@thinremote/thinr-cli 1.3.0 → 1.3.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [1.3.1] - 2026-09-24
+
+### Fixed
+
+- Device resources now honour the `user` argument, so an admin acting on
+  another account reaches that account's devices. `thinr_resource_list`,
+  `thinr_resource_call` and the `thinr_script_*` tools accepted the
+  argument but addressed the active profile's own account, which answered
+  "Device not found"; playbook `resource` and script actions had the same
+  gap. Not-found errors now name the account they looked in.
+
 ## [1.3.0] - 2026-09-13
 
 ### Added

package/lib/mcp/tools-resources.js

@@ -6,7 +6,7 @@ async function toolResourceList(args) {
     const device = args.device;
     if (!device)
         throw inputError('No device specified. Use thinr_devices to list available devices.');
-    const entries = await listDeviceResourcesWithSchemas(device);
+    const entries = await listDeviceResourcesWithSchemas(device, { user: args.user });
     const fnLabel = (f) =>
         ({ 1: 'no params', 2: 'input', 3: 'output', 4: 'input/output' })[f] || 'unknown';
     const lines = entries.map((e) => {
@@ -26,7 +26,9 @@ async function toolResourceCall(args) {
     if (!device)
         throw inputError('No device specified. Use thinr_devices to list available devices.');
     if (!args.resource) throw inputError('resource is required');
-    const result = await callDeviceResource(device, args.resource, args.inputs);
+    const result = await callDeviceResource(device, args.resource, args.inputs, {
+        user: args.user,
+    });
     return {
         content: [
             {

package/lib/mcp/tools-scripts.js

@@ -7,7 +7,7 @@ async function toolScriptList(args) {
     const device = args.device;
     if (!device)
         throw inputError('No device specified. Use thinr_devices to list available devices.');
-    const info = await readDeviceResource(device, '$scripts/info');
+    const info = await readDeviceResource(device, '$scripts/info', { user: args.user });
     const scripts = Array.isArray(info?.scripts) ? info.scripts : [];
     const header = `Scripts directory: ${info?.path || '(unknown)'}\n${scripts.length} script(s) registered:`;
     const entries = scripts.map((s) => {
@@ -33,7 +33,7 @@ async function toolScriptWrite(args) {
 
     const { api: deviceApi } = getAPI(device, args.user);
 
-    const info = await readDeviceResource(device, '$scripts/info');
+    const info = await readDeviceResource(device, '$scripts/info', { user: args.user });
     const baseDir = info?.path;
     if (!baseDir)
         throw new Error('Agent did not return a scripts directory (is $scripts/info supported?)');
@@ -52,7 +52,7 @@ async function toolScriptWrite(args) {
         throw new Error(`chmod +x failed: ${chmod.stderr || `exit ${chmod.retcode}`}`);
     }
 
-    const reloaded = await callDeviceResource(device, '$scripts/reload', {});
+    const reloaded = await callDeviceResource(device, '$scripts/reload', {}, { user: args.user });
     // The agent registers resources by the file's stem, so "battery.sh"
     // becomes scripts/battery. Match the same way to echo back the schema.
     const registeredName = args.name.replace(/\.[^./]+$/, '');
@@ -82,7 +82,7 @@ async function toolScriptDelete(args) {
     if (!args.name) throw inputError('name is required');
 
     const { api: deviceApi } = getAPI(device, args.user);
-    const info = await readDeviceResource(device, '$scripts/info');
+    const info = await readDeviceResource(device, '$scripts/info', { user: args.user });
     const baseDir = info?.path;
     if (!baseDir)
         throw new Error('Agent did not return a scripts directory (is $scripts/info supported?)');
@@ -93,7 +93,7 @@ async function toolScriptDelete(args) {
     const scriptPath = `${baseDir}/${args.name}`;
 
     await deviceApi.delete(scriptPath, false);
-    const reloaded = await callDeviceResource(device, '$scripts/reload', {});
+    const reloaded = await callDeviceResource(device, '$scripts/reload', {}, { user: args.user });
     const remaining = Array.isArray(reloaded?.scripts) ? reloaded.scripts.length : 0;
     return {
         content: [

