badgr-cli 1.1.4 → 1.1.5

package/src/commands/serve.js

@@ -3,7 +3,7 @@ import { callApi, listDeployments } from '../api.js';
 import { addDeployment, addReceipt, updateReceipt, generateReceiptId } from '../store.js';
 import { normalizeTier, callWithFallback } from '../fallback.js';
 import { formatCliError } from '../errors.js';
-import { requireApiKey } from '../config.js';
+import { requireApiKey, webBaseUrl } from '../config.js';
 import { parseEnvFlag } from '../envFlag.js';
 import { TEMPLATE_MAP, buildTemplateFlags, parseTemplateOverrides, BLESSED_VLLM_MODELS, isLikelyGatedModel } from '../catalog.js';
 import { stage as _stage, stageDone as _stageDone, writeBlock as _writeBlock, clearBlock as _clearBlock, renderLiveBlock as _renderLiveBlock, printFailureClass as _printFailureClass, printCapacityPreview, formatTierLabel } from '../progress.js';
@@ -65,11 +65,19 @@ function envObjHasHfToken(envList) {
 }
 
 // Extract a parameter-count-in-billions hint from a model/file name, e.g.
-// "Qwen2.5-0.5B-Instruct" → 0.5, "Llama-3.1-8B-Instruct" → 8, "Mixtral-8x7B" → 56.
+// "Qwen2.5-0.5B-Instruct" → 0.5, "Llama-3.1-8B-Instruct" → 8, "Mixtral-8x7B" → 56,
+// "facebook/opt-125m" → 0.125 (an "M" suffix means millions, not billions --
+// omitting this previously meant every sub-1B-parameter model name came back
+// with no size hint at all, silently falling through to the generic 7B-8B
+// default below).
 // Splits into delimiter-bounded segments first so a version number like "2.5"
 // in "Qwen2.5-0.5B" is never mistaken for the param count — only a segment that
-// IS entirely "<digits>b" or "<digits>x<digits>b" counts as a size hint.
-function _extractParamsB(name) {
+// IS entirely "<digits>b"/"<digits>m" or "<digits>x<digits>b" counts as a size
+// hint. Mirrors backend/workload_profile.py's own `_extract_params_b` --
+// keep the two in sync; a drift between them means this CLI preview and the
+// backend's real GPU selection could show a different workload class for
+// the same model.
+export function _extractParamsB(name) {
   const s = name.toLowerCase();
   const segments = s.split(/[^a-z0-9.]+/).filter(Boolean);
   for (const seg of segments) {
@@ -80,16 +88,26 @@ function _extractParamsB(name) {
     const m = seg.match(/^(\d+(?:\.\d+)?)b$/);
     if (m) return parseFloat(m[1]);
   }
+  for (const seg of segments) {
+    const m = seg.match(/^(\d+(?:\.\d+)?)m$/);
+    if (m) return parseFloat(m[1]) / 1000;
+  }
   return null;
 }
 
 // Mirror of backend workload_profile.py infer_profile_from_model — for pre-flight display.
 // Sizing is only asserted when a param-count hint is found in the name; unknown
 // sizing falls back to the 7B–8B/24GB+ default rather than guessing small or large.
-function _inferServeProfile(modelName) {
+// GPU lists match workload_profile.py's real preferred_gpus for each profile
+// (not just a cosmetic display choice) -- "L4" previously appeared in the
+// ≤3B bucket here but is not an actual GPU type this codebase ever routes to
+// (see overflow_providers.py's GPU catalog), so it never matched anything
+// real; the cheapest-available-first list below is the one the backend's
+// own "inference_tiny" profile actually searches.
+export function _inferServeProfile(modelName) {
   const paramsB = _extractParamsB(modelName);
   if (paramsB === null) return { label: 'inference (7B–8B model)', vram: '24+ GB', gpus: ['RTX 4090', 'A6000', 'L40S'] };
-  if (paramsB <= 3)    return { label: 'inference (≤3B model)',    vram: '8+ GB',  gpus: ['RTX 3090', 'RTX 4090', 'L4'] };
+  if (paramsB <= 3)    return { label: 'inference (≤3B model)',    vram: '8+ GB',  gpus: ['RTX 3080', 'RTX 3090', 'RTX 4090'] };
   if (paramsB <= 9)    return { label: 'inference (7B–8B model)', vram: '24+ GB', gpus: ['RTX 4090', 'A6000', 'L40S'] };
   if (paramsB <= 35)   return { label: 'inference (30B–34B model)', vram: '40+ GB', gpus: ['A6000', 'L40S', 'A100'] };
   return                      { label: 'inference (70B+ model)',    vram: '80+ GB', gpus: ['H100', 'A100'] };
@@ -176,7 +194,7 @@ async function waitForEndpoint(deploymentId, config, timeoutMs = VLLM_SERVE_WAIT
       const spend   = costPerHour * (elapsed / 3600);
 
