badgr-cli 1.1.1 → 1.1.3

package/src/commands/job.js

@@ -0,0 +1,246 @@
+import { callApi } from '../api.js';
+import { requireApiKey } from '../config.js';
+
+/**
+ * badgr job <agent> "<instruction>" --check "npm test"
+ *
+ * Submits a bounded coding-agent job via POST /v1/jobs (type: "agent"),
+ * which creates a Job record and runs it on a GPU/CPU VM.
+ * All three interfaces (website, CLI, POST /v1/jobs) share the same
+ * execution path on the backend (backend/jobs_routes.py).
+ *
+ * Usage:
+ *   badgr job cline "Fix the checkout bug" --check "npm test"
+ *   badgr job claude "Add pagination" --check "npm run test:e2e" --max-cost 3
+ *   badgr job codex "Refactor auth" --check "pytest tests/" --repo https://github.com/org/repo
+ */
+
+const _BOOL_FLAGS = { '--dry-run': 'dryRun', '--detach': 'detach' };
+const _VALUE_FLAGS = {
+  '--check': 'check', '--eval': 'check', '--eval-command': 'check',
+  '--repo': 'repository', '--repository': 'repository',
+  '--ref': 'ref',
+  '--agent': 'agent',
+  '--provider': 'provider',
+  '--model': 'model',
+  '--max-cost': 'maxCost',
+  '--max-runtime': 'maxRuntime',
+};
+
+// Scan the arg list, pull out known flags wherever they appear, and collect
+// the remaining tokens as positionals. This lets flags appear anywhere:
+//   badgr job cline "Fix it" --check "npm test"
+//   badgr job "Fix it" --check "npm test" --agent cline
+function parseJobArgs(rawArgs) {
+  const flags = {};
+  const positional = [];
+  let i = 0;
+  while (i < rawArgs.length) {
+    const tok = rawArgs[i];
+    if (tok in _BOOL_FLAGS) { flags[_BOOL_FLAGS[tok]] = true; i += 1; continue; }
+    if (tok in _VALUE_FLAGS) { flags[_VALUE_FLAGS[tok]] = rawArgs[i + 1]; i += 2; continue; }
+    positional.push(tok);
+    i += 1;
+  }
+  return { flags, positional };
+}
+
+// Providers the agent Job type accepts (backend jobs_routes._VALID_AGENT_PROVIDERS).
+// The BYOK/OpenAI-compatible providers `badgr launch --provider` supports
+// (openrouter, deepseek, glm, custom) are NOT among them: the Jobs API
+// resolves credentials server-side from stored provider credentials and has
+// nowhere to put a custom base URL, so those must be rejected in the CLI
+// rather than sent on to a 400 from the server.
+export const JOB_API_PROVIDERS = ['badgr', 'openai', 'anthropic'];
+
+export const JOB_AGENTS = ['cline', 'claude', 'claude-code', 'codex', 'playwright'];
+
+export async function jobCommand(config, args, chalk) {
+  // Support both:
+  //   badgr job <agent> "<instruction>" --check "..."
+  //   badgr job "<instruction>" --check "..." --agent cline   (fallback)
+  const { flags, positional } = parseJobArgs(args);
+
+  let agentName = null;
+  let instructionText = null;
+
+  const knownAgents = new Set(JOB_AGENTS);
+
+  if (positional.length >= 2 && knownAgents.has(positional[0])) {
+    agentName = positional[0];
+    instructionText = positional.slice(1).join(' ').trim();
+  } else if (positional.length >= 1) {
+    instructionText = positional.join(' ').trim();
+    agentName = flags.agent ?? 'cline';
+  }
+
+  if (!instructionText || !agentName) {
+    console.error(chalk.red('\nUsage: badgr job <agent> "<instruction>" --check "<command>"\n'));
+    console.error(chalk.dim('  Agents: cline (default), claude-code, codex, playwright'));
+    console.error(chalk.dim('  Example: badgr job cline "Fix the checkout bug" --check "npm test"'));
+    console.error(chalk.dim('  Example: badgr job claude-code "Add pagination" --check "pytest tests/" --max-cost 3\n'));
+    process.exitCode = 1;
+    return;
+  }
+
+  if (!flags.check) {
+    console.error(chalk.red('\n  ✗ --check <command> is required — it verifies the job succeeded.\n'));
+    console.error(chalk.dim('  Example: badgr job cline "Fix the bug" --check "npm test"\n'));
+    process.exitCode = 1;
+    return;
+  }
+
+  return runJob(config, {
+    agent:       agentName,
+    instruction: instructionText,
+    check:       flags.check,
+    provider:    flags.provider,
+    model:       flags.model,
+    repository:  flags.repository,
+    ref:         flags.ref,
+    maxCost:     flags.maxCost,
+    maxRuntime:  flags.maxRuntime,
+    dryRun:      flags.dryRun,
+    detach:      flags.detach,
+  }, chalk);
+}
+
+/**
+ * Submit one agent job to POST /v1/jobs and (unless detached) poll it to a
+ * terminal state. Takes an already-resolved options object rather than argv
+ * so callers that have parsed their own flags — `badgr launch <agent>
+ * --eval-command ...` — can reuse this path directly instead of
