="$(r5dctl -p <project> get env API_KEY)"
+r5dctl -p <project> get env PRIVATE_KEY | openssl pkey -check -noout
+```
+
+An undeclared or unset variable makes `get env` fail with a nonzero exit status. An explicitly configured empty value succeeds and writes zero bytes. Prefer `--from-env-file` for bulk imports so secret values do not appear in shell arguments or history. Empty dotenv values are skipped unless `--include-empty` is passed, and `--only-missing` preserves values that are already set.
 
 Conversation output is human-readable by default and excludes both the system prompt and tool definitions. `--raw` keeps the transcript layout but renders structured message and tool parts as JSON, `--tools` includes the provider-shaped tool definitions, and `--system` includes system prompt messages. The global `--json` flag remains separate and prints the complete API response envelope.
 

package/dist/cjs/cli.cjs

@@ -28,18 +28,24 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var cli_exports = {};
 __export(cli_exports, {
+  advanceTransientDevicePollBackoff: () => advanceTransientDevicePollBackoff,
   collectK8sUsage: () => collectK8sUsage,
   formatK8sCpu: () => formatK8sCpu,
   formatK8sMemory: () => formatK8sMemory,
   formatProcessAge: () => formatProcessAge,
   getCliHelpText: () => getCliHelpText,
+  getK8sUsageState: () => getK8sUsageState,
+  getProjectEnvValue: () => getProjectEnvValue,
   getR5dctlVersion: () => getR5dctlVersion,
+  getTransientDevicePollDelay: () => getTransientDevicePollDelay,
+  handleAuthLogin: () => handleAuthLogin,
   main: () => main,
   parseAnswerFlags: () => parseAnswerFlags,
   parseConversationRenderArgs: () => parseConversationRenderArgs,
   parseConversationWorkDetailArgs: () => parseConversationWorkDetailArgs,
   parseEnvFlags: () => parseEnvFlags,
   parseEnvRequestResponseArgs: () => parseEnvRequestResponseArgs,
+  parseGetEnvsArgs: () => parseGetEnvsArgs,
   parseGlobalArgs: () => parseGlobalArgs,
   parseK8sUsageArgs: () => parseK8sUsageArgs,
   parsePromptArgs: () => parsePromptArgs,
@@ -52,6 +58,8 @@ __export(cli_exports, {
   renderConversationOverviewResponse: () => renderConversationOverviewResponse,
   renderConversationResponse: () => renderConversationResponse,
   renderConversationWorkResponse: () => renderConversationWorkResponse,
+  renderDeviceAuthorizationPrompt: () => renderDeviceAuthorizationPrompt,
+  renderEnvValues: () => renderEnvValues,
   renderK8sUsageReport: () => renderK8sUsageReport,
   renderProcessHistory: () => renderProcessHistory,
   renderProcessInspection: () => renderProcessInspection,
@@ -60,13 +68,16 @@ __export(cli_exports, {
   renderWorkspaceSync: () => renderWorkspaceSync,
   resolveCommandExecution: () => resolveCommandExecution,
   runR5dctlCli: () => runR5dctlCli,
-  summarizeEnvData: () => summarizeEnvData
+  summarizeEnvData: () => summarizeEnvData,
+  writeConfig: () => writeConfig
 });
 module.exports = __toCommonJS(cli_exports);
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_os = __toESM(require("node:os"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_node_child_process = require("node:child_process");
+var import_node_crypto = require("node:crypto");
+var import_qrcode = __toESM(require("qrcode"), 1);
 var import_promises = require("node:timers/promises");
 var import_dotenv = require("dotenv");
 var import_r5d_api = require("@ricsam/r5d-api");
@@ -101,7 +112,7 @@ const CLI_GLOBAL_OPTION_HELP = [
 const CLI_ONLY_HELP_ENTRIES = [
   {
     section: "auth",
-    usage: "auth login [--no-open]",
+    usage: "auth login [--no-open] [--no-qr] [--device-name <name>] [--worker-label <label>]",
     description: "Start the browser login flow."
   },
   {
@@ -113,7 +124,7 @@ const CLI_ONLY_HELP_ENTRIES = [
 const CLI_ONLY_COMMAND_HELP = [
   {
     path: ["auth", "login"],
-    usage: "auth login [--no-open]"
+    usage: "auth login [--no-open] [--no-qr] [--device-name <name>] [--worker-label <label>]"
   },
   {
     path: ["shell"],
@@ -133,9 +144,9 @@ const PS_HELP_TEXT = [
 ].join("\n");
 const K8S_HELP_TEXT = [
   "Usage:",
-  "  r5dctl k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window=24h]",
+  "  r5dctl k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
   "",
-  "Show current and 24-hour CPU and memory usage for managed-vCluster workload containers.",
+  "Show current and rolling CPU and memory usage for managed-vCluster workload containers.",
   ""
 ].join("\n");
 const SHARED_HELP_ENTRIES = [
@@ -167,8 +178,13 @@ const SHARED_HELP_ENTRIES = [
   { section: "branches", usage: "-p <project> describe branch <branch>", description: "Show branch URLs and sessions." },
   {
     section: "envs",
-    usage: "-p <project> get envs",
-    description: "List declared envs and whether each has a value, without revealing values."
+    usage: "-p <project> get envs [--show-values]",
+    description: "List declared envs; use --show-values to reveal their values."
+  },
+  {
+    section: "envs",
+    usage: "-p <project> get env <name>",
+    description: "Write one env value exactly to stdout for command substitution or piping."
   },
   {
     section: "envs",
@@ -235,8 +251,8 @@ const SHARED_HELP_ENTRIES = [
   },
   {
     section: "kubernetes",
-    usage: "k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window=24h]",
-    description: "Show current and 24-hour CPU and memory usage for managed-vCluster workload containers."
+    usage: "k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
+    description: "Show current and rolling CPU and memory usage for managed-vCluster workload containers."