       blockLines = _writeBlock(blockLines, _renderLiveBlock(chalk, {
-        stageLine, elapsedSec: elapsed, statusWord, spend, id: deploymentId,
+        stageLine, elapsedSec: elapsed, statusWord, spend, id: deploymentId, maxCost,
       }));
     } catch {
       // status check failed (transient network/API issue) — retry next tick
@@ -428,16 +446,52 @@ export async function serveCommand(config, args, chalk) {
     return;
   }
 
-  // Endpoints bill continuously — require explicit cost control.
+  // Endpoints bill continuously — require explicit cost control. In an
+  // interactive terminal, ask for it right here instead of forcing a whole
+  // re-run of the command — but never invent consent: a non-TTY context
+  // (CI, piped input) or a cancelled/empty prompt still hard-fails exactly
+  // as before, and provisioning never starts without an explicit answer.
   if (!flags.maxCost && !flags.persistent && !flags.dryRun) {
     const example = model || (customImage ? '--image ...' : '<model>');
-    console.error(chalk.red('\n  ✗ Endpoints bill continuously until stopped. Specify a spending limit:\n'));
-    console.error(chalk.dim(`    --max-cost 5           auto-stop when $5 is reached`));
-    console.error(chalk.dim(`    --persistent           run until you stop it manually\n`));
-    console.error(chalk.dim(`  Example:`));
-    console.error(chalk.dim(`    badgr serve ${example} --max-cost 10\n`));
-    process.exitCode = 1;
-    return;
+    const failHard = () => {
+      console.error(chalk.red('\n  ✗ Endpoints bill continuously until stopped. Specify a spending limit:\n'));
+      console.error(chalk.dim(`    --max-cost 5           auto-stop when $5 is reached`));
+      console.error(chalk.dim(`    --persistent           run until you stop it manually\n`));
+      console.error(chalk.dim(`  Example:`));
+      console.error(chalk.dim(`    badgr serve ${example} --max-cost 10\n`));
+      process.exitCode = 1;
+    };
+
+    if (!process.stdin.isTTY) {
+      failHard();
+      return;
+    }
+
+    console.log(chalk.yellow('\n  Endpoints bill continuously until stopped — no spending limit was given.'));
+    const { createInterface } = await import('readline');
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise(resolve => {
+      rl.question(
+        chalk.dim('  Enter a max spend in USD to auto-stop, or "persistent" to run until you stop it manually [Ctrl+C to cancel]: $'),
+        resolve,
+      );
+    });
+    rl.close();
+
+    const trimmed = answer.trim();
+    if (/^p(ersistent)?$/i.test(trimmed)) {
+      flags.persistent = true;
+      console.log(chalk.dim('  Running persistent — stop billing with `badgr down`.\n'));
+    } else {
+      const parsed = parseFloat(trimmed);
+      if (!trimmed || !Number.isFinite(parsed) || parsed <= 0) {
+        console.log(chalk.dim('\n  No valid answer given — not provisioning.\n'));
+        failHard();
+        return;
+      }
+      flags.maxCost = parsed;
+      console.log(chalk.dim(`  Max spend set to $${parsed.toFixed(2)}.\n`));
+    }
   }
 
   const envObj = parseEnvFlag(flags.env);
@@ -580,6 +634,14 @@ export async function serveCommand(config, args, chalk) {
     };
   }
 