+ * re-serializing their flags back into an argv for jobCommand to reparse.
+ */
+export async function runJob(config, opts, chalk) {
+  const { agent: agentName, instruction: instructionText, check } = opts;
+
+  // Require API key — jobs are tracked under the user account.
+  const apiKey = requireApiKey(config, chalk);
+  if (!apiKey) return;
+
+  const provider = opts.provider ?? null;
+  const model = opts.model ?? null;
+  const repository = opts.repository ?? '.';
+  const ref = opts.ref ?? null;
+  const maxCostUsd = opts.maxCost != null ? Number(opts.maxCost) : 2.0;
+  const maxRuntimeSeconds = opts.maxRuntime != null ? Number(opts.maxRuntime) : 1800;
+
+  if (provider && !JOB_API_PROVIDERS.includes(provider)) {
+    console.error(chalk.red(`\n  ✗ The Jobs API does not accept --provider ${provider}.`));
+    console.error(chalk.dim(`  Supported: ${JOB_API_PROVIDERS.join(', ')}`));
+    console.error(chalk.dim('  BYOK providers (openrouter, deepseek, glm, custom) work with'));
+    console.error(chalk.dim('  badgr launch without --eval-command.\n'));
+    process.exitCode = 1;
+    return;
+  }
+
+  // Print plan.
+  console.log('');
+  console.log(chalk.bold(`  Job: ${instructionText}`));
+  console.log(chalk.dim(`  Agent: ${agentName}${provider ? ` via ${provider}` : ''}${model ? ` / ${model}` : ''}`));
+  console.log(chalk.dim(`  Check: ${check}`));
+  console.log(chalk.dim(`  Max:   $${maxCostUsd.toFixed(2)} / ${Math.round(maxRuntimeSeconds / 60)} min`));
+  console.log('');
+
+  if (opts.dryRun) {
+    console.log(chalk.yellow('  (dry run — no job submitted)\n'));
+    return;
+  }
+
+  // Submit job.
+  let job;
+  try {
+    job = await callApi('/v1/jobs', {
+      method: 'POST',
+      apiKey,
+      baseUrl: config.baseUrl,
+      body: {
+        type: 'agent',
+        input: {
+          repository,
+          ref,
+          agent: agentName,
+          provider,
+          model,
+          instruction: instructionText,
+          check,
+        },
+        policy: {
+          max_cost: maxCostUsd,
+          max_runtime_minutes: Math.round(maxRuntimeSeconds / 60),
+        },
+      },
+    });
+  } catch (err) {
+    console.error(chalk.red(`\n  ✗ Could not submit job: ${err.message}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  if (job?.detail || job?.error) {
+    console.error(chalk.red(`\n  ✗ ${job.detail ?? job.error}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  const jobId = job?.job_id;
+  if (!jobId) {
+    console.error(chalk.red('\n  ✗ Unexpected response from server.\n'));
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(chalk.green(`  ✓ Job submitted`));
+  console.log(chalk.dim(`  ID: ${jobId}`));
+
+  if (opts.detach) {
+    console.log(chalk.dim(`  Status: badgr status (or GET /v1/jobs/${jobId})\n`));
+    return;
+  }
+
+  // Poll until terminal.
+  console.log(chalk.dim('  Waiting for job to complete…\n'));
+  const pollMs = 10_000;
+  const maxWaitMs = (maxRuntimeSeconds + 60) * 1000;
+  const startMs = Date.now();
+
+  while (true) {
+    await new Promise(r => setTimeout(r, pollMs));
+    if (Date.now() - startMs > maxWaitMs) {
+      console.error(chalk.yellow(`\n  ⚠ Timed out waiting. Job ${jobId} is still running.\n`));
+      console.log(chalk.dim(`  Check: badgr status (or GET /v1/jobs/${jobId})\n`));
+      break;
+    }
+    let latest;
+    try {
+      latest = await callApi(`/v1/jobs/${jobId}`, { apiKey, baseUrl: config.baseUrl });
+    } catch {
+      continue;
+    }
+    if (!latest?.job_id) continue;
+    if (latest.status === 'running' && latest.stage) {
+      process.stdout.write(chalk.dim(`\r  ${latest.stage}…`));
+    }
+    if (latest.status === 'completed' || latest.status === 'failed' || latest.status === 'canceled') {
+      console.log('');
+      if (latest.status === 'completed') {
+        console.log(chalk.green(`\n  ✓ Job succeeded`));
+        if (latest.output?.exit_code != null) {
+          console.log(chalk.green(`  Check: ${latest.output.exit_code === 0 ? 'passed' : 'failed'}`));
+        }
+      } else if (latest.status === 'failed') {
+        console.error(chalk.red(`\n  ✗ Job failed`));
+        if (latest.error?.message) console.error(chalk.dim(`  ${latest.error.message}`));
+        process.exitCode = 1;
+      } else {
+        console.log(chalk.yellow(`\n  Job ${latest.status}`));
+      }
+      if (latest.charged_usd != null) {
+        console.log(chalk.dim(`  Cost: $${latest.charged_usd.toFixed(4)}`));
+      }
+      console.log('');
+      break;
+    }
+  }
+}

