@weirgate/cli 0.2.0 → 0.3.1

package/README.md

@@ -30,4 +30,20 @@ Provider-key values are entered only through `weirgate provider-keys put|rotate`
 local browser page by default, or hidden terminal input with `--stdin`) and never appear
 in output. Exit codes are listed in the guide.
 
+`weirgate models list` shows model prices and provider policy (`--upstream`,
+`--modality`), and `weirgate audit list --all` reads the whole audit log (up to 10,000
+events; `--limit` and `--cursor` page by hand).
+
+## Changes
+
+- **0.3.1**: the CLI and `weirgate-mcp` refuse the platform super-admin key on every
+  command (exit code 4, `platform_key_rejected`) and ask for a tenant-scoped key, instead
+  of acting on the first tenant the platform key can see.
+- **0.3.0**: `weirgate models list` and the MCP tool `weirgate_list_models` (model prices
+  and provider policy, with the reason a model isn't allowed); `weirgate audit list`
+  pages with `--limit`, `--cursor`, and `--all`.
+- **0.2.0**: CLI and MCP failures use the API's error envelope; `grants create
+  --source`; `doctor payments`.
+- **0.1.0**: first release.
+
 MIT licensed. Copyright 2026 Astraen Labs LLC.

package/dist/cli/index.js

@@ -10,7 +10,10 @@ import { AgentApiClient, API_VERSION, DEFAULT_API_URL, pathPart, WeirgateApiErro
 import { invokeTool } from "../shared/tools.js";
 import { browserSessionGrant } from "./browser-session-grant.js";
 import { exitCodeFor } from "./exit-codes.js";
+import { AUDIT_ALL_CAP, listAllAuditEvents, modelsTable } from "./listing.js";
 let deferringRequiredFlags = false;
+/** A command-specific `--output table` view; other commands print YAML. */
+let tableView;
 const parsed = parse(process.argv.slice(2));
 try {
     const result = await run(parsed);
@@ -140,11 +143,13 @@ async function commandToTool(client, noun, verb, flags) {
         "proposals:get": ["weirgate_get_proposal", { proposal_id: requiredFlag(flags, "proposal") }],
         "proposals:cancel": ["weirgate_cancel_proposal", { proposal_id: requiredFlag(flags, "proposal") }],
         "proposals:apply": ["weirgate_apply_proposal", { proposal_id: requiredFlag(flags, "proposal"), expected_base_revision: numberFlag(flags, "expected-base-revision"), idempotency_key: requiredFlag(flags, "idempotency-key") }],
-        "usage:query": ["weirgate_query_usage", { ...common, since: requiredFlag(flags, "since"), until: requiredFlag(flags, "until"), group_by: stringFlag(flags, "group-by"), limit: numberFlag(flags, "limit") }],
+        "usage:query": ["weirgate_query_usage", { ...common, since: requiredFlag(flags, "since"), until: requiredFlag(flags, "until"), group_by: stringFlag(flags, "group-by"), bucket: stringFlag(flags, "bucket"), limit: numberFlag(flags, "limit") }],
+        "usage:failures": ["weirgate_list_failures", { ...common, since: stringFlag(flags, "since"), until: stringFlag(flags, "until"), cursor: stringFlag(flags, "cursor"), limit: numberFlag(flags, "limit") }],
         "pricing-insights:get": ["weirgate_get_pricing_insights", { ...common, since: requiredFlag(flags, "since"), until: requiredFlag(flags, "until") }],
         "users:timeline": ["weirgate_get_user_timeline", { ...common, external_id: requiredFlag(flags, "user") }],
         "events:list": ["weirgate_list_events", common],
-        "audit:list": ["weirgate_list_audit_events", { ...common, since: stringFlag(flags, "since"), until: stringFlag(flags, "until"), action: stringFlag(flags, "action") }],
+        "audit:list": ["weirgate_list_audit_events", { ...common, since: stringFlag(flags, "since"), until: stringFlag(flags, "until"), action: stringFlag(flags, "action"), limit: numberFlag(flags, "limit"), cursor: stringFlag(flags, "cursor") }],
+        "models:list": ["weirgate_list_models", { upstream: stringFlag(flags, "upstream"), modality: stringFlag(flags, "modality") }],
         "provider-keys:list": ["weirgate_list_provider_key_slots", common],
