@thinremote/thinr-cli 1.3.1 → 1.3.3

package/lib/mcp/tools-tokens.js

@@ -115,13 +115,11 @@ async function toolTokenDelete(args) {
 // ─── Device-level tokens ────────────────────────────────────────────
 
 async function toolDeviceTokenList(args) {
-    if (!args.device) throw inputError('device is required');
-    const tokens = await listDeviceTokens(args.device, args.user);
+    if (!args.device_id) throw inputError('device is required');
+    const tokens = await listDeviceTokens(args.device_id, args.user);
     if (tokens.length === 0) {
         return {
-            content: [
-                { type: 'text', text: `No device tokens on device "${args.device}".` },
-            ],
+            content: [{ type: 'text', text: `No device tokens on device "${args.device_id}".` }],
             isError: false,
         };
     }
@@ -129,7 +127,7 @@ async function toolDeviceTokenList(args) {
         content: [
             {
                 type: 'text',
-                text: `${tokens.length} device token(s) on "${args.device}":\n${JSON.stringify(tokens, null, 2)}`,
+                text: `${tokens.length} device token(s) on "${args.device_id}":\n${JSON.stringify(tokens, null, 2)}`,
             },
         ],
         isError: false,
@@ -137,11 +135,11 @@ async function toolDeviceTokenList(args) {
 }
 
 async function toolDeviceTokenCreate(args) {
-    if (!args.device) throw inputError('device is required');
+    if (!args.device_id) throw inputError('device is required');
     if (!args.token_name) throw inputError('token_name is required');
 
     const doc = await createDeviceToken(
-        args.device,
+        args.device_id,
         {
             token_name: args.token_name,
             token_resources: args.token_resources,
@@ -153,7 +151,7 @@ async function toolDeviceTokenCreate(args) {
         content: [
             {
                 type: 'text',
-                text: `Created device token "${args.token_name}" on "${args.device}".\n${JSON.stringify(doc, null, 2)}`,
+                text: `Created device token "${args.token_name}" on "${args.device_id}".\n${JSON.stringify(doc, null, 2)}`,
             },
         ],
         isError: false,
@@ -161,16 +159,16 @@ async function toolDeviceTokenCreate(args) {
 }
 
 async function toolDeviceTokenDelete(args) {
-    if (!args.device) throw inputError('device is required');
+    if (!args.device_id) throw inputError('device is required');
     if (!args.token_id) throw inputError('token_id is required');
-    const removed = await deleteDeviceToken(args.device, args.token_id, args.user);
+    const removed = await deleteDeviceToken(args.device_id, args.token_id, args.user);
     return {
         content: [
             {
                 type: 'text',
                 text: removed
-                    ? `Deleted device token "${args.token_id}" from "${args.device}".`
-                    : `Device token "${args.token_id}" was not configured on "${args.device}".`,
+                    ? `Deleted device token "${args.token_id}" from "${args.device_id}".`
+                    : `Device token "${args.token_id}" was not configured on "${args.device_id}".`,
             },
         ],
         isError: false,
@@ -318,10 +316,10 @@ ${EXPIRY_NOTE}`,
         inputSchema: {
             type: 'object',
             properties: {
-                device: { type: 'string', description: 'Device ID.' },
+                device_id: { type: 'string', description: 'Device ID.' },
                 user: { type: 'string', description: 'API user.' },
             },
-            required: ['device'],
+            required: ['device_id'],
         },
         handler: toolDeviceTokenList,
     },
@@ -336,7 +334,7 @@ Example: a token that lets a remote script call only the \`monitoring\` and \`re
         inputSchema: {
             type: 'object',
             properties: {
-                device: { type: 'string', description: 'Device ID.' },
+                device_id: { type: 'string', description: 'Device ID.' },
                 token_name: { type: 'string', description: 'Display name for the new token.' },
                 token_resources: {
                     type: 'array',
@@ -350,7 +348,7 @@ Example: a token that lets a remote script call only the \`monitoring\` and \`re
                 },
                 user: { type: 'string', description: 'API user.' },
             },
-            required: ['device', 'token_name'],
+            required: ['device_id', 'token_name'],
         },
         handler: toolDeviceTokenCreate,
     },
@@ -360,11 +358,11 @@ Example: a token that lets a remote script call only the \`monitoring\` and \`re
         inputSchema: {
             type: 'object',
             properties: {
-                device: { type: 'string', description: 'Device ID.' },
+                device_id: { type: 'string', description: 'Device ID.' },
                 token_id: { type: 'string', description: 'Token id to remove.' },
                 user: { type: 'string', description: 'API user.' },
             },
-            required: ['device', 'token_id'],
+            required: ['device_id', 'token_id'],
         },
         handler: toolDeviceTokenDelete,
     },