package/src/commands/launch.js

@@ -1,5 +1,6 @@
 import { runCommand, parseRunArgs } from './run.js';
-import { getCredential, setCredential, PROVIDER_ENV_KEYS } from '../credentials.js';
+import { runJob } from './job.js';
+import { getCredential, setCredential, PROVIDER_ENV_KEYS, MODEL_PROVIDERS, KNOWN_MODEL_PROVIDERS, ENV_KEYS_FOR_API_KIND } from '../credentials.js';
 import { VM_CLASSES, LAUNCH_VM_SIZES, vmClassForWorkload } from '../spec.js';
 
 // Phase 1 supports these coding/testing workloads via shorthand. Do not add
@@ -43,8 +44,8 @@ import { VM_CLASSES, LAUNCH_VM_SIZES, vmClassForWorkload } from '../spec.js';
 // images/badgr-job-runner/entrypoint.py, which subprocess.run executes
 // directly with shell=False — no shlex.split() involved for this path).
 const AGENT_WORKLOADS = {
-  cline:  { image: process.env.BADGR_AGENT_IMAGE_CLINE  || 'ghcr.io/michaelmanly/badgr-agent-cline:latest',  buildCmd: task => ['badgr-cline-run', task], provider: null },
-  claude: { image: process.env.BADGR_AGENT_IMAGE_CLAUDE || 'ghcr.io/michaelmanly/badgr-agent-claude:latest', buildCmd: task => ['claude', '-p', task],  provider: 'anthropic' },
+  cline:  { image: process.env.BADGR_AGENT_IMAGE_CLINE  || 'ghcr.io/michaelmanly/badgr-agent-cline:latest',  buildCmd: task => ['badgr-cline-run', task],  provider: null },
+  claude: { image: process.env.BADGR_AGENT_IMAGE_CLAUDE || 'ghcr.io/michaelmanly/badgr-agent-claude:latest', buildCmd: task => ['badgr-claude-run', task], provider: 'anthropic' },
   codex:  { image: process.env.BADGR_AGENT_IMAGE_CODEX   || 'ghcr.io/michaelmanly/badgr-agent-codex:latest',  buildCmd: task => ['badgr-codex-run', task], provider: 'openai' },
 };
 
@@ -100,9 +101,25 @@ const _VALUE_FLAGS = {
   '--max-runtime': 'maxRuntime', '--max-cost': 'maxCost', '--save': 'save',
   '--workspace': 'workspace', '--output': 'output', '--checkpoint': 'checkpoint',
   '--resume-cmd': 'resumeCmd', '--size': 'size',
+  // BYOK / OpenAI-compatible model selection — `badgr launch cline` only,
+  // see resolveModelProviderEnv below.
+  '--provider': 'provider', '--model': 'model', '--base-url': 'baseUrl',
+  // When present, routes to POST /v1/jobs (type: agent) instead of the
+  // plain badgr-launch GPU/CPU run path.
+  '--eval-command': 'evalCommand', '--eval': 'evalCommand',
 };
 const _REPEATABLE_FLAGS = { '--env': 'env', '--artifacts': 'artifacts' };
 