+  // `/serve` is a single synchronous call that blocks until routing,
+  // provisioning, and runtime startup have all either succeeded or failed
+  // server-side -- there is no live per-provider stage feed to poll during
+  // it (that would need an async two-phase API this endpoint doesn't have
+  // yet), so this is a plain pending indicator, not a progress bar.
+  console.log(chalk.dim(`  Maximum spend: ${flags.maxCost ? `$${flags.maxCost.toFixed(2)}` : 'none (persistent)'}`));
+  console.log(chalk.dim('  Routing and provisioning...'));
+
   let dep;
   try {
     dep = await callWithFallback(
@@ -767,6 +829,11 @@ export async function serveCommand(config, args, chalk) {
   if (customImage)        console.log(`  ${chalk.bold('Image:')}        ${customImage}`);
   if (flags.maxCost) console.log(`  ${chalk.bold('Max cost:')}     $${flags.maxCost.toFixed(2)}`);
   if (flags.idleTimeout) console.log(`  ${chalk.bold('Idle timeout:')} ${flags.idleTimeout}m (auto-stops if idle — see Heartbeat below)`);
+  // A `serve` endpoint keeps running (and billing) after this command
+  // returns, unlike a finite `badgr run` job -- so this is the one place a
+  // management link matters: the customer needs a way back to it later
+  // that isn't re-running this exact command from shell history.
+  console.log(`  ${chalk.bold('Manage:')}       ${chalk.cyan(`${webBaseUrl(config)}/dashboard/jobs/${dep.deployment_id}`)}`);
   console.log(`  ${chalk.bold('Logs:')}         badgr logs ${dep.deployment_id}`);
   console.log(`  ${chalk.bold('Restart:')}      badgr restart ${dep.deployment_id}`);
   console.log(`  ${chalk.bold('Stop billing:')} ${chalk.cyan(`badgr down ${dep.deployment_id}`)}`);

package/src/commands/shell.js

@@ -1,11 +1,11 @@
 import { findCheapest, findById } from '../router.js';
-import { requireApiKey } from '../config.js';
+import { ensureBadgrReady } from '../onboarding.js';
 
 export async function shellCommand(config, args, chalk) {
   const gpuFlag = args.indexOf('--gpu');
   const gpuId = gpuFlag !== -1 ? args[gpuFlag + 1] : null;
 
-  requireApiKey(config);
+  config = await ensureBadgrReady(config, chalk);
 
   const gpu = gpuId ? findById(gpuId) : findCheapest({ tag: 'dev' });
 

package/src/commands/status.js

@@ -1,9 +1,32 @@
 import { listDeployments as localDeployments } from '../store.js';
-import { listDeployments as apiDeployments } from '../api.js';
+import { listDeployments as apiDeployments, listAllActiveDeploymentsAdmin } from '../api.js';
 
 export async function statusCommand(config, args, chalk) {
+  const isAdmin = args.includes('--admin');
   let deployments = [];
 
+  if (isAdmin) {
+    // Admin-only (michaelhireitem@gmail.com): every user's active
+    // deployments, not just the caller's own -- see
+    // deployment_routes.py's GET /v1/admin/deployments/active. A non-admin
+    // account gets a plain 403 here, same as any other access-denied call.
+    if (!config.apiKey) {
+      console.log(chalk.red('\n  Sign in required: badgr login\n'));
+      return;
+    }
+    try {
+      const data = await listAllActiveDeploymentsAdmin(config);
+      deployments = data?.deployments ?? [];
+    } catch (err) {
+      console.log(chalk.red(`\n  Could not fetch admin status: ${err.message}\n`));
+      return;
+    }
+    // Already active/non-terminal on arrival (the backend route only
+    // returns those) -- no client-side terminal-status filter needed here
+    // the way the plain (own-account) listing below has to apply.
+    return _printDeploymentList(deployments, chalk, { admin: true });
+  }
+
   if (config.apiKey) {
     try {
       const data = await apiDeployments(config);
@@ -46,25 +69,43 @@ export async function statusCommand(config, args, chalk) {
   const TERMINAL_STATUSES = new Set(['completed', 'succeeded', 'success', 'failed', 'stopped']);
   const running = deployments.filter(d => !TERMINAL_STATUSES.has(d.status));
 