package/lib/monitoring.js

@@ -1,10 +1,6 @@
 import api from './api.js';
 import { apiError } from './errors.js';
-import { requireConfig } from './config.js';
-
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
+import { v2, v3 } from './paths.js';
 
 /**
  * Query the monitoring bucket. When `device` is provided, scopes to
@@ -55,7 +51,6 @@ export async function getMonitoringData({
     fields,
     group_by,
 } = {}) {
-    const apiUser = resolveUser(user);
     const params = { items, sort };
     if (minutes) {
         params.min_ts = Date.now() - minutes * 60 * 1000;
@@ -80,13 +75,12 @@ export async function getMonitoringData({
             .split(',')
             .map((s) => s.trim())
             .includes('device');
-        params.fields =
-            !device && !effectiveGroupBy && !hasDevice ? `device,${fields}` : fields;
+        params.fields = !device && !effectiveGroupBy && !hasDevice ? `device,${fields}` : fields;
     }
 
     const url = device
-        ? `/v3/users/${apiUser}/devices/${device}/buckets/monitoring/data`
-        : `/v2/users/${apiUser}/buckets/monitoring/data`;
+        ? `${v3(user)}/devices/${device}/buckets/monitoring/data`
+        : `${v2(user)}/buckets/monitoring/data`;
 
     try {
         const res = await api.get(url, { params });

package/lib/paths.js

@@ -0,0 +1,32 @@
+// @ts-check
+import { resolveUser } from './config.js';
+
+/**
+ * Account-scoped base paths, one per API version.
+ *
+ * Every endpoint the CLI talks to hangs off `/v{N}/users/{account}`, and
+ * the account is the part that is easy to get wrong: leaving it out still
+ * produces a valid URL, one that works against your own account and fails
+ * only when acting on behalf of another — with a "not found" that points
+ * nowhere near the real problem. Building the prefix in one place keeps
+ * the account in the signature, where it is visible, and `tests/paths.test.js`
+ * fails the build if a module starts hand-rolling these again.
+ *
+ * Pass `user` to address another account; omit it for the active profile.
+ */
+export function v1(user) {
+    return `/v1/users/${resolveUser(user)}`;
+}
+
+export function v2(user) {
+    return `/v2/users/${resolveUser(user)}`;
+}
+
+export function v3(user) {
+    return `/v3/users/${resolveUser(user)}`;
+}
+
+/** `/v3/users/{account}/devices/{deviceId}` — the most common prefix. */
+export function device(user, deviceId) {
+    return `${v3(user)}/devices/${deviceId}`;
+}

package/lib/playbook/actions.js

@@ -126,7 +126,7 @@ export const HANDLERS = {
     },
 
     async property_set(ctx, params) {
-        await setDeviceProperty(ctx.deviceId, params.property, params.value);
+        await setDeviceProperty(ctx.deviceId, params.property, params.value, ctx.user);
         return `set ${params.property}`;
     },
 