         "provider-keys:test": ["weirgate_test_provider_key", { ...common, provider: requiredFlag(flags, "provider") }],
         "grants:create": ["weirgate_grant_allowance", { ...common, external_id: requiredFlag(flags, "user"), units: numberRequired(flags, "units"), source: stringFlag(flags, "source") }],
@@ -170,6 +175,12 @@ async function commandToTool(client, noun, verb, flags) {
             return invokeTool(client, "weirgate_get_proposal", { proposal_id: entry[1].proposal_id });
         return localResult({ dry_run: true, operation: `${noun}:${verb}`, input: redact(entry[1]) });
     }
+    if (noun === "models")
+        tableView = modelsTable;
+    if (noun === "audit" && flags.all) {
+        const input = entry[1];
+        return listAllAuditEvents(client, { app_id: input.app_id, action: input.action, since: input.since, until: input.until }, { cursor: input.cursor, pageSize: input.limit });
+    }
     if (entry[0] === "__auth_presets")
         return client.request("/v1/admin/auth-presets");
     if (entry[0] === "__config_propose")
@@ -298,7 +309,7 @@ function printSuccess(result, flags) {
     if (output === "yaml")
         stdout.write(`${YAML.stringify(envelope)}`);
     else if (output === "table")
-        stdout.write(`${human(result.data)}${flags["request-id"] ? `\nrequest_id: ${result.request_id}` : ""}\n`);
+        stdout.write(`${(tableView ?? human)(result.data)}${flags["request-id"] ? `\nrequest_id: ${result.request_id}` : ""}\n`);
     else
         stdout.write(`${JSON.stringify(envelope)}\n`);
 }
@@ -343,10 +354,10 @@ function redact(value) { if (Array.isArray(value))
     return value.map(redact); if (!value || typeof value !== "object")
     return value; return Object.fromEntries(Object.entries(value).map(([key, item]) => [/^(key|secret|token|password|credential|authorization)$/i.test(key) ? key : key, /^(key|secret|token|password|credential|authorization)$/i.test(key) ? "[redacted]" : redact(item)])); }
 function help() {
-    return `weirgate <noun> <verb> [flags]\n\nAuth: auth login|status|logout, mcp install, init\nApps: apps list|get|propose, config export|validate|propose|apply, auth-presets list\nConfig: features/tiers/rules/overrides/proposals, doctor, sandbox\nOps: usage, pricing-insights, users, user-tiers, events, audit, provider-keys, grants, docs\nOutput: --output json|table|yaml; --json; mutations use --idempotency-key\nAuth login: browser consent by default; --stdin accepts a pre-minted key\nSecrets: provider-keys put|rotate defaults to --browser; --stdin rejects pipes without --allow-pipe\n`;
+    return `weirgate <noun> <verb> [flags]\n\nAuth: auth login|status|logout, mcp install, init\nApps: apps list|get|propose, config export|validate|propose|apply, auth-presets list\nConfig: features/tiers/rules/overrides/proposals, doctor, sandbox\nOps: usage, pricing-insights, users, user-tiers, events, audit, provider-keys, grants, docs\nModels: models list [--upstream openrouter|openai|anthropic|google|xai] [--modality chat|embedding|image|audio]\nAudit: audit list [--limit n] [--cursor c] [--all] (--all follows next_cursor, up to ${AUDIT_ALL_CAP} events)\nOutput: --output json|table|yaml; --json; mutations use --idempotency-key\nAuth login: browser consent by default; --stdin accepts a pre-minted key\nSecrets: provider-keys put|rotate defaults to --browser; --stdin rejects pipes without --allow-pipe\n`;
 }
 function completion(shell) {
-    const commands = "auth mcp init apps config auth-presets features tiers rules overrides proposals usage pricing-insights users user-tiers events audit provider-keys grants doctor sandbox docs completion";
+    const commands = "auth mcp init apps config auth-presets models features tiers rules overrides proposals usage pricing-insights users user-tiers events audit provider-keys grants doctor sandbox docs completion";
     if (shell === "zsh")
         return `#compdef weirgate\n_arguments '1:command:(${commands})'\n`;
     if (shell === "fish")