   },
   {
     section: "processes",
@@ -440,6 +456,21 @@ function parseOptionalFlagValue(args, flag, shortFlag) {
 function hasBooleanFlag(args, flag) {
   return args.includes(flag);
 }
+function assertAuthLoginArgs(args) {
+  const valueFlags = /* @__PURE__ */ new Set(["--device-name", "--worker-label"]);
+  const booleanFlags = /* @__PURE__ */ new Set(["--no-open", "--no-qr"]);
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (booleanFlags.has(arg)) continue;
+    if (valueFlags.has(arg)) {
+      if (!args[index + 1]) throw new Error(`Missing value for ${arg}`);
+      index += 1;
+      continue;
+    }
+    if ([...valueFlags].some((flag) => arg.startsWith(`${flag}=`))) continue;
+    throw new Error(`Unknown auth login flag: ${arg}`);
+  }
+}
 function parseGlobalArgs(argv) {
   const options = {
     json: false,
@@ -571,12 +602,27 @@ function serializeConfig(config) {
 function writeConfig(configPath, config) {
   const dir = import_node_path.default.dirname(configPath);
   import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  import_node_fs.default.chmodSync(dir, 448);
   const serialized = serializeConfig(config);
-  import_node_fs.default.writeFileSync(configPath, `${JSON.stringify(serialized, null, 2)}
-`, {
-    mode: 384
-  });
-  import_node_fs.default.chmodSync(configPath, 384);
+  const tempPath = import_node_path.default.join(dir, `.${import_node_path.default.basename(configPath)}.${process.pid}.${(0, import_node_crypto.randomUUID)()}.tmp`);
+  let descriptor;
+  try {
+    descriptor = import_node_fs.default.openSync(tempPath, "wx", 384);
+    import_node_fs.default.writeFileSync(descriptor, `${JSON.stringify(serialized, null, 2)}
+`, "utf8");
+    import_node_fs.default.fsyncSync(descriptor);
+    import_node_fs.default.closeSync(descriptor);
+    descriptor = void 0;
+    import_node_fs.default.renameSync(tempPath, configPath);
+    import_node_fs.default.chmodSync(configPath, 384);
+  } catch (error) {
+    if (descriptor !== void 0) import_node_fs.default.closeSync(descriptor);
+    try {
+      import_node_fs.default.unlinkSync(tempPath);
+    } catch {
+    }
+    throw error;
+  }
 }
 function resolveClientOptions(options, config) {
   return {
@@ -972,7 +1018,7 @@ function parseK8sUsageArgs(args) {
     const value = candidateValue;
     if (inlineValue === void 0) index += 1;
     if (option === "--window") {
-      if (value !== "24h") throw new Error("--window currently supports only 24h");
+      if (value !== "24h" && value !== "7d") throw new Error("--window must be 24h or 7d");
       parsed.window = value;
     } else if (option === "--namespace") {
       parsed.namespace = value;
@@ -1010,41 +1056,89 @@ function createSavedApiKeyConfig(options, config, apiKey) {
     token: void 0
   };
 }
+function renderDeviceAuthorizationPrompt(input) {
+  const codeBorder = "\u2500".repeat(input.userCode.length + 4);
+  return `Authorize this device at:
+${input.verificationUri}
+
+\u250C${codeBorder}\u2510
+\u2502  ${input.userCode}  \u2502
+\u2514${codeBorder}\u2518
+`;
+}
+function getTransientDevicePollDelay(intervalMs, transientBackoffMs) {
+  return Math.min(3e4, Math.max(intervalMs, transientBackoffMs));
+}
+function advanceTransientDevicePollBackoff(intervalMs, transientBackoffMs) {
+  return {
+    delayMs: getTransientDevicePollDelay(intervalMs, transientBackoffMs),
+    nextBackoffMs: Math.min(3e4, transientBackoffMs * 2)
+  };
+}
 async function handleAuthLogin(client, options, commandArgs, config) {
+  assertAuthLoginArgs(commandArgs);
   const noOpen = hasBooleanFlag(commandArgs, "--no-open");
-  const start = await client.auth.loginStart({
-    baseUrl: options.baseUrl ?? config.baseUrl
-  });
+  const noQr = hasBooleanFlag(commandArgs, "--no-qr");
+  const deviceName = parseOptionalFlagValue(commandArgs, "--device-name") ?? `${import_node_os.default.hostname()} r5dctl`;
+  const workerLabel = parseOptionalFlagValue(commandArgs, "--worker-label");
+  const start = await client.auth.deviceStart({ deviceName, workerLabel });
   if (options.json) {
     writeDataOutput(
       true,
       {
         status: "pending",
         requestId: start.requestId,
-        loginUrl: start.loginUrl,
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        verificationUriComplete: start.verificationUriComplete,
         expiresAt: start.expiresAt,
         intervalMs: start.intervalMs
       },
       ""
     );
   } else {
-    process.stdout.write(`Open this URL to approve login:
-${start.loginUrl}
+    process.stdout.write(renderDeviceAuthorizationPrompt(start));
+    if (!noQr) {
+      process.stdout.write(`
+${await import_qrcode.default.toString(start.verificationUriComplete, { type: "terminal", small: true })}
 `);
+    }
   }
   if (!noOpen) {
     try {
-      await openInBrowser(start.loginUrl);
+      await openInBrowser(start.verificationUriComplete);
     } catch {
     }
   }
   const expiresAtMs = new Date(start.expiresAt).getTime();
   let intervalMs = start.intervalMs;
+  let nextDelayMs = intervalMs;
+  let transientBackoffMs = 1e3;
   while (Date.now() < expiresAtMs) {
-    await (0, import_promises.setTimeout)(intervalMs);
-    const polled = await client.auth.loginPoll(start.requestId, { pollCode: start.pollCode });
+    await (0, import_promises.setTimeout)(Math.min(nextDelayMs, Math.max(0, expiresAtMs - Date.now())));
+    let polled;
+    try {
+      polled = await client.auth.devicePoll(start.requestId, { deviceCode: start.deviceCode });
+    } catch (error) {
+      if (error instanceof import_r5d_api.R5dctlApiError && error.status === 429) {
+        const body = error.body;
+        if (typeof body?.intervalMs === "number") intervalMs = body.intervalMs;
+        nextDelayMs = intervalMs;
+        continue;
+      }
+      const transient = !(error instanceof import_r5d_api.R5dctlApiError) || error.status === 408 || error.status >= 500;
+      if (transient) {
+        const retry = advanceTransientDevicePollBackoff(intervalMs, transientBackoffMs);
+        nextDelayMs = retry.delayMs;
+        transientBackoffMs = retry.nextBackoffMs;
+        continue;
+      }
+      throw error;
+    }
+    transientBackoffMs = 1e3;
     if (polled.status === "pending") {
       intervalMs = polled.intervalMs;
+      nextDelayMs = intervalMs;
       continue;
     }
     if (polled.status === "approved") {
@@ -1069,6 +1163,9 @@ ${start.loginUrl}
     if (polled.status === "expired") {
       throw new Error("Login request expired. Run `r5dctl auth login` again.");
     }