-  if (running.length === 0) {
-    console.log(chalk.dim('\n  Nothing running.\n'));
-    console.log(chalk.dim('  badgr run python train.py'));
-    console.log(chalk.dim('  badgr serve meta-llama/Llama-3.1-8B-Instruct\n'));
+  _printDeploymentList(running, chalk, { admin: false });
+}
+
+// Shared renderer for both the plain (own-account) and `--admin` (every
+// account) listings -- the two only ever differed in: whether an owner
+// line is shown, whether the printed `badgr down` command needs `--admin`
+// appended, the header/empty-state wording, and the badge falling back to
+// the raw status word instead of a fixed "starting" (the admin route can
+// return any non-terminal status, not just "running"/"starting"). Factored
+// into one function so those four differences are the only things that can
+// diverge, instead of the whole render (badge/GPU/rate/URL/model/billing
+// total/stop-commands) being copy-pasted per mode.
+function _printDeploymentList(deployments, chalk, { admin }) {
+  if (deployments.length === 0) {
+    console.log(admin ? chalk.dim('\n  Nothing running for any account.\n') : chalk.dim('\n  Nothing running.\n'));
+    if (!admin) {
+      console.log(chalk.dim('  badgr run python train.py'));
+      console.log(chalk.dim('  badgr serve meta-llama/Llama-3.1-8B-Instruct\n'));
+    }
     return;
   }
 
-  console.log(chalk.bold('\nRunning now:\n'));
-  for (const d of running) {
+  console.log(chalk.bold(admin ? `\nRunning now (all accounts) — ${deployments.length} deployment(s):\n` : '\nRunning now:\n'));
+  for (const d of deployments) {
     const id   = d.deployment_id || d.name;
     const type = d.workload_type === 'endpoint' ? 'endpoint' : 'job';
     const gpu  = d.gpu_type || '—';
     const rate = d.cost_per_hour > 0 ? chalk.yellow(`$${d.cost_per_hour.toFixed(2)}/hr`) : '';
     const badge = d.status === 'running'
       ? chalk.green('● running')
-      : chalk.yellow('● starting');
+      : chalk.yellow(admin ? `● ${d.status}` : '● starting');
 
     console.log(`  ${badge}  ${chalk.bold(id)}  ${type}  ${gpu}  ${rate}`);
-
+    if (admin) {
+      const owner = d.username || d.user_email || d.user_id || 'unknown user';
+      console.log(`    ${chalk.dim('User:')}   ${chalk.cyan(owner)}`);
+    }
     if (d.workload_type === 'endpoint' && d.endpoint_url) {
       console.log(`    ${chalk.dim('URL:')}    ${d.endpoint_url}`);
     }
@@ -74,16 +115,19 @@ export async function statusCommand(config, args, chalk) {
     console.log();
   }
 
-  const billable = running.filter(d => (d.cost_per_hour || 0) > 0);
+  const billable = deployments.filter(d => (d.cost_per_hour || 0) > 0);
   if (billable.length > 0) {
     const totalPerHr = billable.reduce((s, d) => s + (d.cost_per_hour || 0), 0);
-    console.log(`  ${chalk.bold('Total billing:')} ${chalk.yellow(`$${totalPerHr.toFixed(2)}/hr`)}\n`);
+    const label = admin ? 'Total billing (all accounts):' : 'Total billing:';
+    console.log(`  ${chalk.bold(label)} ${chalk.yellow(`$${totalPerHr.toFixed(2)}/hr`)}\n`);
   }
 
   console.log(chalk.bold('Stop billing:\n'));
-  for (const d of running) {
+  for (const d of deployments) {
     const id = d.deployment_id || d.name;
-    console.log(`  ${chalk.cyan(`badgr down ${id}`)}`);
+    const cmd = admin ? `badgr down ${id} --admin` : `badgr down ${id}`;
+    const ownerSuffix = admin ? `  ${chalk.dim(`(${d.username || d.user_email || d.user_id})`)}` : '';
+    console.log(`  ${chalk.cyan(cmd)}${ownerSuffix}`);
   }
   console.log();
 }

package/src/commands/test-run.js

@@ -1,4 +1,4 @@
-import { requireApiKey } from '../config.js';
+import { ensureBadgrReady } from '../onboarding.js';
 import { callApi, terminateDeployment } from '../api.js';
 import { addReceipt, generateReceiptId } from '../store.js';
 