package/lib/playbook/actions.js

@@ -30,7 +30,10 @@ const MAX_CAPTURED_STREAM_BYTES = 32 * 1024;
 
 function capStream(s) {
     if (typeof s !== 'string' || s.length <= MAX_CAPTURED_STREAM_BYTES) return s;
-    return s.slice(0, MAX_CAPTURED_STREAM_BYTES) + `\n…[truncated, ${s.length - MAX_CAPTURED_STREAM_BYTES} more bytes]`;
+    return (
+        s.slice(0, MAX_CAPTURED_STREAM_BYTES) +
+        `\n…[truncated, ${s.length - MAX_CAPTURED_STREAM_BYTES} more bytes]`
+    );
 }
 
 /** @type {Record<string, (ctx: any, params: any) => Promise<string | { summary: string, stdout?: string, stderr?: string, exitCode?: number }>>} */
@@ -128,11 +131,16 @@ export const HANDLERS = {
     },
 
     async resource(ctx, params) {
-        const result = await callDeviceResource(ctx.deviceId, params.resource, params.inputs || null);
+        const result = await callDeviceResource(
+            ctx.deviceId,
+            params.resource,
+            params.inputs || null,
+            {
+                user: ctx.user,
+            },
+        );
         const summary =
-            typeof result === 'string'
-                ? result.slice(0, 40)
-                : JSON.stringify(result).slice(0, 40);
+            typeof result === 'string' ? result.slice(0, 40) : JSON.stringify(result).slice(0, 40);
         return `resource ${params.resource} → ${summary}`;
     },
 
@@ -158,7 +166,7 @@ export const HANDLERS = {
         if (!/^[A-Za-z0-9._-]+$/.test(params.name)) {
             throw new Error(`invalid script name "${params.name}"`);
         }
-        const info = await readDeviceResource(ctx.deviceId, '$scripts/info');
+        const info = await readDeviceResource(ctx.deviceId, '$scripts/info', { user: ctx.user });
         const baseDir = info?.path;
         if (!baseDir) throw new Error('agent did not return a scripts directory');
         const path = `${baseDir}/${params.name}`;
@@ -168,7 +176,7 @@ export const HANDLERS = {
             TIMEOUTS.SCRIPT_CHMOD_SECONDS,
         );
         if (chmod.retcode !== 0) throw new Error(`chmod failed: ${chmod.stderr || chmod.retcode}`);
-        await callDeviceResource(ctx.deviceId, '$scripts/reload', {});
+        await callDeviceResource(ctx.deviceId, '$scripts/reload', {}, { user: ctx.user });
         return `installed ${params.name}`;
     },
 