+    if (polled.status === "denied") {
+      throw new Error("Device authorization denied.");
+    }
     if (polled.status === "consumed") {
       throw new Error("Login request was already consumed.");
     }
@@ -1189,19 +1286,22 @@ async function collectK8sUsage(client, options) {
     throw new Error("No managed-vCluster workload containers matched the requested filters");
   }
   const entries = await mapWithConcurrency(candidates, 8, async ({ workload, container }) => {
-    const history = await client.k8s.resourceHistory({ workloadUid: workload.uid, containerName: container.name });
+    const history = await client.k8s.resourceHistory({ workloadUid: workload.uid, containerName: container.name, window: options.window });
     return {
       workload: {
         uid: workload.uid,
         kind: workload.kind,
         namespace: workload.namespace,
-        name: workload.name
+        name: workload.name,
+        replicas: workload.replicas,
+        readyReplicas: workload.readyReplicas
       },
       container: {
         name: container.name,
         currentUsage: container.currentUsage,
         pods: container.pods
       },
+      sampledPodCount: container.pods.filter((pod) => pod.cpuNanoCores !== null || pod.memoryBytes !== null).length,
       summary: summarizeK8sHistory(history),
       history
     };
@@ -1227,60 +1327,83 @@ function formatDecimal(value) {
 function formatK8sCpu(value) {
   if (value === null) return "-";
   const milliCores = value / 1e6;
-  return milliCores >= 1e3 ? `${formatDecimal(milliCores / 1e3)} cores` : `${formatDecimal(milliCores)}m`;
+  return `${formatDecimal(milliCores)}m`;
 }
 function formatK8sMemory(value) {
   if (value === null) return "-";
-  const units = ["B", "KiB", "MiB", "GiB", "TiB"];
+  const units = ["B", "Ki", "Mi", "Gi", "Ti"];
   let amount = value;
   let unitIndex = 0;
   while (amount >= 1024 && unitIndex < units.length - 1) {
     amount /= 1024;
     unitIndex += 1;
   }
-  return `${formatDecimal(amount)} ${units[unitIndex]}`;
-}
-function formatK8sCoverage(start, end) {
-  if (!start || !end) return "none";
-  const durationMs = Date.parse(end) - Date.parse(start);
-  if (!Number.isFinite(durationMs) || durationMs < 0) return "unknown";
-  const totalMinutes = Math.floor(durationMs / 6e4);
-  return `${Math.floor(totalMinutes / 60)}h ${String(totalMinutes % 60).padStart(2, "0")}m`;
+  return `${formatDecimal(amount)}${units[unitIndex]}`;
+}
+function getK8sUsageState(entry) {
+  const hasHistory = entry.history.envelope.length > 0;
+  const terminalPods = entry.container.pods.filter((pod) => pod.phase === "Succeeded" || pod.phase === "Failed").length;
+  const inactive = entry.sampledPodCount === 0 && (entry.workload.replicas === 0 || entry.container.pods.length > 0 && terminalPods === entry.container.pods.length || entry.workload.kind === "CronJob" && entry.container.pods.length === 0);
+  if (inactive) return "inactive";
+  if (entry.sampledPodCount === 0) return hasHistory ? entry.history.stale ? "stale" : "no current" : "no data";
+  if (!hasHistory) return "warming";
+  if (entry.history.stale) return "stale";
+  if (entry.history.incomplete) return "partial";
+  return "healthy";
+}
+function abbreviatedK8sKind(kind) {
+  switch (kind) {
+    case "Deployment":
+      return "deploy";
+    case "StatefulSet":
+      return "sts";
+    case "DaemonSet":
+      return "ds";
+    case "CronJob":
+      return "cron";
+    case "ReplicaSet":
+      return "rs";
+    case "Job":
+      return "job";
+    case "Pod":
+      return "pod";
+  }
 }
 function renderK8sUsageReport(report) {
   const freshness = report.metricsFreshAt ?? "unavailable";
-  const lines = [`Metrics: ${report.metricsStale ? "stale" : "current"} (fresh at ${freshness})`, "Window: 24h"];
+  const lines = [
+    `Window: ${report.window}  Collector: ${report.metricsStale ? "stale" : "current"}  Fresh: ${freshness}`,
+    "PODS counts pods with current metrics."
+  ];
   if (report.entries.length === 0) return `${lines.join("\n")}
 No managed-vCluster workload containers found.
 `;
-  const headers = [
-    "NAMESPACE",
-    "WORKLOAD",
-    "CONTAINER",
-    "PODS",
-    "CPU NOW",
-    "CPU 24H MIN/MAX",
-    "MEM NOW",
-    "MEM 24H MIN/MAX",
-    "COVERAGE",
-    "STATUS"
-  ];
-  const rows = report.entries.map((entry) => [
-    entry.workload.namespace,
-    `${entry.workload.kind}/${entry.workload.name}`,
-    entry.container.name,
-    String(entry.container.pods.length),
-    formatK8sCpu(entry.container.currentUsage.cpuNanoCores),
-    `${formatK8sCpu(entry.summary.cpuMinNanoCores)} / ${formatK8sCpu(entry.summary.cpuMaxNanoCores)}`,
-    formatK8sMemory(entry.container.currentUsage.memoryBytes),
-    `${formatK8sMemory(entry.summary.memoryMinBytes)} / ${formatK8sMemory(entry.summary.memoryMaxBytes)}`,
-    formatK8sCoverage(entry.history.coverageStart, entry.history.coverageEnd),
-    entry.history.stale ? "stale" : entry.history.incomplete ? "partial" : "complete"
-  ]);
-  const widths = headers.map((header, column) => Math.max(header.length, ...rows.map((row) => row[column]?.length ?? 0)));
-  const formatRow = (row) => row.map((value, column) => column === row.length - 1 ? value : value.padEnd(widths[column] ?? value.length)).join("  ");
-  const separator = widths.map((width) => "-".repeat(width)).join("  ");
-  lines.push(formatRow(headers), separator, ...rows.map(formatRow));
+  const headers = ["WORKLOAD", "CONTAINER", "PODS", "CPU NOW", "CPU MAX", "MEM NOW", "MEM MAX", "STATE"];
+  const grouped = /* @__PURE__ */ new Map();
+  for (const entry of report.entries) {
+    const entries = grouped.get(entry.workload.namespace) ?? [];
+    entries.push(entry);
+    grouped.set(entry.workload.namespace, entries);
+  }
+  for (const [namespace, entries] of grouped) {
+    const rows = entries.map((entry) => {
+      const state = getK8sUsageState(entry);
+      return [
+        `${abbreviatedK8sKind(entry.workload.kind)}/${entry.workload.name}`,
+        entry.container.name,
+        String(entry.sampledPodCount),
+        formatK8sCpu(entry.container.currentUsage.cpuNanoCores),
+        formatK8sCpu(entry.summary.cpuMaxNanoCores),
+        formatK8sMemory(entry.container.currentUsage.memoryBytes),
+        formatK8sMemory(entry.summary.memoryMaxBytes),
+        state === "healthy" ? "-" : state
+      ];
+    });
+    const widths = headers.map((header, column) => Math.max(header.length, ...rows.map((row) => row[column]?.length ?? 0)));