@@ -80,7 +80,7 @@ async function pollOutputOrDone(config, depId, expected, timeoutMs) {
 }
 
 export async function testCommand(config, args, chalk) {
-  requireApiKey(config);
+  config = await ensureBadgrReady(config, chalk);
 
   const flags = parseTestArgs(Array.isArray(args) ? args : []);
   const providerKey = flags.provider ? flags.provider.toLowerCase() : 'tier1';

package/src/commands/train.js

@@ -6,7 +6,7 @@
  * Enforces a max-runtime (default 120 min) and streams logs until completion.
  */
 import { readFileSync, existsSync } from 'fs';
-import { requireApiKey } from '../config.js';
+import { ensureBadgrReady } from '../onboarding.js';
 import { addReceipt, updateReceipt, generateReceiptId } from '../store.js';
 import { normalizeTier, callWithFallback } from '../fallback.js';
 import { monitorBatchJob, fmtRuntime } from '../batch.js';
@@ -168,7 +168,7 @@ export async function trainLoraCommand(config, args, chalk) {
     return;
   }
 
-  requireApiKey(config);
+  config = await ensureBadgrReady(config, chalk);
 
   // Build dataset input field
   const input = { base_model: flags.baseModel, config_preset: flags.preset || 'small' };
@@ -304,7 +304,7 @@ export async function trainCommand(config, args, chalk) {
     return;
   }
 
-  requireApiKey(config);
+  config = await ensureBadgrReady(config, chalk);
 
   if (!existsSync(configFile)) {
     console.error(chalk.red(`\n  ✗ Config file not found: ${configFile}\n`));

package/src/commands/transcribe.js

@@ -6,7 +6,7 @@
  * Transcript appears in streaming logs and is written to stdout by the container.
  */
 import { readFileSync, existsSync, statSync } from 'fs';
-import { requireApiKey } from '../config.js';
+import { ensureBadgrReady } from '../onboarding.js';
 import { addReceipt, generateReceiptId } from '../store.js';
 import { normalizeTier, callWithFallback } from '../fallback.js';
 import { monitorBatchJob, fmtRuntime } from '../batch.js';
@@ -85,7 +85,7 @@ export async function transcribeCommand(config, args, chalk) {
     return;
   }
 
-  requireApiKey(config);
+  config = await ensureBadgrReady(config, chalk);
 
   const resolved = resolveAudioInput(input);
   if (resolved.error) {

package/src/commands/up.js

@@ -1,5 +1,6 @@
 import { parseSpec, validateSpec, specLines } from '../spec.js';
 import { requireApiKey } from '../config.js';
+import { ensureBadgrReady } from '../onboarding.js';
 import { generateDeploymentId, generateReceiptId, addDeployment, addReceipt } from '../store.js';
 import { createDeployment, callApi } from '../api.js';
 
@@ -64,7 +65,7 @@ export async function upCommand(config, args, chalk) {
   }
 
   // ── Provision via backend API ─────────────────────────────────────────────
-  requireApiKey(config);
+  config = await ensureBadgrReady(config, chalk);
 
   console.log(chalk.bold('\n🚀 Provisioning\n'));
   console.log(chalk.bold('  Spec'));

package/src/config.js

@@ -29,6 +29,25 @@ export function normalizeBaseUrl(url) {
   return trimmed.endsWith('/v1') ? trimmed : `${trimmed}/v1`;
 }
 
+const DEFAULT_WEB_URL = 'https://aibadgr.com';
+const LOCAL_WEB_URL = 'http://localhost:3000';
+
+// The frontend origin to link out to (Run page, evidence/repro page, etc).
+// start-local.sh points config.baseUrl at http://localhost:8000/v1 so the
+// CLI's API calls hit the local backend; when it does, links the CLI prints
+// should point at the local frontend (localhost:3000) too, not production.
+export function webBaseUrl(config) {
+  const envWeb = process.env.BADGR_WEB_URL?.trim().replace(/\/+$/, '');
+  if (envWeb) return envWeb;
+  try {
+    const { hostname } = new URL(config?.baseUrl || DEFAULTS.baseUrl);
+    if (hostname === 'localhost' || hostname === '127.0.0.1') return LOCAL_WEB_URL;
+  } catch {
+    // fall through to the default below
+  }
+  return DEFAULT_WEB_URL;
+}
+
 function applyEnvOverrides(config) {
   const envBase = process.env.BADGR_API_URL?.trim();
   if (envBase) config.baseUrl = normalizeBaseUrl(envBase);