+// `badgr launch --eval-command` hands the run to the agent Job type
+// (POST /v1/jobs, type: agent), which provisions and configures the VM
+// server-side. These VM-shaping flags have no equivalent there, so they are
+// called out instead of being silently dropped.
+const JOB_API_IGNORED_FLAGS = [
+  ['--base-url', 'baseUrl'], ['--env', 'env'], ['--artifacts', 'artifacts'],
+  ['--workspace', 'workspace'], ['--output', 'output'], ['--size', 'size'],
+  ['--image', 'image'], ['--region', 'region'], ['--tier', 'tier'],
+];
+
 const _PASSTHROUGH_FLAGS = [
   ['--image', 'image'], ['--count', 'count'], ['--region', 'region'],
   ['--tier', 'tier'], ['--max-price', 'maxPrice'], ['--name', 'name'],
@@ -229,28 +246,32 @@ function resolveVmSize(flags, workloadName, chalk) {
   return true;
 }
 
-async function resolveMissingCredential(provider, chalk) {
-  const providerLabel = provider === 'anthropic' ? 'Anthropic' : 'OpenAI';
+async function resolveMissingCredential(provider, chalk, label) {
+  const displayLabel = label ?? (provider === 'anthropic' ? 'Anthropic' : 'OpenAI');
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    console.error(chalk.red(`\n  ✗ No ${provider} credential found.\n`));
+    console.error(chalk.red(`\n  ✗ No ${displayLabel} credential found.\n`));
     console.error(chalk.dim(`  Run: badgr connect ${provider}\n`));
     return null;
   }
 
-  console.log(chalk.yellow(`\n  ${providerLabel} is not connected.`));
-  console.log(chalk.dim(`  ${providerLabel === 'Anthropic' ? 'Claude Code' : 'Codex'} uses your ${providerLabel} account for model usage.`));
-  console.log(chalk.dim('  Badgr credits still pay for the disposable VM.\n'));
+  console.log(chalk.yellow(`\n  ${displayLabel} is not connected.`));
+  if (label) {
+    console.log(chalk.dim(`  Your own ${displayLabel} API key pays for model usage — Badgr credits still pay for the disposable VM.\n`));
+  } else {
+    console.log(chalk.dim(`  ${displayLabel === 'Anthropic' ? 'Claude Code' : 'Codex'} uses your ${displayLabel} account for model usage.`));
+    console.log(chalk.dim('  Badgr credits still pay for the disposable VM.\n'));
+  }
 
   try {
     const { password } = await import('@inquirer/prompts');
     const key = await password({
-      message: `Enter your ${providerLabel} API key:`,
+      message: `Enter your ${displayLabel} API key:`,
       validate: v => v.trim() ? true : 'API key is required',
     });
     const trimmed = key.trim();
     if (!trimmed) return null;
     setCredential(provider, trimmed);
-    console.log(chalk.green(`  ✓ ${providerLabel} connected\n`));
+    console.log(chalk.green(`  ✓ ${displayLabel} connected\n`));
     return trimmed;
   } catch {
     // Ctrl+C or a non-interactive stdin that lied about isTTY.
@@ -258,6 +279,53 @@ async function resolveMissingCredential(provider, chalk) {
   }
 }
 
