@synteq/cli 0.1.6 → 1.1.1

package/dist/version-check.js

@@ -0,0 +1,153 @@
+import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, chmodSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname, join } from "node:path";
+import * as semver from "semver";
+import { CLI_VERSION } from "./api/client.js";
+import { configDir } from "./config/paths.js";
+export const VERSION_CHECK_CACHE_TTL_MS = 6 * 60 * 60 * 1000;
+/** The npm package this CLI ships as (package.json `name`) — the one string
+ *  every upgrade hint agrees on, pinned by test/version-check.test.ts.
+ *  `@synteq/cli`, which the hints used to print, is not the published name. */
+export const NPM_PACKAGE = "synteq";
+export const UPGRADE_COMMAND = `npm i -g ${NPM_PACKAGE}@latest`;
+/** Commands that MUST work even when the local CLI is outdated. Keep tight:
+ *  login/logout so users can complete a re-auth if upgrade requires it;
+ *  settings so users can inspect the state they're stuck in. Nothing else. */
+export const VERSION_CHECK_EXEMPT = new Set([
+    "login",
+    "logout",
+    "settings",
+    "settings:render-mode",
+    "settings:index", // topic index
+]);
+function defaultCacheFile() {
+    return join(configDir(), "min-version.json");
+}
+function readCache(cacheFilePath) {
+    if (!existsSync(cacheFilePath))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(cacheFilePath, "utf8"));
+        if (typeof parsed?.min_version !== "string" || typeof parsed?.fetched_at !== "number")
+            return null;
+        // F5: the backend's regex + max_length historically admitted values
+        // semver.lt() throws on (e.g. overflowing MAX_SAFE_INTEGER), and a
+        // hand-edited or older-format cache file can carry a non-semver string
+        // ("1.0"). Drop the entry rather than let a corrupt/overflowed cache
+        // crash the guard later — fail open, same as a missing cache.
+        if (!semver.valid(parsed.min_version))
+            return null;
+        return {
+            minVersion: parsed.min_version,
+            deprecatedMessage: typeof parsed.deprecated_message === "string" ? parsed.deprecated_message : null,
+            fetchedAt: parsed.fetched_at,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeCacheAtomic(cacheFilePath, info) {
+    const dir = dirname(cacheFilePath);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    // randomUUID suffix (in addition to pid) avoids a collision if the pid is
+    // reused (common in containers) while a prior write's tmp file lingers.
+    const tmp = `${cacheFilePath}.tmp.${process.pid}.${randomUUID()}`;
+    writeFileSync(tmp, JSON.stringify({
+        min_version: info.minVersion,
+        deprecated_message: info.deprecatedMessage,
+        fetched_at: info.fetchedAt,
+    }), { mode: 0o600 });
+    // Match TokenStore's belt-and-suspenders pattern (src/auth/tokens.ts) —
+    // explicit chmod in case the platform/umask ignored the writeFileSync mode.
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, cacheFilePath);
+}
+/** Fetch the min-version record. Returns null when we couldn't get one AND
+ *  had no stale cache to fall back on — the caller MUST treat null as
+ *  "unknown, allow through" per the spec's fail-open error handling. */
+export async function loadOrFetchMinVersion(api, cacheFilePath = defaultCacheFile()) {
+    if (process.env.SYNTEQ_SKIP_VERSION_CHECK === "1")
+        return null;
+    const cached = readCache(cacheFilePath);
+    const now = Date.now();
+    if (cached && now - cached.fetchedAt < VERSION_CHECK_CACHE_TTL_MS && now - cached.fetchedAt >= 0) {
+        return cached;
+    }
+    try {
+        const resp = await api.auth.minCliVersion();
+        const info = {
+            minVersion: resp.min_cli_version,
+            deprecatedMessage: resp.deprecated_message ?? null,
+            fetchedAt: now,
+        };
+        writeCacheAtomic(cacheFilePath, info);
+        return info;
+    }
+    catch {
+        // Network / non-2xx / parse failure. Stale cache beats blocking the user.
+        return cached ?? null;
+    }
+}
+export function isCliOutdated(current, min) {
+    return semver.lt(current, min);
+}
+/** Strip C0/C1 control characters (except newline) and bidi-override
+ *  codepoints from a string. Defence-in-depth for `deprecatedMessage`,
+ *  which originates as unauthenticated, admin-free-text server input
+ *  (`GET /auth/device/version`) and is printed raw to the user's terminal.
+ *  The backend sanitizes on write (see `text_sanitize.py`); this is a
+ *  second, independent line of defence on the print path in case that
+ *  ever regresses or a stale cache from before the backend fix lingers
+ *  on disk. Shared by `formatUpgradeMessage` here and the bin-level shim
+ *  (`version-check-bin.ts`) so both print paths agree. */
+export function stripControlChars(s) {
+    // C0 controls (\x00-\x1F) except \n (\x0A), plus DEL (\x7F), plus C1
+    // controls (\x80-\x9F), plus Unicode bidi override/embedding/isolate
+    // control codepoints (U+200E-U+200F, U+202A-U+202E, U+2066-U+2069).