package/src/deploymentLog.js

@@ -0,0 +1,45 @@
+// Shared customer-facing filtering for `/deployments/{id}/logs` lines.
+//
+// The backend (DeploymentService.get_logs()) already keeps provider names,
+// pod IDs, and raw provider status out of what it returns for a finite job
+// once it's ready or finished -- the one exception is while readiness is
+// still being actively probed (health_path set, not yet ready), where the
+// same provider_status=/uptime= evidence is deliberately included, since
+// that's exactly the window where "pod alive but app not answering" vs.
+// "stuck in a crash loop" needs telling apart. This module is the
+// client-side half either way: structured `[dep-...] field=value`
+// meta-lines carry state the CLI renders elsewhere (status bar, SSH line),
+// so they're suppressed from the printed log stream. Kept in one place so
+// `badgr run`/`badgr launch` (live streaming) and `badgr logs` (fetch/follow)
+// can't drift on which fields they hide.
+
+// Structured `[dep-...] field=value` lines rendered elsewhere, not printed as log text.
+export const DEPLOYMENT_META_LOG_RE =
+  /^\[dep-[^\]]+\] (status|gpu|region|endpoint|cost|receipt|provider_status|uptime)=/;
+
+// Inline provider-status fields that can appear embedded in a line rather than
+// as a whole `[dep-...] field=value` meta-line.
+const INLINE_PROVIDER_FIELD_RE = /\b(gpu_util|cpu_util|provider_status|uptime)=/;
+
+export function isMetaLogLine(line) {
+  return DEPLOYMENT_META_LOG_RE.test(line) || INLINE_PROVIDER_FIELD_RE.test(line);
+}
+
+export function isErrorLogLine(line) {
+  return /^error\b/i.test(line) || /Error response from daemon/i.test(line);
+}
+
+// Extract structured values from provider-status lines so the CLI can show
+// them nicely (e.g. the SSH line in `badgr run`'s status bar).
+export function parseProviderStatusLine(line) {
+  const gpuUtil = line.match(/\bgpu_util=([\d.]+)%/);
+  const cpuUtil = line.match(/\bcpu_util=([\d.]+)%/);
+  const ssh     = line.match(/\bssh=(\S+)/);
+  const provSt  = line.match(/\bprovider_status=(\S+)/);
+  return {
+    gpuUtil: gpuUtil ? parseFloat(gpuUtil[1]) : null,
+    cpuUtil: cpuUtil ? parseFloat(cpuUtil[1]) : null,
+    ssh: ssh ? ssh[1] : null,
+    providerStatus: provSt ? provSt[1] : null,
+  };
+}

package/src/errors.js

@@ -60,12 +60,16 @@ export const CATALOG = {
       ctx.failure_category === 'compat_failure'
         ? 'GPU/CUDA driver incompatibility — the container requires a CUDA version this GPU does not support.'
         : 'GPU was reserved but the container failed to start.',
-    billing:  'never_started',
-    retried:  true,
+    // A real resource was reserved (the message says so) before this
+    // failed -- billing exposure was real, never "never_started". See
+    // fallback.js's own comment on why this code no longer triggers a
+    // client-side resubmission either.
+    billing:  'check_receipt',
+    retried:  false,
     hint: (ctx) =>
       ctx.failure_category === 'compat_failure'
         ? ['Try a different base image or a different --gpu type.']
-        : ['Badgr retried once. Please try again, or try a different --gpu type.'],
+        : ['Please try again, or try a different --gpu type.'],
     severity: 'P2',
   },
 

package/src/fallback.js

@@ -31,7 +31,7 @@ export class CapacityError extends Error {
 }
 
 /**
- * Call an API endpoint with automatic tier-2 expansion when tier-1 fails.
+ * Submit one deployment. Provider and tier fallback are backend-owned.
  * Returns the deployment object on success.
  * Throws CapacityError (pre-formatted for display) on unrecoverable failure.
  * Re-throws payment errors (err.isPaymentRequired) for callers to handle.
@@ -42,18 +42,11 @@ export class CapacityError extends Error {
  * @param {string}   effectiveTier
  * @param {object}   chalk
  * @param {object}   labels            - { thing: 'job'|'endpoint', cmd: 'badgr run'|'badgr serve' }
- * @param {object}   [opts]
- * @param {boolean}  [opts.allowTier2Fallback=true] - set false to disable tier-2 expansion
- * @param {boolean}  [opts.singleAttempt=false] - set true to skip both the same-tier
- *   provider retry and tier-2 expansion, failing immediately on the first error
- *   (badgr run --smoke's "one attempt" guarantee)
  */
-export async function callWithFallback(endpoint, callOpts, buildBody, effectiveTier, chalk, labels, opts = {}) {
+export async function callWithFallback(endpoint, callOpts, buildBody, effectiveTier, chalk, labels) {
   const { callApi } = await import('./api.js');
   const thing = labels?.thing ?? 'job';
   const cmd   = labels?.cmd   ?? 'badgr run';
-  const singleAttempt = opts.singleAttempt === true;
-  const allowTier2Fallback = !singleAttempt && opts.allowTier2Fallback !== false; // default true
 