@@ -275,7 +275,7 @@ export const CHECKERS = {
     async property_set(ctx, params) {
         let current;
         try {
-            current = await getDeviceProperty(ctx.deviceId, params.property);
+            current = await getDeviceProperty(ctx.deviceId, params.property, ctx.user);
         } catch (err) {
             if (err?.code === 'not_found') {
                 return { status: 'changed', summary: `create property ${params.property}` };

package/lib/product.js

@@ -1,6 +1,5 @@
 import api from './api.js';
 import { apiError, inputError } from './errors.js';
-import { requireConfig } from './config.js';
 import {
     storageExists,
     createStorage,
@@ -12,6 +11,7 @@ import {
     deleteStorageFile,
 } from './storage.js';
 import { parsePlaybook } from './playbook/loader.js';
+import { v1 } from './paths.js';
 
 /**
  * Helpers for ThinRemote products and the product-script workflow.
@@ -28,14 +28,6 @@ import { parsePlaybook } from './playbook/loader.js';
  * sequence.
  */
 
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
-
-function v1(user) {
-    return `/v1/users/${resolveUser(user)}`;
-}
-
 // ─── Low-level: products ─────────────────────────────────────────────
 
 export async function getProducts(user) {

package/lib/profile.js

@@ -1,7 +1,7 @@
 // @ts-check
 import api from './api.js';
 import { apiError, inputError } from './errors.js';
-import { requireConfig } from './config.js';
+import { v1 } from './paths.js';
 
 /**
  * Helpers for product *profile* configuration.
@@ -68,14 +68,6 @@ import { requireConfig } from './config.js';
  * device code change.
  */
 
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
-
-function v1(user) {
-    return `/v1/users/${resolveUser(user)}`;
-}
-
 // ─── Listener config validators ──────────────────────────────────────
 //
 // Each `data.source` shape (for buckets/properties) and each request

package/lib/property.js

@@ -1,28 +1,23 @@
-import { requireConfig } from './config.js';
+import { resolveUser } from './config.js';
+import { device } from './paths.js';
 import api from './api.js';
 import { apiError } from './errors.js';
 import { info, success } from './format.js';
 
-export async function getDeviceProperties(deviceId) {
-    const config = requireConfig();
-
+export async function getDeviceProperties(deviceId, user) {
     try {
-        const response = await api.get(
-            `/v3/users/${config.username}/devices/${deviceId}/properties`,
-        );
+        const response = await api.get(`${device(user, deviceId)}/properties`);
         return response.data;
     } catch (error) {
-        throw apiError(error, { notFound: `Device not found: ${deviceId}` });
+        throw apiError(error, {
+            notFound: `Device not found: ${deviceId} (account ${resolveUser(user)})`,
+        });
     }
 }
 
-export async function getDeviceProperty(deviceId, propertyId) {
-    const config = requireConfig();
-
+export async function getDeviceProperty(deviceId, propertyId, user) {
     try {
-        const response = await api.get(
-            `/v3/users/${config.username}/devices/${deviceId}/properties/${propertyId}`,
-        );
+        const response = await api.get(`${device(user, deviceId)}/properties/${propertyId}`);
         return response.data.value;
     } catch (error) {
         throw apiError(error, {
@@ -33,17 +28,16 @@ export async function getDeviceProperty(deviceId, propertyId) {
 
 // PUT so the operation is idempotent — missing properties are created,
 // existing ones are overwritten wholesale.
-export async function setDeviceProperty(deviceId, propertyId, value) {
-    const config = requireConfig();
-
+export async function setDeviceProperty(deviceId, propertyId, value, user) {
     try {
-        const response = await api.put(
-            `/v3/users/${config.username}/devices/${deviceId}/properties/${propertyId}`,
-            { value },
-        );
+        const response = await api.put(`${device(user, deviceId)}/properties/${propertyId}`, {
+            value,
+        });
         return response.data;
     } catch (error) {
-        throw apiError(error, { notFound: `Device not found: ${deviceId}` });
+        throw apiError(error, {
+            notFound: `Device not found: ${deviceId} (account ${resolveUser(user)})`,
+        });
     }
 }
 