@@ -176,11 +184,11 @@ export const HANDLERS = {
         if (!/^[A-Za-z0-9._-]+$/.test(params.name)) {
             throw new Error(`invalid script name "${params.name}"`);
         }
-        const info = await readDeviceResource(ctx.deviceId, '$scripts/info');
+        const info = await readDeviceResource(ctx.deviceId, '$scripts/info', { user: ctx.user });
         const baseDir = info?.path;
         if (!baseDir) throw new Error('agent did not return a scripts directory');
         await ctx.api.delete(`${baseDir}/${params.name}`, false);
-        await callDeviceResource(ctx.deviceId, '$scripts/reload', {});
+        await callDeviceResource(ctx.deviceId, '$scripts/reload', {}, { user: ctx.user });
         return `removed ${params.name}`;
     },
 };
@@ -221,10 +229,16 @@ export const CHECKERS = {
         try {
             const info = await ctx.api.info(params.source);
             const size = info?.size ?? '?';
-            return { status: 'changed', summary: `would pull ${params.source} (${size} bytes) → ${params.destination}` };
+            return {
+                status: 'changed',
+                summary: `would pull ${params.source} (${size} bytes) → ${params.destination}`,
+            };
         } catch (err) {
             if (err?.response?.status === 404) {
-                return { status: 'changed', summary: `source ${params.source} not found on device` };
+                return {
+                    status: 'changed',
+                    summary: `source ${params.source} not found on device`,
+                };
             }
             throw err;
         }
@@ -236,7 +250,7 @@ export const CHECKERS = {
         }
         const content = resolveWriteContent(params, ctx.baseDir);
         const localHash = sha256Hex(content);
-        const info = await readDeviceResource(ctx.deviceId, '$scripts/info');
+        const info = await readDeviceResource(ctx.deviceId, '$scripts/info', { user: ctx.user });
         const baseDir = info?.path;
         if (!baseDir) throw new Error('agent did not return a scripts directory');
         const remotePath = `${baseDir}/${params.name}`;
@@ -342,7 +356,8 @@ export const CHECKERS = {
         const upToDate = result?.status === 'up_to_date';
         return {
             status: upToDate ? 'unchanged' : 'changed',
-            summary: `update ${params.op}: ${result?.status || 'unknown'}` +
+            summary:
+                `update ${params.op}: ${result?.status || 'unknown'}` +
                 (result?.latest ? ` (latest=${result.latest})` : ''),
         };
     },
@@ -351,7 +366,7 @@ export const CHECKERS = {
         if (!/^[A-Za-z0-9._-]+$/.test(params.name)) {
             throw new Error(`invalid script name "${params.name}"`);
         }
-        const info = await readDeviceResource(ctx.deviceId, '$scripts/info');
+        const info = await readDeviceResource(ctx.deviceId, '$scripts/info', { user: ctx.user });
         const baseDir = info?.path;
         if (!baseDir) throw new Error('agent did not return a scripts directory');
         try {
@@ -396,7 +411,10 @@ async function hashCheck(api, path, contentBuffer) {
             return { status: 'changed', summary: `create ${path} (${contentBuffer.length} bytes)` };
         }
         if (err?.response?.status === 400) {
-            return { status: 'changed', summary: `${path} is not a regular file — would overwrite` };
+            return {
+                status: 'changed',
+                summary: `${path} is not a regular file — would overwrite`,
+            };
         }
         if (err?.response?.status === 405 || err?.response?.status === 501) {
             return { status: 'unknown', summary: 'agent lacks $fs/hash — cannot predict' };

package/lib/resource.js

@@ -3,23 +3,33 @@ import api from './api.js';
 import { apiError } from './errors.js';
 import { info, warning, hint } from './format.js';
 
+/**
+ * Account the request is addressed to: `options.user` for admin access to
+ * another account's devices, the active profile's own user otherwise.
+ * Matches `createDeviceAPI`, so both halves of a device interaction (files
+ * and resources) resolve the same way.
+ */
+function apiUser(options = {}) {
+    return options.user || requireConfig().username;
+}
+
 // Drops internal resources whose keys start with `$`; those belong to
 // the agent's own framework (cmd, fs, scripts…) and shouldn't surface
 // through the user-facing resource list.
-export async function getDeviceResources(deviceId) {
-    const config = requireConfig();
+export async function getDeviceResources(deviceId, options = {}) {
+    const user = apiUser(options);
 
     try {
         // `/resources/api` merges firmware resources with API resources
         // inherited from the product profile, which `/resources` alone omits.
-        const response = await api.get(
-            `/v3/users/${config.username}/devices/${deviceId}/resources/api`,
-        );
+        const response = await api.get(`/v3/users/${user}/devices/${deviceId}/resources/api`);
         return Object.fromEntries(
             Object.entries(response.data).filter(([key]) => !key.startsWith('$')),
         );
     } catch (error) {
-        throw apiError(error, { notFound: `Device not found: ${deviceId}` });
+        throw apiError(error, {
+            notFound: `Device not found: ${deviceId} (account ${user})`,
+        });
     }
 }
 