   // 220s: comfortably above backend's BADGR_PROVISION_TIMEOUT_SECONDS (default
   // 200s, itself set above deployment_service.py's 180s routing-search
@@ -122,31 +115,58 @@ export async function callWithFallback(endpoint, callOpts, buildBody, effectiveT
     firstErr = err;
   }
 
-  const d = firstErr.errorData;
-
-  // Provider retry: PROVISIONING_FAILED means the selected provider couldn't launch the slot.
-  // Retry once with prefer_different_provider so the backend routes to a different provider
-  // (e.g. RunPod failed → try Vast.ai or Hyperstack) within the same max_cost budget.
-  if (!singleAttempt && (d?.code === 'PROVISIONING_FAILED' || d?.code === 'PROVIDER_ADAPTER_ERROR')) {
-    console.log(chalk.dim('\n  Provider unavailable — trying alternative provider...\n'));
-    try {
-      const retryBody = { ...buildBody(), prefer_different_provider: true };
-      return await attempt(retryBody);
-    } catch (retryErr) {
-      if (retryErr.isPaymentRequired) throw retryErr;
-      firstErr = retryErr;
+  // A stale/expired/revoked API key is not capacity trouble — the request
+  // never got past auth, so retrying against another provider or expanding
+  // to tier-2 can't help and just prints misleading "expanding search"
+  // language over a problem those retries cannot fix. Short-circuit before
+  // any fallback attempt — but in an interactive terminal, "short-circuit"
+  // means offering the same browser login-and-resume flow every other
+  // auth failure gets, not just printing a hint and exiting: the person is
+  // sitting right there. Retry exactly once with the fresh key; a repeat
+  // 401/403 (or non-interactive/CI) falls through to the plain AUTH_FAILED
+  // message, same as before this existed.
+  if (firstErr.httpStatus === 401 || firstErr.httpStatus === 403) {
+    if (process.stdin.isTTY && process.stdout.isTTY) {
+      try {
+        const { ensureLoggedIn } = await import('./onboarding.js');
+        console.log(chalk.yellow('\n  Your saved API key was rejected. Signing in again...'));
+        const fresh = await ensureLoggedIn({ apiKey: callOpts.apiKey, baseUrl: callOpts.baseUrl }, chalk);
+        callOpts.apiKey = fresh.apiKey;
+        return await attempt(buildBody());
+      } catch (retryErr) {
+        if (retryErr.isPaymentRequired) throw retryErr;
+        // Falls through to the same AUTH_FAILED message below, whether the
+        // re-login itself failed or the retried request 401/403'd again.
+      }
     }
+    throw new CapacityError(formatCliError('AUTH_FAILED', {}, chalk));
   }
 
-  // Tier-2 expansion: try budget-tier providers whenever tier-1 fails
-  if (effectiveTier !== '2' && allowTier2Fallback) {
-    console.log(chalk.dim('\n  Primary capacity unavailable — expanding search...\n'));
-    try {
-      return await attempt(buildBody('2'));
-    } catch (err2) {
-      throw buildCapacityError(err2, true);
-    }
-  }
+  const d = firstErr.errorData;
+
+  // No client-side "provider retry" here on purpose. The backend
+  // (reliability_engine.py / deployment_service.py's legacy provisioning
+  // loop) already tries every viable provider/offer for a request within
+  // the ONE deployment it creates before ever returning a failure -- a
+  // PROVISIONING_FAILED/PROVIDER_ADAPTER_ERROR response means that whole
+  // internal search already ran and a real, billable resource was very
+  // likely created and destroyed along the way (see deployment_service.
+  // _reliability_result_failure_reason and the legacy loop's own
+  // smoke-check-failure path, both of which only report these codes once
+  // a resource actually existed). A second /run or /serve call here would
+  // be an entirely new deployment repeating that same internal search from
+  // scratch -- duplicate billable exposure for a workload that was never a
+  // capacity problem in the first place. This CLI previously did retry
+  // once here with a `prefer_different_provider` flag the backend never
+  // actually reads (dead parameter, verified against the API source) --
+  // that retry never changed routing behavior, it just doubled exposure.
+  // A truthful WORKLOAD_START_FAILED/COMMAND_NOT_FOUND response (see
+  // serverToKey below) isn't even reachable here -- CapacityError is only
+  // for the capacity-flavored codes this function's own contract covers.
+
+  // The backend owns all provider and tier expansion for the deployment.
+  // Even NO_CAPACITY is terminal for this one submission: a second POST
+  // would create a second deployment id and split cleanup/audit ownership.
 