+    const formatRow = (row) => row.map((value, column) => column === row.length - 1 ? value : value.padEnd(widths[column] ?? value.length)).join("  ");
+    const separator = widths.map((width) => "-".repeat(width)).join("  ");
+    lines.push("", `Namespace: ${namespace}`, formatRow(headers), separator, ...rows.map(formatRow));
+  }
   return `${lines.join("\n")}
 `;
 }
@@ -1375,6 +1498,17 @@ function summarizeEnvData(data) {
     ])
   );
 }
+function parseGetEnvsArgs(args) {
+  let showValues = false;
+  for (const arg of args) {
+    if (arg === "--show-values") {
+      showValues = true;
+      continue;
+    }
+    throw new Error(arg.startsWith("-") ? `Unknown get envs flag: ${arg}` : `Unexpected get envs value: ${arg}`);
+  }
+  return { showValues };
+}
 function renderEnvSummary(data) {
   const lines = [];
   for (const [name, env] of Object.entries(data)) {
@@ -1383,6 +1517,24 @@ function renderEnvSummary(data) {
   return lines.length > 0 ? `${lines.join("\n")}
 ` : "No environment variables declared.\n";
 }
+function renderEnvValues(data) {
+  const lines = Object.entries(data).sort(([left], [right]) => left.localeCompare(right)).map(([name, env]) => `${name}  ${env.value === null ? "<missing>" : JSON.stringify(env.value)}  ${env.description}`);
+  return lines.length > 0 ? `${lines.join("\n")}
+` : "No environment variables declared.\n";
+}
+function getProjectEnvValue(data, name) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+    throw new Error(`Invalid environment variable name: ${name}`);
+  }
+  if (!Object.prototype.hasOwnProperty.call(data, name)) {
+    throw new Error(`Environment variable ${name} is not declared for this project`);
+  }
+  const value = data[name]?.value;
+  if (value === null || value === void 0) {
+    throw new Error(`Environment variable ${name} does not have a value`);
+  }
+  return value;
+}
 function renderEnvSetResult(result) {
   const lines = [`Updated ${result.updated.length} environment variable${result.updated.length === 1 ? "" : "s"} for ${result.project}.`];
   if (result.skippedExisting.length > 0) lines.push(`Skipped ${result.skippedExisting.length} existing value(s).`);
@@ -1738,11 +1890,25 @@ Sessions: ${result.sessions.length}
     return;
   }
   if (first === "get" && second === "envs") {
-    if (args.length !== 3) throw new Error(`Unexpected get envs argument: ${args[3] ?? ""}`.trim());
     const projectRef = requireValue(args[2], "Missing project reference");
+    const options = parseGetEnvsArgs(args.slice(3));
     const project = await client.projects.describe(projectRef);
-    const envs = summarizeEnvData(await client.projects.env.get(project.id));
-    write({ project: project.path, envs }, renderEnvSummary(envs));
+    const envs = await client.projects.env.get(project.id);
+    if (options.showValues) {
+      write({ project: project.path, envs }, renderEnvValues(envs));
+    } else {
+      const summary = summarizeEnvData(envs);
+      write({ project: project.path, envs: summary }, renderEnvSummary(summary));
+    }
+    return;
+  }
+  if (first === "get" && second === "env") {
+    if (args.length > 4) throw new Error(`Unexpected get env argument: ${args[4]}`);
+    const projectRef = requireValue(args[2], "Missing project reference");
+    const name = requireValue(args[3], "Missing environment variable name");
+    const project = await client.projects.describe(projectRef);
+    const value = getProjectEnvValue(await client.projects.env.get(project.id), name);
+    write({ project: project.path, name, value }, value);
     return;
   }
   if (first === "set" && second === "envs") {
@@ -2095,9 +2261,29 @@ function resolveCommandExecution(options, rest) {
       if (options.branch) {
         throw new Error("--branch/-b is not supported for project environment variables");
       }
+      parseGetEnvsArgs(commandArgs.slice(1));
+      return {
+        kind: "plugin",
+        pluginArgs: ["get", "envs", options.project, ...commandArgs.slice(1)]
+      };
+    }
+    if (target === "env") {
+      if (!options.project) {
+        throw new Error("--project/-p is required for `get env`");
+      }
+      if (options.branch) {
+        throw new Error("--branch/-b is not supported for project environment variables");
+      }
+      const name = requireValue(commandArgs[1], "Environment variable name is required for `get env`");
+      if (commandArgs.length > 2) {
+        throw new Error(`Unexpected get env argument: ${commandArgs[2]}`);
+      }
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+        throw new Error(`Invalid environment variable name: ${name}`);
+      }
       return {
         kind: "plugin",
-        pluginArgs: ["get", "envs", options.project]
+        pluginArgs: ["get", "env", options.project, name]
       };
     }
     throw new Error("Unknown get command");
@@ -2486,18 +2672,24 @@ async function main(argv = process.argv.slice(2)) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  advanceTransientDevicePollBackoff,
   collectK8sUsage,
   formatK8sCpu,
   formatK8sMemory,
   formatProcessAge,
   getCliHelpText,
+  getK8sUsageState,
+  getProjectEnvValue,
   getR5dctlVersion,
+  getTransientDevicePollDelay,
+  handleAuthLogin,
   main,
   parseAnswerFlags,
   parseConversationRenderArgs,
   parseConversationWorkDetailArgs,
   parseEnvFlags,
   parseEnvRequestResponseArgs,
+  parseGetEnvsArgs,
   parseGlobalArgs,
   parseK8sUsageArgs,
   parsePromptArgs,
@@ -2510,6 +2702,8 @@ async function main(argv = process.argv.slice(2)) {
   renderConversationOverviewResponse,
   renderConversationResponse,
   renderConversationWorkResponse,
+  renderDeviceAuthorizationPrompt,
+  renderEnvValues,
   renderK8sUsageReport,
   renderProcessHistory,
   renderProcessInspection,
@@ -2518,5 +2712,6 @@ async function main(argv = process.argv.slice(2)) {
   renderWorkspaceSync,
   resolveCommandExecution,
   runR5dctlCli,
-  summarizeEnvData
+  summarizeEnvData,
+  writeConfig
 });

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.50",
+  "version": "0.0.53",
   "type": "commonjs"
 }

package/dist/mjs/cli.mjs

@@ -2,6 +2,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import QRCode from "qrcode";
 import { setTimeout as sleep } from "node:timers/promises";
 import { parse as parseDotenv } from "dotenv";
 import {
@@ -39,7 +41,7 @@ const CLI_GLOBAL_OPTION_HELP = [
 const CLI_ONLY_HELP_ENTRIES = [
   {
     section: "auth",
-    usage: "auth login [--no-open]",
+    usage: "auth login [--no-open] [--no-qr] [--device-name <name>] [--worker-label <label>]",
     description: "Start the browser login flow."