@@ -28,16 +38,16 @@ export async function getDeviceResources(deviceId) {
  * output-only (fn=3) or fn=4 resources when you only want the latest
  * sample, not to trigger the input side.
  */
-export async function readDeviceResource(deviceId, resourceId) {
-    const config = requireConfig();
+export async function readDeviceResource(deviceId, resourceId, options = {}) {
+    const user = apiUser(options);
     try {
         const response = await api.get(
-            `/v3/users/${config.username}/devices/${deviceId}/resources/${resourceId}`,
+            `/v3/users/${user}/devices/${deviceId}/resources/${resourceId}`,
         );
         return response.data;
     } catch (error) {
         throw apiError(error, {
-            notFound: `Resource not found: ${resourceId} on device ${deviceId}`,
+            notFound: `Resource not found: ${resourceId} on device ${deviceId} (account ${user})`,
         });
     }
 }
@@ -51,32 +61,32 @@ export async function readDeviceResource(deviceId, resourceId) {
  * return `in`; fn=1 may return an empty object. Not every agent/firmware
  * exposes /api — callers should tolerate 404/501.
  */
-export async function getDeviceResourceApi(deviceId, resourceId) {
-    const config = requireConfig();
+export async function getDeviceResourceApi(deviceId, resourceId, options = {}) {
+    const user = apiUser(options);
     try {
         const response = await api.get(
-            `/v3/users/${config.username}/devices/${deviceId}/resources/${resourceId}/api`,
+            `/v3/users/${user}/devices/${deviceId}/resources/${resourceId}/api`,
         );
         return response.data;
     } catch (error) {
         throw apiError(error, {
-            notFound: `Resource not found: ${resourceId} on device ${deviceId}`,
+            notFound: `Resource not found: ${resourceId} on device ${deviceId} (account ${user})`,
         });
     }
 }
 
-export async function executeDeviceResource(deviceId, resourceId, inputs) {
-    const config = requireConfig();
+export async function executeDeviceResource(deviceId, resourceId, inputs, options = {}) {
+    const user = apiUser(options);
 
     try {
         const response = await api.post(
-            `/v3/users/${config.username}/devices/${deviceId}/resources/${resourceId}`,
+            `/v3/users/${user}/devices/${deviceId}/resources/${resourceId}`,
             inputs,
         );
         return response.data;
     } catch (error) {
         throw apiError(error, {
-            notFound: `Resource not found: ${resourceId} on device ${deviceId}`,
+            notFound: `Resource not found: ${resourceId} on device ${deviceId} (account ${user})`,
         });
     }
 }
@@ -87,14 +97,14 @@ export async function executeDeviceResource(deviceId, resourceId, inputs) {
  * the output side of fn=3/4 resources without triggering the input
  * handler. Otherwise POST with the payload.
  */
-export async function callDeviceResource(deviceId, resourceId, inputs) {
+export async function callDeviceResource(deviceId, resourceId, inputs, options = {}) {
     const hasInputs =
         inputs !== undefined &&
         inputs !== null &&
         !(typeof inputs === 'object' && !Array.isArray(inputs) && Object.keys(inputs).length === 0);
     return hasInputs
-        ? executeDeviceResource(deviceId, resourceId, inputs)
-        : readDeviceResource(deviceId, resourceId);
+        ? executeDeviceResource(deviceId, resourceId, inputs, options)
+        : readDeviceResource(deviceId, resourceId, options);
 }
 
 /**
@@ -102,14 +112,14 @@ export async function callDeviceResource(deviceId, resourceId, inputs) {
  * `/api` schema. Returns an array with `{name, fn, in?, out?}` so both
  * the CLI and the MCP can render the same information.
  */
-export async function listDeviceResourcesWithSchemas(deviceId) {
-    const resources = await getDeviceResources(deviceId);
+export async function listDeviceResourcesWithSchemas(deviceId, options = {}) {
+    const resources = await getDeviceResources(deviceId, options);
     const names = Object.keys(resources);
     const entries = await Promise.all(
         names.map(async (name) => {
             const fn = resources[name]?.fn;
             try {
-                const schema = await getDeviceResourceApi(deviceId, name);
+                const schema = await getDeviceResourceApi(deviceId, name, options);
                 return { name, fn, ...schema };
             } catch {
                 return { name, fn };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@thinremote/thinr-cli",
-    "version": "1.3.0",
+    "version": "1.3.1",
     "description": "CLI for ThinRemote — remote management for IoT devices, with an MCP server for AI clients",
     "main": "bin/thinr.js",
     "bin": {