+/**
+ * BYOK / OpenAI-compatible or Anthropic-compatible model selection.
+ *
+ * `badgr launch <cline|codex> --provider <name> --model <id> [--base-url <url>]`
+ * uses apiKind='openai' (injects OPENAI_API_KEY/OPENAI_BASE_URL/MODEL).
+ * `badgr launch claude --provider <name> --model <id> [--base-url <url>]`
+ * uses apiKind='anthropic' (injects ANTHROPIC_API_KEY/ANTHROPIC_BASE_URL/MODEL).
+ *
+ * Validates before provisioning — unknown provider, missing --model, or
+ * missing --base-url for `custom` all hard-fail here, no VM created.
+ * Returns the extra env pairs to inject, or null on validation failure.
+ */
+async function resolveModelProviderEnv(flags, chalk, apiKind = 'openai') {
+  const provider = flags.provider;
+  if (!(provider in MODEL_PROVIDERS)) {
+    console.error(chalk.red(`\n  ✗ Unknown model provider: ${provider}`));
+    console.error(chalk.dim(`  Supported: ${KNOWN_MODEL_PROVIDERS.join(', ')}\n`));
+    return null;
+  }
+  if (!flags.model) {
+    console.error(chalk.red(`\n  ✗ --provider ${provider} requires --model <model-id> — no default model is assumed.\n`));
+    return null;
+  }
+  const baseUrl = flags.baseUrl || MODEL_PROVIDERS[provider].defaultBaseUrl;
+  if (!baseUrl) {
+    console.error(chalk.red(`\n  ✗ --provider custom requires --base-url <url>.\n`));
+    return null;
+  }
+
+  const envKeys = ENV_KEYS_FOR_API_KIND[apiKind];
+  const userEnvKeys = new Set((flags.env || []).map(kv => kv.split('=')[0]));
+  const env = [];
+
+  if (!userEnvKeys.has(envKeys.apiKey)) {
+    let credential = getCredential(provider);
+    if (!credential) {
+      credential = await resolveMissingCredential(provider, chalk, MODEL_PROVIDERS[provider].label);
+      if (!credential) return null;
+    }
+    env.push(`${envKeys.apiKey}=${credential}`);
+  }
+  if (!userEnvKeys.has(envKeys.model)) env.push(`${envKeys.model}=${flags.model}`);
+  if (!userEnvKeys.has(envKeys.baseUrl)) env.push(`${envKeys.baseUrl}=${baseUrl}`);
+
+  return env;
+}
+
 async function launchAgentWorkload(config, agentName, rawArgs, chalk) {
   const { flags, task, gpuRejected } = parseWorkloadShorthandArgs(rawArgs);
 
@@ -275,6 +343,32 @@ async function launchAgentWorkload(config, agentName, rawArgs, chalk) {
 
   warnIfTaskMayHaveSwallowedAFlag(task, chalk);
 
+  // When --eval-command is given, route to the agent Job type
+  // (POST /v1/jobs, type: agent) which tracks check results and stores a
+  // receipt — same UX path, different backend record type. Runs after the
+  // --gpu / empty-task guards above so those still apply, and calls runJob
+  // directly with the already-parsed flags rather than re-serializing them
+  // into an argv (which silently dropped everything the re-serializer
+  // forgot to list).
+  if (flags.evalCommand) {
+    const ignored = JOB_API_IGNORED_FLAGS.filter(([, key]) => flags[key] !== undefined);
+    if (ignored.length) {
+      console.error(chalk.yellow(`\n  ⚠ ${ignored.map(([f]) => f).join(', ')} ${ignored.length === 1 ? 'is' : 'are'} not supported with --eval-command and will be ignored.`));
+      console.error(chalk.dim('    The Jobs API provisions and configures the VM itself.\n'));
+    }
+    return runJob(config, {
+      agent:       agentName,
+      instruction: task,
+      check:       flags.evalCommand,
+      provider:    flags.provider,
+      model:       flags.model,
+      maxCost:     flags.maxCost,
+      maxRuntime:  flags.maxRuntime,
+      dryRun:      flags.dryRun,
+      detach:      flags.detach,
+    }, chalk);
+  }
+
   if (!resolveVmSize(flags, agentName, chalk)) {
     process.exitCode = 1;
     return;
@@ -282,19 +376,40 @@ async function launchAgentWorkload(config, agentName, rawArgs, chalk) {
 
   const spec = AGENT_WORKLOADS[agentName];
 