package/dist/cli/listing.js

@@ -0,0 +1,66 @@
+import { record } from "../shared/api-client.js";
+/** `weirgate audit list --all` stops after this many events; resume with `--cursor <next_cursor>`. */
+export const AUDIT_ALL_CAP = 10_000;
+const AUDIT_MAX_PAGE = 500;
+/**
+ * Follows `pagination.next_cursor` from `cursor` (or the newest event) until the log ends or
+ * `cap` events are read. The first page asks for `include=total`, so the result says how many
+ * events match the filters. A capped result keeps `truncated: true` and the `next_cursor` to resume from.
+ */
+export async function listAllAuditEvents(client, filters, options = {}) {
+    const cap = options.cap ?? AUDIT_ALL_CAP;
+    const pageSize = Math.min(options.pageSize ?? AUDIT_MAX_PAGE, AUDIT_MAX_PAGE);
+    const events = [];
+    let cursor = options.cursor;
+    let total;
+    let pages = 0;
+    let last;
+    do {
+        const limit = Math.min(pageSize, cap - events.length);
+        last = await client.request("/v1/admin/audit", {
+            query: { ...filters, limit, cursor, ...(pages === 0 ? { include: "total" } : {}) },
+        });
+        pages += 1;
+        const page = record(last.data);
+        if (pages === 1)
+            total = page.pagination?.total;
+        events.push(...(page.data ?? []));
+        cursor = page.pagination?.truncated ? page.pagination.next_cursor ?? undefined : undefined;
+    } while (cursor && events.length < cap);
+    return {
+        ...last,
+        data: {
+            data: events,
+            pagination: {
+                limit: pageSize,
+                returned: events.length,
+                pages,
+                cap,
+                truncated: cursor !== undefined,
+                next_cursor: cursor ?? null,
+                ...(total === undefined ? {} : { total }),
+            },
+        },
+    };
+}
+const price = (value) => value === null ? "-" : `$${value}`;
+const policyCell = (entry) => entry.allowed ? (entry.state === "allowed" ? "yes" : `yes (${entry.state})`) : "no";
+/** The `--output table` view of `weirgate models list`: one line per row, prices in USD per 1M tokens. */
+export function modelsTable(data) {
+    const catalog = record(data);
+    const rows = catalog.data ?? [];
+    const header = ["UPSTREAM", "MODEL", "IN/1M", "OUT/1M", "CONTEXT", "DEV KEY", "USER KEY"];
+    const lines = rows.map((row) => [
+        row.upstream,
+        row.model,
+        price(row.input_usd_per_million),
+        price(row.output_usd_per_million),
+        row.context_length === null ? "-" : String(row.context_length),
+        policyCell(row.policy.developer),
+        policyCell(row.policy.user),
+    ]);
+    const widths = header.map((title, column) => Math.max(title.length, ...lines.map((line) => line[column].length)));
+    const format = (line) => line.map((cell, column) => column === line.length - 1 ? cell : cell.padEnd(widths[column])).join("  ");
+    const footer = `${rows.length} models · prices as of ${catalog.as_of ?? "unknown"}${catalog.stale ? " (stale)" : ""} · policy revision ${catalog.policy_revision}`;
+    return [format(header), ...lines.map(format), "", footer].join("\n");
+}