   throw buildCapacityError(firstErr, false);
 }

package/src/onboarding.js

@@ -115,17 +115,76 @@ async function ensureFunded(config, chalk) {
   console.log(chalk.green('\n  ✓ Payment confirmed\n'));
 }
 
-export async function ensureBadgrReady(config, chalk) {
+/**
+ * Just-in-time login only, no funding gate — for commands that manage or
+ * inspect an *existing* resource (stop it, read its logs, download its
+ * artifacts, reset its idle timer) rather than provisioning new spend.
+ * Critically, `badgr down` must never be blocked behind "add funds first" —
+ * a $0-balance user with a still-running deployment needs to be able to
+ * stop it without a funding detour. Same browser-login-and-resume flow as
+ * ensureBadgrReady, just without the ensureFunded step.
+ */
+export async function ensureLoggedInReady(config, chalk) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     // No human to click a browser link — fail fast with the existing message.
     requireApiKey(config);
     return config;
   }
+  if (!config.apiKey) {
+    return ensureLoggedIn(config, chalk);
+  }
+  return config;
+}
 
-  let cfg = config;
-  if (!cfg.apiKey) {
-    cfg = await ensureLoggedIn(cfg, chalk);
+/**
+ * Login + funding gate — for commands that provision new spend (run,
+ * serve, comfyui, launch/job, batch run, train, transcribe, embed, deploy,
+ * shell, sbatch, up). Reuses ensureLoggedInReady for the login half so
+ * there is exactly one login flow, not two.
+ */
+export async function ensureBadgrReady(config, chalk) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    // No human to click a browser link — fail fast with the existing
+    // message, same as ensureLoggedInReady, and skip ensureFunded too:
+    // there's no one to click the billing checkout link either.
+    requireApiKey(config);
+    return config;
   }
+  const cfg = await ensureLoggedInReady(config, chalk);
   await ensureFunded(cfg, chalk);
   return cfg;
 }
+
+/**
+ * Both ensureLoggedInReady and ensureBadgrReady only ever check whether a
+ * key is *configured* -- neither can tell a stored key is stale/expired/
+ * revoked without actually calling the API, so a command with a bad saved
+ * key sailed straight past both checks and only found out from the real
+ * request's own 401, which every command before this helper just printed
+ * ("Invalid API key ... run: badgr login") and exited. That's a dead end
+ * for the exact case ensureLoggedInReady/ensureBadgrReady exist to avoid:
+ * the person is sitting right there at an interactive terminal.
+ *
+ * withReauthRetry(config, chalk, fn) calls fn(config) once; on a 401/403
+ * in an interactive TTY, it opens the same browser login link
+ * ensureLoggedIn always has, waits for it, then retries fn exactly once
+ * with the fresh key. Any other error (including a repeat 401/403 after a
+ * successful re-login, or non-interactive/CI) is re-thrown unchanged for
+ * the caller's own existing error handling.
+ *
+ * Returns { config, result } -- callers should keep using the returned
+ * config (not their original variable) for anything they do afterward, so
+ * a refreshed key from a mid-command reauth is actually used for the rest
+ * of that same run instead of only being picked up by the next command.
+ */
+export async function withReauthRetry(config, chalk, fn) {
+  try {
+    return { config, result: await fn(config) };
+  } catch (err) {
+    if (err.httpStatus !== 401 && err.httpStatus !== 403) throw err;
+    if (!process.stdin.isTTY || !process.stdout.isTTY) throw err;
+    console.log(chalk.yellow('\n  Your saved API key was rejected. Signing in again...'));
+    const freshConfig = await ensureLoggedIn(config, chalk);
+    return { config: freshConfig, result: await fn(freshConfig) };
+  }
+}