-  if (spec.provider) {
+  if (spec.provider && flags.provider) {
+    // BYOK override for a fixed-provider workload (claude → anthropic,
+    // codex → openai). Skip the managed credential flow and inject the
+    // BYOK model provider env vars instead. The apiKind determines which
+    // env var names the agent image reads (ANTHROPIC_* vs OPENAI_*).
+    const apiKind = spec.provider === 'anthropic' ? 'anthropic' : 'openai';
+    const modelEnv = await resolveModelProviderEnv(flags, chalk, apiKind);
+    if (!modelEnv) {
+      process.exitCode = 1;
+      return;
+    }
+    if (!flags.env) flags.env = [];
+    flags.env.push(...modelEnv);
+    flags.authRequired = { provider: flags.provider, status: 'connected' };
+  } else if (spec.provider) {
+    // Standard managed-credential flow: anthropic → ANTHROPIC_API_KEY,
+    // openai → OPENAI_API_KEY. Prompts inline on first use in a TTY.
     const envKey = PROVIDER_ENV_KEYS[spec.provider];
     const userSuppliedKey = flags.env?.some(kv => kv.startsWith(`${envKey}=`));
     let credential = userSuppliedKey ? null : getCredential(spec.provider);
+    flags.authRequired = { provider: spec.provider, status: credential || userSuppliedKey ? 'connected' : 'missing' };
     if (!credential && !userSuppliedKey) {
       // Missing credential no longer forces a separate `badgr connect` +
       // rerun in an interactive terminal — prompt inline and continue the
-      // same launch. Non-interactive contexts still hard-fail as before.
+      // same launch (including under --dry-run, so the dry-run preview
+      // reflects the connected state the real launch will actually use, and
+      // a follow-up real launch never needs a second prompt). Non-interactive
+      // contexts still hard-fail as before.
       credential = await resolveMissingCredential(spec.provider, chalk);
       if (!credential) {
         process.exitCode = 1;
         return;
       }
+      flags.authRequired.status = 'connected';
     }
     // An explicit --env always wins over the stored credential — never
     // append the injected default alongside a user-supplied value for the
@@ -304,10 +419,24 @@ async function launchAgentWorkload(config, agentName, rawArgs, chalk) {
       if (!flags.env) flags.env = [];
       flags.env.push(`${envKey}=${credential}`);
     }
+  } else if (flags.provider) {
+    // BYOK for cline (spec.provider is null) — injects OPENAI_API_KEY,
+    // OPENAI_BASE_URL, MODEL. The backend skips its managed model token
+    // when it sees an existing OPENAI_API_KEY (see jobs_routes.py).
+    const modelEnv = await resolveModelProviderEnv(flags, chalk, 'openai');
+    if (!modelEnv) {
+      process.exitCode = 1;
+      return;
+    }
+    if (!flags.env) flags.env = [];
+    flags.env.push(...modelEnv);
+    flags.authRequired = { provider: flags.provider, status: 'connected' };
+  } else {
+    flags.authRequired = { provider: null, status: 'none' };
   }
-  // cline has no `provider` — Badgr mints and injects its own short-lived
-  // job-scoped model token server-side (see backend jobs_routes.py); the
-  // CLI never handles or displays that token.
+  // cline with no --provider: Badgr mints a short-lived job-scoped model
+  // token server-side (see backend jobs_routes.py); the CLI never handles
+  // or displays that token. --provider switches cline to BYOK instead.
 
   const cmdArgv = spec.buildCmd(task);
   flags.cmd = displayCmd(cmdArgv);
@@ -329,6 +458,13 @@ async function launchDirectWorkload(config, workloadName, rawArgs, chalk) {
   // there's no natural-language interface to hand it to, unlike the agent
   // workloads above. Read but intentionally not passed to buildCmd().
 
+  if (flags.provider) {
+    console.error(chalk.red(`\n  ✗ --provider is not supported for \`badgr launch ${workloadName}\` — it is a test runner with no LLM component.\n`));
+    console.error(chalk.dim(`  Use \`badgr launch claude/cline/codex\` for AI agent workloads.\n`));
+    process.exitCode = 1;
+    return;
+  }
+
   if (gpuRejected) {
     console.error(chalk.red('\n  ✗ badgr launch runs on a CPU VM and does not accept --gpu.\n'));
     process.exitCode = 1;

package/src/commands/login.js

@@ -1,36 +1,91 @@
-import { input } from '@inquirer/prompts';
-import { DEFAULTS } from '../config.js';
+import { DEFAULTS, loadConfig } from '../config.js';
 import { callApi } from '../api.js';
+import { ensureLoggedIn } from '../onboarding.js';
 