package/dist/mcp/server.js

@@ -20,7 +20,7 @@ const rank = { read: 0, propose: 1, apply: 2 };
 export function createMcpServer(auth) {
     const server = new Server({ name: "weirgate", version: API_VERSION }, {
         capabilities: { tools: { listChanged: false } },
-        instructions: "Operate Weirgate only through the frozen 2026-07-18 public API. Propose before apply. Provider keys are entered outside the model-facing MCP surface.",
+        instructions: "Operate Weirgate only through the 2026-07-18 public API. Propose before apply. Provider keys are entered outside the model-facing MCP surface.",
     });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: allowedTools({ scope: auth.identity.scope, tool_groups: auth.identity.tool_groups }).map((tool) => ({

package/dist/shared/tools.js

@@ -16,6 +16,7 @@ export const TOOL_DEFINITIONS = [
     { name: "weirgate_get_app", title: "Get app", description: "Get one visible app configuration.", scope: "read", group: "setup", inputSchema: objectSchema(app, appRequired) },
     { name: "weirgate_list_features", title: "List features", description: "List configured features for an app.", scope: "read", group: "setup", inputSchema: objectSchema(app, appRequired) },
     { name: "weirgate_get_feature", title: "Get feature", description: "Get a configured feature.", scope: "read", group: "setup", inputSchema: objectSchema({ ...app, feature_id: str() }, ["app_id", "feature_id"]) },
+    { name: "weirgate_list_models", title: "List models", description: "List models a feature can use, with list prices per million tokens (USD), context length, and whether the provider policy allows each for the developer's key and the user's own key (with a reason when not). Use `upstream` and `model` from a row as the feature's values.", scope: "read", group: "setup", inputSchema: objectSchema({ upstream: { enum: ["openrouter", "openai", "anthropic", "google", "xai"], description: "Provider slot the feature uses" }, modality: { enum: ["chat", "embedding", "image", "audio"] } }) },
     { name: "weirgate_search_docs", title: "Search docs", description: "Search the authenticated canonical Markdown corpus.", scope: "read", group: "docs", inputSchema: objectSchema({ query: str(), section: str(), limit: integer() }, ["query"]) },
     { name: "weirgate_get_doc", title: "Get doc", description: "Read one canonical Markdown document.", scope: "read", group: "docs", inputSchema: objectSchema({ page_id: str() }, ["page_id"]) },
     { name: "weirgate_get_onboarding_state", title: "Get onboarding state", description: "Read durable onboarding readiness evidence.", scope: "read", group: "setup", inputSchema: objectSchema(app, appRequired) },
@@ -24,7 +25,8 @@ export const TOOL_DEFINITIONS = [
     { name: "weirgate_test_provider_key", title: "Test provider key", description: "Run a non-billable metadata probe for an existing provider slot.", scope: "read", group: "provider_keys", inputSchema: objectSchema({ ...app, provider: str() }, ["app_id", "provider"]) },
     { name: "weirgate_get_integration_snippet", title: "Get integration snippet", description: "Generate an HTTP/curl integration snippet.", scope: "read", group: "setup", inputSchema: objectSchema({ ...app, mode: { enum: ["http", "curl"] }, feature_id: str() }, appRequired) },
     { name: "weirgate_run_mock_call", title: "Run mock call", description: "Run a deterministic sandbox fixture; never invokes live inference.", scope: "apply", group: "sandbox", inputSchema: objectSchema({ ...app, fixture: str(), session_name: str(), idempotency_key: str() }, ["app_id", "fixture"]) },
-    { name: "weirgate_query_usage", title: "Query usage", description: "Query windowed usage rollups.", scope: "read", group: "usage", inputSchema: objectSchema({ ...app, since: str(), until: str(), group_by: { enum: ["feature", "user"] }, limit: integer() }, ["app_id", "since", "until"]) },