@@ -59,11 +53,7 @@ export function formatDeviceProperties(deviceId, properties) {
 
 export function formatDeviceProperty(deviceId, propertyId, propertyValue) {
     let formattedValue =
-        '\nValue of property ' +
-        info(propertyId) +
-        ' for device ' +
-        info(deviceId) +
-        ':\n';
+        '\nValue of property ' + info(propertyId) + ' for device ' + info(deviceId) + ':\n';
     const flattenedValue = flatten(propertyValue);
     for (const key in flattenedValue) {
         formattedValue += `${key}: ${success(flattenedValue[key])}\n`;

package/lib/resource.js

@@ -1,28 +1,19 @@
-import { requireConfig } from './config.js';
+import { resolveUser } from './config.js';
+import { device } from './paths.js';
 import api from './api.js';
 import { apiError } from './errors.js';
 import { info, warning, hint } from './format.js';
 
-/**
- * Account the request is addressed to: `options.user` for admin access to
- * another account's devices, the active profile's own user otherwise.
- * Matches `createDeviceAPI`, so both halves of a device interaction (files
- * and resources) resolve the same way.
- */
-function apiUser(options = {}) {
-    return options.user || requireConfig().username;
-}
-
 // Drops internal resources whose keys start with `$`; those belong to
 // the agent's own framework (cmd, fs, scripts…) and shouldn't surface
 // through the user-facing resource list.
 export async function getDeviceResources(deviceId, options = {}) {
-    const user = apiUser(options);
+    const user = resolveUser(options.user);
 
     try {
         // `/resources/api` merges firmware resources with API resources
         // inherited from the product profile, which `/resources` alone omits.
-        const response = await api.get(`/v3/users/${user}/devices/${deviceId}/resources/api`);
+        const response = await api.get(`${device(user, deviceId)}/resources/api`);
         return Object.fromEntries(
             Object.entries(response.data).filter(([key]) => !key.startsWith('$')),
         );
@@ -39,11 +30,9 @@ export async function getDeviceResources(deviceId, options = {}) {
  * sample, not to trigger the input side.
  */
 export async function readDeviceResource(deviceId, resourceId, options = {}) {
-    const user = apiUser(options);
+    const user = resolveUser(options.user);
     try {
-        const response = await api.get(
-            `/v3/users/${user}/devices/${deviceId}/resources/${resourceId}`,
-        );
+        const response = await api.get(`${device(user, deviceId)}/resources/${resourceId}`);
         return response.data;
     } catch (error) {
         throw apiError(error, {
@@ -62,11 +51,9 @@ export async function readDeviceResource(deviceId, resourceId, options = {}) {
  * exposes /api — callers should tolerate 404/501.
  */
 export async function getDeviceResourceApi(deviceId, resourceId, options = {}) {
-    const user = apiUser(options);
+    const user = resolveUser(options.user);
     try {
-        const response = await api.get(
-            `/v3/users/${user}/devices/${deviceId}/resources/${resourceId}/api`,
-        );
+        const response = await api.get(`${device(user, deviceId)}/resources/${resourceId}/api`);
         return response.data;
     } catch (error) {
         throw apiError(error, {
@@ -76,11 +63,11 @@ export async function getDeviceResourceApi(deviceId, resourceId, options = {}) {
 }
 
 export async function executeDeviceResource(deviceId, resourceId, inputs, options = {}) {
-    const user = apiUser(options);
+    const user = resolveUser(options.user);
 
     try {
         const response = await api.post(
-            `/v3/users/${user}/devices/${deviceId}/resources/${resourceId}`,
+            `${device(user, deviceId)}/resources/${resourceId}`,
             inputs,
         );
         return response.data;

package/lib/status.js

@@ -1,29 +1,23 @@
-import { requireConfig } from './config.js';
+import { resolveUser } from './config.js';
+import { v1 } from './paths.js';
 import api from './api.js';
 import { apiError } from './errors.js';
-import {
-    formatUptime,
-    colorPct,
-    formatBytes,
-    label,
-    muted,
-    success,
-    error,
-} from './format.js';
+import { formatUptime, colorPct, formatBytes, label, muted, success, error } from './format.js';
 