+    // eslint-disable-next-line no-control-regex
+    return s.replace(/[\x00-\x09\x0B-\x1F\x7F-\x9F\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+export function formatUpgradeMessage(current, min, deprecatedMessage, binName) {
+    const lines = [
+        `${binName}: this CLI (v${current}) is older than the portal's required minimum (v${min}).`,
+        `Upgrade with: ${UPGRADE_COMMAND}`,
+    ];
+    if (deprecatedMessage) {
+        lines.push("");
+        lines.push(stripControlChars(deprecatedMessage));
+    }
+    // Deliberately NOT advertising SYNTEQ_SKIP_VERSION_CHECK here: telling every
+    // blocked user to bypass the gate defeats it and produces broken requests
+    // against a portal their CLI no longer matches. The env var still works and
+    // is documented for tests/support in cli/CLAUDE.md — it just isn't surfaced
+    // in the user-facing block. Keep this in sync with buildOutdatedMessage in
+    // version-check-bin.ts (which likewise omits it).
+    return lines.join("\n");
+}
+export async function guardCliVersion(api, cmdId, binName, cacheFilePath) {
+    if (VERSION_CHECK_EXEMPT.has(cmdId))
+        return { outdated: false };
+    const info = await loadOrFetchMinVersion(api, cacheFilePath);
+    if (!info)
+        return { outdated: false }; // fail-open per spec
+    let outdated;
+    try {
+        outdated = isCliOutdated(CLI_VERSION, info.minVersion);
+    }
+    catch {
+        // F5: readCache already drops non-semver min_version values, and the
+        // network path's response is a live fetch (not free-form), but this
+        // guard is deliberately unconditional — a comparator surprise must
+        // never crash the command, only fail open.
+        return { outdated: false };
+    }
+    if (!outdated)
+        return { outdated: false };
+    return {
+        outdated: true,
+        message: formatUpgradeMessage(CLI_VERSION, info.minVersion, info.deprecatedMessage, binName),
+    };
+}
+//# sourceMappingURL=version-check.js.map

package/dist/version-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../src/version-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAGjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7D;;+EAE+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AACpC,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,WAAW,SAAS,CAAC;AAEhE;;8EAE8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,OAAO;IACP,QAAQ;IACR,UAAU;IACV,sBAAsB;IACtB,gBAAgB,EAAG,cAAc;CAClC,CAAC,CAAC;AAQH,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,aAAqB;IACtC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,OAAO,MAAM,EAAE,WAAW,KAAK,QAAQ,IAAI,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnG,oEAAoE;QACpE,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,iBAAiB,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;YACnG,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,aAAqB,EAAE,IAAoB;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,GAAG,GAAG,GAAG,aAAa,QAAQ,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;IAClE,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC;QAChC,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,kBAAkB,EAAE,IAAI,CAAC,iBAAiB;QAC1C,UAAU,EAAE,IAAI,CAAC,SAAS;KAC3B,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrB,wEAAwE;IACxE,4EAA4E;IAC5E,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACjC,CAAC;AAED;;wEAEwE;AACxE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAyI,EACzI,gBAAwB,gBAAgB,EAAE;IAE1C,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,0BAA0B,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;QACjG,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAmB;YAC3B,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,IAAI,IAAI;YAClD,SAAS,EAAE,GAAG;SACf,CAAC;QACF,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,GAAW;IACxD,OAAO,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;0DAQ0D;AAC1D,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,4CAA4C;IAC5C,OAAO,CAAC,CAAC,OAAO,CAAC,sEAAsE,EAAE,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,GAAW,EACX,iBAAgC,EAChC,OAAe;IAEf,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO,gBAAgB,OAAO,mDAAmD,GAAG,IAAI;QAC3F,iBAAiB,eAAe,EAAE;KACnC,CAAC;IACF,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,kDAAkD;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAA4B,EAC5B,KAAa,EACb,OAAe,EACf,aAAsB;IAEtB,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAE,qBAAqB;IAC7D,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,2CAA2C;QAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC1C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC;KAC7F,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synteq/cli",
-  "version": "0.1.6",
+  "version": "1.1.1",
   "description": "Synteq Cloud command-line client",
   "bin": {
     "synteq": "bin/run.js"
@@ -17,20 +17,63 @@
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.json",
     "dev": "node ./bin/dev.js",
-    "test": "vitest run",
+    "test": "vitest run && npm run test:scope && npm run test:help-filter && npm run test:scope-coverage && npm run test:version-check",
     "test:watch": "vitest",
+    "test:scope": "tsx --test test/auth/scope.test.ts",
+    "test:help-filter": "tsx --test test/help/help-filter.test.ts",
+    "test:scope-coverage": "tsx --test test/commands/scope-coverage.test.ts",
+    "test:version-check": "tsx --test test/version-check.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "oclif": {
     "bin": "synteq",
     "dirname": "synteq",
     "commands": "./dist/commands",
-    "helpClass": "./dist/help",
+    "helpClass": "./dist/help/scope-aware-help.js",
+    "plugins": [
+      "@oclif/plugin-autocomplete"
+    ],
     "topicSeparator": " ",
     "topics": {
       "order": {
         "description": "Order a new resource (interactive picker, or a kind: order vps / gpu / instant-metal / storage)."