+    { name: "weirgate_query_usage", title: "Query usage", description: "Query windowed usage totals, groups, latency, refusals, and an optional day/hour series.", scope: "read", group: "usage", inputSchema: objectSchema({ ...app, since: str(), until: str(), group_by: { enum: ["feature", "user", "model", "funding_rail", "refusal_code"] }, bucket: { enum: ["day", "hour"] }, limit: integer() }, ["app_id", "since", "until"]) },
+    { name: "weirgate_list_failures", title: "List failures", description: "List recent refused and failed metered requests, newest first, with request ids for request traces.", scope: "read", group: "usage", inputSchema: objectSchema({ ...app, since: str(), until: str(), cursor: str(), limit: integer() }, appRequired) },
     { name: "weirgate_get_pricing_insights", title: "Get pricing insights", description: "Read closed-window pricing evidence.", scope: "read", group: "usage", inputSchema: objectSchema({ ...app, since: str(), until: str() }, ["app_id", "since", "until"]) },
     { name: "weirgate_get_user_timeline", title: "Get user timeline", description: "Read one user's tenant-scoped operational timeline.", scope: "read", group: "usage", inputSchema: objectSchema({ ...app, external_id: str() }, ["app_id", "external_id"]) },
     { name: "weirgate_list_events", title: "List events", description: "List webhook delivery events for an app.", scope: "read", group: "webhooks", inputSchema: objectSchema({ ...app, status: str(), cursor: str(), limit: integer() }, appRequired) },
@@ -106,6 +108,7 @@ export async function invokeTool(client, name, rawInput) {
             const r = await client.request("/v1/admin/config");
             return { ...r, data: record(findApp(r.data, String(input.app_id)).features)[String(input.feature_id)] };
         }
+        case "weirgate_list_models": return client.request("/v1/admin/provider-policy/models", { query: q(input, ["upstream", "modality"]) });
         case "weirgate_search_docs": return client.request("/v1/admin/docs/search", { query: q(input, ["query", "section", "limit"]) });
         case "weirgate_get_doc": return client.request(`/v1/admin/docs/${pathPart(input.page_id)}`);
         case "weirgate_get_onboarding_state": return client.request(`/v1/admin/apps/${a()}/readiness`);
@@ -117,7 +120,8 @@ export async function invokeTool(client, name, rawInput) {
             const session = await client.request(`/v1/admin/apps/${a()}/sandbox/sessions`, { method: "POST", body: { name: input.session_name ?? "agent mock call" }, idempotencyKey: input.idempotency_key });
             return client.request(`/v1/admin/apps/${a()}/sandbox/sessions/${pathPart(session.data.id)}/runs`, { method: "POST", body: { fixture: input.fixture } });
         }
-        case "weirgate_query_usage": return client.request(`/v1/admin/apps/${a()}/usage`, { query: q(input, ["since", "until", "group_by", "limit"]) });
+        case "weirgate_query_usage": return client.request(`/v1/admin/apps/${a()}/usage`, { query: q(input, ["since", "until", "group_by", "bucket", "limit"]) });
+        case "weirgate_list_failures": return client.request(`/v1/admin/apps/${a()}/failures`, { query: q(input, ["since", "until", "cursor", "limit"]) });
         case "weirgate_get_pricing_insights": return client.request(`/v1/admin/apps/${a()}/pricing-insights`, { query: q(input, ["since", "until"]) });
         case "weirgate_get_user_timeline": return client.request(`/v1/admin/apps/${a()}/users/${pathPart(input.external_id)}`);
         case "weirgate_list_events": return client.request(`/v1/admin/apps/${a()}/webhooks/deliveries`, { query: q(input, ["status", "cursor", "limit"]) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weirgate/cli",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Weirgate CLI and local stdio MCP server: scoped, proposal-first management of Weirgate apps.",
   "license": "MIT",
   "author": "Astraen Labs LLC",