   },
   {
@@ -51,7 +53,7 @@ const CLI_ONLY_HELP_ENTRIES = [
 const CLI_ONLY_COMMAND_HELP = [
   {
     path: ["auth", "login"],
-    usage: "auth login [--no-open]"
+    usage: "auth login [--no-open] [--no-qr] [--device-name <name>] [--worker-label <label>]"
   },
   {
     path: ["shell"],
@@ -71,9 +73,9 @@ const PS_HELP_TEXT = [
 ].join("\n");
 const K8S_HELP_TEXT = [
   "Usage:",
-  "  r5dctl k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window=24h]",
+  "  r5dctl k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
   "",
-  "Show current and 24-hour CPU and memory usage for managed-vCluster workload containers.",
+  "Show current and rolling CPU and memory usage for managed-vCluster workload containers.",
   ""
 ].join("\n");
 const SHARED_HELP_ENTRIES = [
@@ -105,8 +107,13 @@ const SHARED_HELP_ENTRIES = [
   { section: "branches", usage: "-p <project> describe branch <branch>", description: "Show branch URLs and sessions." },
   {
     section: "envs",
-    usage: "-p <project> get envs",
-    description: "List declared envs and whether each has a value, without revealing values."
+    usage: "-p <project> get envs [--show-values]",
+    description: "List declared envs; use --show-values to reveal their values."
+  },
+  {
+    section: "envs",
+    usage: "-p <project> get env <name>",
+    description: "Write one env value exactly to stdout for command substitution or piping."
   },
   {
     section: "envs",
@@ -173,8 +180,8 @@ const SHARED_HELP_ENTRIES = [
   },
   {
     section: "kubernetes",
-    usage: "k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window=24h]",
-    description: "Show current and 24-hour CPU and memory usage for managed-vCluster workload containers."
+    usage: "k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
+    description: "Show current and rolling CPU and memory usage for managed-vCluster workload containers."
   },
   {
     section: "processes",
@@ -378,6 +385,21 @@ function parseOptionalFlagValue(args, flag, shortFlag) {
 function hasBooleanFlag(args, flag) {
   return args.includes(flag);
 }
+function assertAuthLoginArgs(args) {
+  const valueFlags = /* @__PURE__ */ new Set(["--device-name", "--worker-label"]);
+  const booleanFlags = /* @__PURE__ */ new Set(["--no-open", "--no-qr"]);
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (booleanFlags.has(arg)) continue;
+    if (valueFlags.has(arg)) {
+      if (!args[index + 1]) throw new Error(`Missing value for ${arg}`);
+      index += 1;
+      continue;
+    }
+    if ([...valueFlags].some((flag) => arg.startsWith(`${flag}=`))) continue;
+    throw new Error(`Unknown auth login flag: ${arg}`);
+  }
+}
 function parseGlobalArgs(argv) {
   const options = {
     json: false,
@@ -509,12 +531,27 @@ function serializeConfig(config) {
 function writeConfig(configPath, config) {
   const dir = path.dirname(configPath);
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
   const serialized = serializeConfig(config);
-  fs.writeFileSync(configPath, `${JSON.stringify(serialized, null, 2)}
-`, {
-    mode: 384
-  });
-  fs.chmodSync(configPath, 384);
+  const tempPath = path.join(dir, `.${path.basename(configPath)}.${process.pid}.${randomUUID()}.tmp`);
+  let descriptor;
+  try {
+    descriptor = fs.openSync(tempPath, "wx", 384);
+    fs.writeFileSync(descriptor, `${JSON.stringify(serialized, null, 2)}
+`, "utf8");
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = void 0;
+    fs.renameSync(tempPath, configPath);
+    fs.chmodSync(configPath, 384);
+  } catch (error) {
+    if (descriptor !== void 0) fs.closeSync(descriptor);
+    try {
+      fs.unlinkSync(tempPath);
+    } catch {
+    }
+    throw error;
+  }
 }
 function resolveClientOptions(options, config) {
   return {
@@ -910,7 +947,7 @@ function parseK8sUsageArgs(args) {
     const value = candidateValue;
     if (inlineValue === void 0) index += 1;
     if (option === "--window") {
-      if (value !== "24h") throw new Error("--window currently supports only 24h");
+      if (value !== "24h" && value !== "7d") throw new Error("--window must be 24h or 7d");
       parsed.window = value;
     } else if (option === "--namespace") {
       parsed.namespace = value;
@@ -948,41 +985,89 @@ function createSavedApiKeyConfig(options, config, apiKey) {
     token: void 0
   };
 }
+function renderDeviceAuthorizationPrompt(input) {
+  const codeBorder = "\u2500".repeat(input.userCode.length + 4);
+  return `Authorize this device at:
+${input.verificationUri}
+
+\u250C${codeBorder}\u2510
+\u2502  ${input.userCode}  \u2502
+\u2514${codeBorder}\u2518
+`;
+}
+function getTransientDevicePollDelay(intervalMs, transientBackoffMs) {
+  return Math.min(3e4, Math.max(intervalMs, transientBackoffMs));
+}
+function advanceTransientDevicePollBackoff(intervalMs, transientBackoffMs) {
+  return {
+    delayMs: getTransientDevicePollDelay(intervalMs, transientBackoffMs),
+    nextBackoffMs: Math.min(3e4, transientBackoffMs * 2)
+  };
+}
 async function handleAuthLogin(client, options, commandArgs, config) {
+  assertAuthLoginArgs(commandArgs);
   const noOpen = hasBooleanFlag(commandArgs, "--no-open");
-  const start = await client.auth.loginStart({
-    baseUrl: options.baseUrl ?? config.baseUrl
-  });
+  const noQr = hasBooleanFlag(commandArgs, "--no-qr");
+  const deviceName = parseOptionalFlagValue(commandArgs, "--device-name") ?? `${os.hostname()} r5dctl`;
+  const workerLabel = parseOptionalFlagValue(commandArgs, "--worker-label");
+  const start = await client.auth.deviceStart({ deviceName, workerLabel });
   if (options.json) {
     writeDataOutput(
       true,
       {
         status: "pending",
         requestId: start.requestId,
-        loginUrl: start.loginUrl,
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        verificationUriComplete: start.verificationUriComplete,
         expiresAt: start.expiresAt,
         intervalMs: start.intervalMs
       },
       ""
     );
   } else {
-    process.stdout.write(`Open this URL to approve login:
-${start.loginUrl}