-export async function loginCommand(chalk, saveConfigFn) {
+const API_KEYS_URL = 'https://aibadgr.com/dashboard/api-keys';
+
+function parseArgs(args) {
+  const flags = {};
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--key') flags.key = args[++i];
+  }
+  return flags;
+}
+
+/**
+ * badgr login             — interactive TTY: if a saved key is already
+ *                            valid, reports that and stops (no browser
+ *                            round-trip). Otherwise opens a browser login
+ *                            link and polls until it completes (same flow
+ *                            `badgr run`/`launch`/`serve`/`comfyui` trigger
+ *                            just-in-time — see onboarding.js's
+ *                            ensureLoggedIn).
+ * badgr login --key <key> — non-interactive: paste an existing key directly
+ *                            (CI, scripts, or anyone who already has one).
+ *
+ * The pasted-key path validates against a live API call before saving —
+ * a confirmed-invalid key (401/403) is never written to
+ * ~/.badgr/config.json. A network failure during validation still saves
+ * the key (with a warning), since that failure says nothing about whether
+ * the key itself is valid.
+ */
+export async function loginCommand(chalk, saveConfigFn, args = []) {
   console.log(chalk.bold('\nBadgr Login\n'));
 
-  const apiKey = await input({
-    message: 'Enter your Badgr API key:',
-    validate: v => v.trim() ? true : 'API key is required',
-  });
+  const flags = parseArgs(args);
 
-  const config = saveConfigFn({
-    apiKey: apiKey.trim(),
-    baseUrl: DEFAULTS.baseUrl,
-  });
+  if (!flags.key) {
+    if (process.stdin.isTTY && process.stdout.isTTY) {
+      const existing = loadConfig();
+      if (existing.apiKey) {
+        try {
+          await callApi('/models', { apiKey: existing.apiKey, baseUrl: existing.baseUrl });
+          console.log(chalk.green('✓ Already logged in'));
+          console.log(chalk.dim(`  Run ${chalk.cyan('badgr login --key <value>')} to switch accounts.\n`));
+          return existing;
+        } catch (err) {
+          if (err.httpStatus !== 401 && err.httpStatus !== 403) {
+            console.log(chalk.yellow('  ⚠ Could not reach the API to confirm the saved key — logging in again.'));
+          }
+          // Confirmed-invalid or unverifiable — fall through to re-auth below.
+        }
+      }
 
-  console.log(chalk.green('\n✓ Logged in'));
-  console.log(chalk.dim(`  Config saved to ~/.badgr/config.json`));
+      const config = await ensureLoggedIn({ ...DEFAULTS }, chalk);
+      console.log(chalk.dim(`  Run ${chalk.cyan('badgr run python train.py')} to launch your first job.\n`));
+      return config;
+    }
+
+    console.error(chalk.red('\n  ✗ --key <value> is required in non-interactive mode.\n'));
+    console.error(chalk.dim(`  Get an API key: ${API_KEYS_URL}`));
+    console.error(chalk.dim('  Example: badgr login --key bdgr_...\n'));
+    process.exitCode = 1;
+    return null;
+  }
+
+  const apiKey = flags.key.trim();
+  if (!apiKey) {
+    console.error(chalk.red('\n  ✗ API key is required.\n'));
+    process.exitCode = 1;
+    return null;
+  }
 
-  // Verify the key works against the live API
   try {
-    await callApi('/models', { apiKey: config.apiKey, baseUrl: config.baseUrl });
-    console.log(chalk.green('✓ API reachable'));
-    console.log(chalk.green('✓ API key valid\n'));
+    await callApi('/models', { apiKey, baseUrl: DEFAULTS.baseUrl });
   } catch (err) {
     if (err.httpStatus === 401 || err.httpStatus === 403) {
-      console.log(chalk.yellow('⚠ API key may be invalid — double-check and run badgr login again\n'));
-    } else {
-      console.log(chalk.yellow('⚠ Could not reach the API right now — check your internet connection\n'));
+      console.error(chalk.red('\n  ✗ That API key was rejected — not saved.'));
+      console.error(chalk.dim(`  Get a valid key: ${API_KEYS_URL}\n`));
+      process.exitCode = 1;
+      return null;
     }
+    console.log(chalk.yellow('\n  ⚠ Could not reach the API to verify the key right now — saving anyway.'));
   }
 
+  const config = saveConfigFn({ apiKey, baseUrl: DEFAULTS.baseUrl });
+
+  console.log(chalk.green('\n✓ Logged in'));
+  console.log(chalk.dim(`  Config saved to ~/.badgr/config.json`));
   console.log(chalk.dim(`  Run ${chalk.cyan('badgr run python train.py')} to launch your first job.\n`));
   return config;
 }