       },
+      "apps": {
+        "description": "Manage managed-container apps (list, create). Deploy with `synteq deploy`, tail with `synteq app logs -f`."
+      },
+      "app": {
+        "description": "Full lifecycle for one app (health, logs incl. live tail, metrics, deployment, domain, env, plan, settings, unlink). Resolves the directory's `synteq link` when --app is omitted."
+      },
+      "app:deployment": {
+        "description": "An app's deployment history (list), one build's detail (show) and rollback to an earlier release."
+      },
+      "app:domain": {
+        "description": "Custom domains on an app (list, add, verify, remove). Adding one prints the DNS records to set."
+      },
+      "app:env": {
+        "description": "App environment variables (list, add, reveal, rm). Values are write-only; reveal returns config vars in full and secrets masked."
+      },
+      "app:plan": {
+        "description": "An app's plan (show) and plan changes (change) with a proration preview."
+      },
+      "app:settings": {
+        "description": "An app's build/deploy settings (show, set): root dir, Dockerfile, commands, auto-deploy, health check."
+      },
+      "function": {
+        "description": "Serverless functions: init, deploy, list, show, logs, releases, rollback, invoke, settings, pause, resume, env, cron, credits, delete. Resolves the directory's link when --name is omitted."
+      },
+      "function:cron": {
+        "description": "Function cron triggers (list, add, update, rm, run). Schedules are 5-field cron expressions in UTC."
+      },
+      "function:env": {
+        "description": "Function environment variables (list, set, rm, reveal). Secrets reveal masked; config reveals in full."
+      },
+      "function:credits": {
+        "description": "Function run credits: show the balance (bare), buy more (add), and top up automatically (auto-reload). --pool for the team pool."
+      },
+      "function:settings": {
+        "description": "A function's runtime and scaling settings (set): runtime, concurrency, timeout, min/max instances. Show them with `synteq function show`."
+      },
       "vps": {
         "description": "Manage VPS instances (list, details, order, power, resize, console, reinstall, ip, boot-order, stats, bandwidth, activity)."
       },
@@ -70,6 +113,9 @@
       "config": {
         "description": "Inspect or modify CLI configuration (api url, active team, paths)."
       },
+      "config:profile": {
+        "description": "Named connection profiles — each a saved API URL with its own login (list, add, use, remove)."
+      },
       "settings": {
         "description": "Inspect and modify CLI settings (render mode, api url, output format)."
       },
@@ -93,9 +139,13 @@
       },
       "instant-metal:ip": {
         "description": "An Instant Metal server's IPs (list, add)."
+      },
+      "baremetal": {
+        "description": "Bare metal (physical, ILA-managed dedicated servers) — list, details, power, reinstall, install-password, order. No console yet."
       }
     },
     "exitCodes": {
+      "4": "Outdated client — CLI version is below the portal's minimum. Run the update command shown in the error.",
       "default": 1,
       "failedFlagParsing": 1,
       "failedFlagValidation": 1,
@@ -112,6 +162,7 @@
     "@inquirer/input": "^5.1.2",
     "@inquirer/select": "^2.5.0",
     "@oclif/core": "^4.0.0",
+    "@oclif/plugin-autocomplete": "^3.2.56",
     "@types/react": "^19.2.17",
     "chalk": "^5.6.2",
     "cli-spinners": "^3.4.0",
@@ -122,14 +173,18 @@
     "ink-text-input": "^6.0.0",
     "log-update": "^8.0.0",
     "open": "^10.1.0",
-    "react": "^19.2.7"
+    "react": "^19.2.7",
+    "semver": "^7.8.5",
+    "undici": "^6.28.0"
   },
   "optionalDependencies": {
     "keytar": "^7.9.0"
   },
   "devDependencies": {
     "@types/node": "^20.11.0",
+    "@types/semver": "^7.7.1",
     "ts-node": "^10.9.2",
+    "tsx": "^4.23.1",
     "typescript": "^5.4.0",
     "vitest": "^1.6.0"
   },