+    process.stdout.write(renderDeviceAuthorizationPrompt(start));
+    if (!noQr) {
+      process.stdout.write(`
+${await QRCode.toString(start.verificationUriComplete, { type: "terminal", small: true })}
 `);
+    }
   }
   if (!noOpen) {
     try {
-      await openInBrowser(start.loginUrl);
+      await openInBrowser(start.verificationUriComplete);
     } catch {
     }
   }
   const expiresAtMs = new Date(start.expiresAt).getTime();
   let intervalMs = start.intervalMs;
+  let nextDelayMs = intervalMs;
+  let transientBackoffMs = 1e3;
   while (Date.now() < expiresAtMs) {
-    await sleep(intervalMs);
-    const polled = await client.auth.loginPoll(start.requestId, { pollCode: start.pollCode });
+    await sleep(Math.min(nextDelayMs, Math.max(0, expiresAtMs - Date.now())));
+    let polled;
+    try {
+      polled = await client.auth.devicePoll(start.requestId, { deviceCode: start.deviceCode });
+    } catch (error) {
+      if (error instanceof R5dctlApiError && error.status === 429) {
+        const body = error.body;
+        if (typeof body?.intervalMs === "number") intervalMs = body.intervalMs;
+        nextDelayMs = intervalMs;
+        continue;
+      }
+      const transient = !(error instanceof R5dctlApiError) || error.status === 408 || error.status >= 500;
+      if (transient) {
+        const retry = advanceTransientDevicePollBackoff(intervalMs, transientBackoffMs);
+        nextDelayMs = retry.delayMs;
+        transientBackoffMs = retry.nextBackoffMs;
+        continue;
+      }
+      throw error;
+    }
+    transientBackoffMs = 1e3;
     if (polled.status === "pending") {
       intervalMs = polled.intervalMs;
+      nextDelayMs = intervalMs;
       continue;
     }
     if (polled.status === "approved") {
@@ -1007,6 +1092,9 @@ ${start.loginUrl}
     if (polled.status === "expired") {
       throw new Error("Login request expired. Run `r5dctl auth login` again.");
     }
+    if (polled.status === "denied") {
+      throw new Error("Device authorization denied.");
+    }
     if (polled.status === "consumed") {
       throw new Error("Login request was already consumed.");
     }
@@ -1127,19 +1215,22 @@ async function collectK8sUsage(client, options) {
     throw new Error("No managed-vCluster workload containers matched the requested filters");
   }
   const entries = await mapWithConcurrency(candidates, 8, async ({ workload, container }) => {
-    const history = await client.k8s.resourceHistory({ workloadUid: workload.uid, containerName: container.name });
+    const history = await client.k8s.resourceHistory({ workloadUid: workload.uid, containerName: container.name, window: options.window });
     return {
       workload: {
         uid: workload.uid,
         kind: workload.kind,
         namespace: workload.namespace,
-        name: workload.name
+        name: workload.name,
+        replicas: workload.replicas,
+        readyReplicas: workload.readyReplicas
       },
       container: {
         name: container.name,
         currentUsage: container.currentUsage,
         pods: container.pods
       },
+      sampledPodCount: container.pods.filter((pod) => pod.cpuNanoCores !== null || pod.memoryBytes !== null).length,
       summary: summarizeK8sHistory(history),
       history
     };
@@ -1165,60 +1256,83 @@ function formatDecimal(value) {
 function formatK8sCpu(value) {
   if (value === null) return "-";
   const milliCores = value / 1e6;
-  return milliCores >= 1e3 ? `${formatDecimal(milliCores / 1e3)} cores` : `${formatDecimal(milliCores)}m`;
+  return `${formatDecimal(milliCores)}m`;
 }
 function formatK8sMemory(value) {
   if (value === null) return "-";
-  const units = ["B", "KiB", "MiB", "GiB", "TiB"];
+  const units = ["B", "Ki", "Mi", "Gi", "Ti"];
   let amount = value;
   let unitIndex = 0;
   while (amount >= 1024 && unitIndex < units.length - 1) {
     amount /= 1024;
     unitIndex += 1;
   }
-  return `${formatDecimal(amount)} ${units[unitIndex]}`;
-}
-function formatK8sCoverage(start, end) {
-  if (!start || !end) return "none";
-  const durationMs = Date.parse(end) - Date.parse(start);
-  if (!Number.isFinite(durationMs) || durationMs < 0) return "unknown";
-  const totalMinutes = Math.floor(durationMs / 6e4);
-  return `${Math.floor(totalMinutes / 60)}h ${String(totalMinutes % 60).padStart(2, "0")}m`;
+  return `${formatDecimal(amount)}${units[unitIndex]}`;
+}
+function getK8sUsageState(entry) {
+  const hasHistory = entry.history.envelope.length > 0;
+  const terminalPods = entry.container.pods.filter((pod) => pod.phase === "Succeeded" || pod.phase === "Failed").length;
+  const inactive = entry.sampledPodCount === 0 && (entry.workload.replicas === 0 || entry.container.pods.length > 0 && terminalPods === entry.container.pods.length || entry.workload.kind === "CronJob" && entry.container.pods.length === 0);
+  if (inactive) return "inactive";
+  if (entry.sampledPodCount === 0) return hasHistory ? entry.history.stale ? "stale" : "no current" : "no data";
+  if (!hasHistory) return "warming";
+  if (entry.history.stale) return "stale";
+  if (entry.history.incomplete) return "partial";
+  return "healthy";
+}
+function abbreviatedK8sKind(kind) {
+  switch (kind) {
+    case "Deployment":
+      return "deploy";
+    case "StatefulSet":
+      return "sts";
+    case "DaemonSet":
+      return "ds";
+    case "CronJob":
+      return "cron";
+    case "ReplicaSet":
+      return "rs";
+    case "Job":
+      return "job";
+    case "Pod":
+      return "pod";
+  }
 }
 function renderK8sUsageReport(report) {
   const freshness = report.metricsFreshAt ?? "unavailable";
-  const lines = [`Metrics: ${report.metricsStale ? "stale" : "current"} (fresh at ${freshness})`, "Window: 24h"];
+  const lines = [
+    `Window: ${report.window}  Collector: ${report.metricsStale ? "stale" : "current"}  Fresh: ${freshness}`,
+    "PODS counts pods with current metrics."
+  ];
   if (report.entries.length === 0) return `${lines.join("\n")}
 No managed-vCluster workload containers found.