 /**
  * Get device status
  * @param {string} deviceId - Device ID to check
+ * @param {string} [user] - Account that owns the device (defaults to the active profile)
  * @returns {Promise<Object>} Status information
  */
-export async function getDeviceStatus(deviceId) {
-    const config = requireConfig();
-
+export async function getDeviceStatus(deviceId, user) {
     try {
-        const response = await api.get(`/v1/users/${config.username}/devices/${deviceId}/stats`);
+        const response = await api.get(`${v1(user)}/devices/${deviceId}/stats`);
         return response.data;
     } catch (error) {
-        throw apiError(error, { notFound: `Device not found: ${deviceId}` });
+        throw apiError(error, {
+            notFound: `Device not found: ${deviceId} (account ${resolveUser(user)})`,
+        });
     }
 }
 
@@ -80,17 +74,13 @@ export function formatDeviceStatus(deviceId, status, monitoring = null) {
             const root = monitoring.disk.root;
             const detail =
                 root.available != null && root.total != null
-                    ? muted(
-                          ` (${formatBytes(root.available)} free of ${formatBytes(root.total)})`,
-                      )
+                    ? muted(` (${formatBytes(root.available)} free of ${formatBytes(root.total)})`)
                     : '';
             lines.push(`  Disk:    ${colorPct(root.usage)}${detail}`);
         }
         if (monitoring.load) {
             const l = monitoring.load;
-            const parts = [l['1m'], l['5m'], l['15m']].map((v) =>
-                v != null ? v.toFixed(2) : '—',
-            );
+            const parts = [l['1m'], l['5m'], l['15m']].map((v) => (v != null ? v.toFixed(2) : '—'));
             lines.push(`  Load:    ${parts.join(' · ')}`);
         }
         if (monitoring.uptime != null) {

package/lib/storage.js

@@ -1,6 +1,6 @@
 import api from './api.js';
 import { apiError } from './errors.js';
-import { requireConfig } from './config.js';
+import { v1, v2 } from './paths.js';
 
 /**
  * Helpers for ThinRemote file storages — independent buckets that the
@@ -13,17 +13,6 @@ import { requireConfig } from './config.js';
  * so orchestration code can stay branch-light.
  */
 
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
-
-function v1(user) {
-    return `/v1/users/${resolveUser(user)}`;
-}
-function v2(user) {
-    return `/v2/users/${resolveUser(user)}`;
-}
-
 export async function getStorage(storageId, user) {
     try {
         const res = await api.get(`${v1(user)}/storages/${storageId}`);

package/lib/tokens.js

@@ -1,7 +1,7 @@
 // @ts-check
 import api from './api.js';
 import { apiError, inputError } from './errors.js';
-import { requireConfig } from './config.js';
+import { v1 } from './paths.js';
 
 /**
  * Helpers for ThinRemote access tokens — both user-level (broad scope,
@@ -60,14 +60,6 @@ import { requireConfig } from './config.js';
  * it.
  */
 
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
-
-function v1(user) {
-    return `/v1/users/${resolveUser(user)}`;
-}
-
 // ─── Duration helpers ───────────────────────────────────────────────
 
 const DURATION_RE = /^(\d+)([smhdwy])$/;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@thinremote/thinr-cli",
-    "version": "1.3.1",
+    "version": "1.3.3",
     "description": "CLI for ThinRemote — remote management for IoT devices, with an MCP server for AI clients",
     "main": "bin/thinr.js",
     "bin": {