 `;
-  const headers = [
-    "NAMESPACE",
-    "WORKLOAD",
-    "CONTAINER",
-    "PODS",
-    "CPU NOW",
-    "CPU 24H MIN/MAX",
-    "MEM NOW",
-    "MEM 24H MIN/MAX",
-    "COVERAGE",
-    "STATUS"
-  ];
-  const rows = report.entries.map((entry) => [
-    entry.workload.namespace,
-    `${entry.workload.kind}/${entry.workload.name}`,
-    entry.container.name,
-    String(entry.container.pods.length),
-    formatK8sCpu(entry.container.currentUsage.cpuNanoCores),
-    `${formatK8sCpu(entry.summary.cpuMinNanoCores)} / ${formatK8sCpu(entry.summary.cpuMaxNanoCores)}`,
-    formatK8sMemory(entry.container.currentUsage.memoryBytes),
-    `${formatK8sMemory(entry.summary.memoryMinBytes)} / ${formatK8sMemory(entry.summary.memoryMaxBytes)}`,
-    formatK8sCoverage(entry.history.coverageStart, entry.history.coverageEnd),
-    entry.history.stale ? "stale" : entry.history.incomplete ? "partial" : "complete"
-  ]);
-  const widths = headers.map((header, column) => Math.max(header.length, ...rows.map((row) => row[column]?.length ?? 0)));
-  const formatRow = (row) => row.map((value, column) => column === row.length - 1 ? value : value.padEnd(widths[column] ?? value.length)).join("  ");
-  const separator = widths.map((width) => "-".repeat(width)).join("  ");
-  lines.push(formatRow(headers), separator, ...rows.map(formatRow));
+  const headers = ["WORKLOAD", "CONTAINER", "PODS", "CPU NOW", "CPU MAX", "MEM NOW", "MEM MAX", "STATE"];
+  const grouped = /* @__PURE__ */ new Map();
+  for (const entry of report.entries) {
+    const entries = grouped.get(entry.workload.namespace) ?? [];
+    entries.push(entry);
+    grouped.set(entry.workload.namespace, entries);
+  }
+  for (const [namespace, entries] of grouped) {
+    const rows = entries.map((entry) => {
+      const state = getK8sUsageState(entry);
+      return [
+        `${abbreviatedK8sKind(entry.workload.kind)}/${entry.workload.name}`,
+        entry.container.name,
+        String(entry.sampledPodCount),
+        formatK8sCpu(entry.container.currentUsage.cpuNanoCores),
+        formatK8sCpu(entry.summary.cpuMaxNanoCores),
+        formatK8sMemory(entry.container.currentUsage.memoryBytes),
+        formatK8sMemory(entry.summary.memoryMaxBytes),
+        state === "healthy" ? "-" : state
+      ];
+    });
+    const widths = headers.map((header, column) => Math.max(header.length, ...rows.map((row) => row[column]?.length ?? 0)));
+    const formatRow = (row) => row.map((value, column) => column === row.length - 1 ? value : value.padEnd(widths[column] ?? value.length)).join("  ");
+    const separator = widths.map((width) => "-".repeat(width)).join("  ");
+    lines.push("", `Namespace: ${namespace}`, formatRow(headers), separator, ...rows.map(formatRow));
+  }
   return `${lines.join("\n")}
 `;
 }
@@ -1313,6 +1427,17 @@ function summarizeEnvData(data) {
     ])
   );
 }
+function parseGetEnvsArgs(args) {
+  let showValues = false;
+  for (const arg of args) {
+    if (arg === "--show-values") {
+      showValues = true;
+      continue;
+    }
+    throw new Error(arg.startsWith("-") ? `Unknown get envs flag: ${arg}` : `Unexpected get envs value: ${arg}`);
+  }
+  return { showValues };
+}
 function renderEnvSummary(data) {
   const lines = [];
   for (const [name, env] of Object.entries(data)) {
@@ -1321,6 +1446,24 @@ function renderEnvSummary(data) {
   return lines.length > 0 ? `${lines.join("\n")}
 ` : "No environment variables declared.\n";
 }
+function renderEnvValues(data) {
+  const lines = Object.entries(data).sort(([left], [right]) => left.localeCompare(right)).map(([name, env]) => `${name}  ${env.value === null ? "<missing>" : JSON.stringify(env.value)}  ${env.description}`);
+  return lines.length > 0 ? `${lines.join("\n")}
+` : "No environment variables declared.\n";
+}
+function getProjectEnvValue(data, name) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+    throw new Error(`Invalid environment variable name: ${name}`);
+  }
+  if (!Object.prototype.hasOwnProperty.call(data, name)) {
+    throw new Error(`Environment variable ${name} is not declared for this project`);
+  }
+  const value = data[name]?.value;
+  if (value === null || value === void 0) {
+    throw new Error(`Environment variable ${name} does not have a value`);
+  }
+  return value;
+}
 function renderEnvSetResult(result) {
   const lines = [`Updated ${result.updated.length} environment variable${result.updated.length === 1 ? "" : "s"} for ${result.project}.`];
   if (result.skippedExisting.length > 0) lines.push(`Skipped ${result.skippedExisting.length} existing value(s).`);
@@ -1676,11 +1819,25 @@ Sessions: ${result.sessions.length}
     return;
   }
   if (first === "get" && second === "envs") {
-    if (args.length !== 3) throw new Error(`Unexpected get envs argument: ${args[3] ?? ""}`.trim());
     const projectRef = requireValue(args[2], "Missing project reference");
+    const options = parseGetEnvsArgs(args.slice(3));
     const project = await client.projects.describe(projectRef);
-    const envs = summarizeEnvData(await client.projects.env.get(project.id));
-    write({ project: project.path, envs }, renderEnvSummary(envs));
+    const envs = await client.projects.env.get(project.id);
+    if (options.showValues) {
+      write({ project: project.path, envs }, renderEnvValues(envs));
+    } else {
+      const summary = summarizeEnvData(envs);
+      write({ project: project.path, envs: summary }, renderEnvSummary(summary));
+    }
+    return;
+  }
+  if (first === "get" && second === "env") {
+    if (args.length > 4) throw new Error(`Unexpected get env argument: ${args[4]}`);
+    const projectRef = requireValue(args[2], "Missing project reference");
+    const name = requireValue(args[3], "Missing environment variable name");
+    const project = await client.projects.describe(projectRef);
+    const value = getProjectEnvValue(await client.projects.env.get(project.id), name);
+    write({ project: project.path, name, value }, value);
     return;
   }
   if (first === "set" && second === "envs") {
@@ -2033,9 +2190,29 @@ function resolveCommandExecution(options, rest) {
       if (options.branch) {
         throw new Error("--branch/-b is not supported for project environment variables");
       }
+      parseGetEnvsArgs(commandArgs.slice(1));
+      return {
+        kind: "plugin",
+        pluginArgs: ["get", "envs", options.project, ...commandArgs.slice(1)]
+      };
+    }
+    if (target === "env") {
+      if (!options.project) {
+        throw new Error("--project/-p is required for `get env`");
+      }
+      if (options.branch) {
+        throw new Error("--branch/-b is not supported for project environment variables");
+      }
+      const name = requireValue(commandArgs[1], "Environment variable name is required for `get env`");
+      if (commandArgs.length > 2) {
+        throw new Error(`Unexpected get env argument: ${commandArgs[2]}`);
+      }
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+        throw new Error(`Invalid environment variable name: ${name}`);
+      }
       return {
         kind: "plugin",
-        pluginArgs: ["get", "envs", options.project]
+        pluginArgs: ["get", "env", options.project, name]
       };
     }
     throw new Error("Unknown get command");
@@ -2423,18 +2600,24 @@ async function main(argv = process.argv.slice(2)) {
   }
 }
 export {
+  advanceTransientDevicePollBackoff,
   collectK8sUsage,
   formatK8sCpu,
   formatK8sMemory,
   formatProcessAge,
   getCliHelpText,
+  getK8sUsageState,
+  getProjectEnvValue,
   getR5dctlVersion,
+  getTransientDevicePollDelay,
+  handleAuthLogin,
   main,
   parseAnswerFlags,
   parseConversationRenderArgs,
   parseConversationWorkDetailArgs,
   parseEnvFlags,
   parseEnvRequestResponseArgs,
+  parseGetEnvsArgs,
   parseGlobalArgs,
   parseK8sUsageArgs,
   parsePromptArgs,
@@ -2447,6 +2630,8 @@ export {
   renderConversationOverviewResponse,
   renderConversationResponse,
   renderConversationWorkResponse,
+  renderDeviceAuthorizationPrompt,
+  renderEnvValues,
   renderK8sUsageReport,
   renderProcessHistory,
   renderProcessInspection,
@@ -2455,5 +2640,6 @@ export {
   renderWorkspaceSync,
   resolveCommandExecution,
   runR5dctlCli,
-  summarizeEnvData
+  summarizeEnvData,
+  writeConfig
 };

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.50",
+  "version": "0.0.53",
   "type": "module"
 }

package/dist/types/cli.d.ts

@@ -40,6 +40,7 @@ export declare function parseGlobalArgs(argv: string[]): {
     options: GlobalOptions;
     rest: string[];
 };
+export declare function writeConfig(configPath: string, config: R5dctlConfig): void;
 export declare function parseAnswerFlags(args: string[]): string[];
 export type SetEnvOptions = {
     assignments: string[];
@@ -69,9 +70,19 @@ export type K8sUsageOptions = {
     namespace?: string;
     workload?: string;
     container?: string;
-    window: "24h";
+    window: "24h" | "7d";
 };
 export declare function parseK8sUsageArgs(args: string[]): K8sUsageOptions;
+export declare function renderDeviceAuthorizationPrompt(input: {
+    verificationUri: string;
+    userCode: string;
+}): string;
+export declare function getTransientDevicePollDelay(intervalMs: number, transientBackoffMs: number): number;
+export declare function advanceTransientDevicePollBackoff(intervalMs: number, transientBackoffMs: number): {
+    delayMs: number;
+    nextBackoffMs: number;
+};
+export declare function handleAuthLogin(client: R5dctlClient, options: GlobalOptions, commandArgs: string[], config: R5dctlConfig): Promise<void>;
 export declare function renderWorkspaceStatus(status: R5dctlWorkspaceStatus): string;
 export declare function renderWorkspaceSync(result: R5dctlWorkspaceSyncResult): string;
 export type K8sUsageSummary = {
@@ -82,21 +93,23 @@ export type K8sUsageSummary = {
     sampleCount: number;
 };
 export type K8sUsageReport = {
-    window: "24h";
+    window: "24h" | "7d";
     collectedAt: string;
     metricsFreshAt: string | null;
     metricsStale: boolean;
     filters: Omit<K8sUsageOptions, "window">;
     entries: Array<{
-        workload: Pick<R5dctlK8sWorkload, "uid" | "kind" | "namespace" | "name">;
+        workload: Pick<R5dctlK8sWorkload, "uid" | "kind" | "namespace" | "name" | "replicas" | "readyReplicas">;
         container: {
             name: string;
             currentUsage: R5dctlK8sUsage;
             pods: Array<R5dctlK8sUsage & {
                 podUid: string;
                 podName: string;
+                phase: string | null;
             }>;
         };
+        sampledPodCount: number;
         summary: K8sUsageSummary;
         history: R5dctlK8sResourceHistory;
     }>;
@@ -104,6 +117,8 @@ export type K8sUsageReport = {
 export declare function collectK8sUsage(client: Pick<R5dctlClient, "k8s">, options: K8sUsageOptions): Promise<K8sUsageReport>;
 export declare function formatK8sCpu(value: number | null): string;
 export declare function formatK8sMemory(value: number | null): string;
+export type K8sUsageState = "healthy" | "partial" | "stale" | "inactive" | "warming" | "no data" | "no current";
+export declare function getK8sUsageState(entry: K8sUsageReport["entries"][number]): K8sUsageState;
 export declare function renderK8sUsageReport(report: K8sUsageReport): string;
 export declare function formatProcessAge(startedAt: string, nowMs?: number): string;
 export declare function renderProcessList(processes: R5dctlProcessRun[], nowMs?: number): string;
@@ -114,6 +129,11 @@ export type EnvSummaryData = Record<string, {
     hasValue: boolean;
 }>;
 export declare function summarizeEnvData(data: R5dctlEnvData): EnvSummaryData;
+export declare function parseGetEnvsArgs(args: string[]): {
+    showValues: boolean;
+};
+export declare function renderEnvValues(data: R5dctlEnvData): string;
+export declare function getProjectEnvValue(data: R5dctlEnvData, name: string): string;
 export declare function parseConversationRenderArgs(args: string[]): ConversationRenderOptions;
 export declare function renderConversationResponse(read: R5dctlConversationResponse): string;
 export declare function parseConversationWorkDetailArgs(args: string[]): R5dctlConversationWorkDetail;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.50",
+  "version": "0.0.53",
   "type": "module",
   "main": "./dist/cjs/cli.cjs",
   "module": "./dist/mjs/cli.mjs",
@@ -26,8 +26,9 @@
     "r5dctl": "dist/cjs/main.cjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.50",
+    "@ricsam/r5d-api": "^0.0.53",
     "dotenv": "^17",
+    "qrcode": "^1.5.4",
     "ws": "^8.18.3"
   },
   "files": [