llm-relay 0.44.0 → 0.45.1

package/dist/cli.js

@@ -33,6 +33,7 @@ import { DASHBOARD_MEDIA_TYPE, isDashboardUtcTimestamp } from "./dashboard-contr
 import { DASHBOARD_BOOTSTRAP_SCHEMA, DASHBOARD_BOOTSTRAP_REQUEST_SCHEMA } from "./dashboard-routes.js";
 import { flushRuntimeTelemetry } from "./ping/runtime-telemetry.js";
 import { flushProbeCache } from "./ping/probe-cache.js";
+import { runKeysAddLocal, runKeysDisableLocal, runKeysEnableLocal, runKeysExportLocal, runKeysImportLocal, runKeysListLocal, runKeysRemoveLocal, runKeysRevokeLocal, runKeysRotateLocal, runKeysUnlockLocal, } from "./keys-cli.js";
 const VALUE_FLAGS = new Set([
     "--config", "-config", "-c",
     "--provider", "-provider", "-p",
@@ -63,6 +64,9 @@ const VALUE_FLAGS = new Set([
     "--reset-field", "-reset-field",
     "--reset-ms", "-reset-ms",
     "--import", "-import",
+    "--label", "-label",
+    "--env-name", "-env-name",
+    "--out", "-out",
 ]);
 let cachedArgv;
 let cachedParsedArgs;
@@ -158,7 +162,8 @@ ${formatTextTable([
     ["llm-relay [options]", "Start proxy."],
     ["llm-relay onboard [--import <file>] [--force]", "Set up or import provider keys."],
     ["llm-relay setup [target]", "target: claude-cli | claude-desktop."],
-    ["llm-relay keys | check-keys", "Check every configured credential slot."],
+    ["llm-relay keys | keys check | check-keys", "Check every configured credential slot."],
+    ["llm-relay keys <action> ...", "action: add|list|rotate|revoke|remove|disable|enable|export|import|unlock."],
     ["llm-relay pools [--probe]", "List members; --probe tests each deployment once."],
     ["llm-relay pools <action> <name> [<spec>...]", "action: set|add|remove|delete."],
     ["llm-relay routing <action> ...", "action: show|get|default|tier|subagent|sort|benchmark|set|unset."],
@@ -669,6 +674,43 @@ export async function runCheckKeys() {
     ];
     process.stdout.write(formatTextTable(rows) + "\n");
 }
+/** `llm-relay keys add` — CLI-local credential insertion; secret input is never argv. */
+export async function runKeysAdd(provider = getPositionalArgs(process.argv)[2], deps = {}) {
+    await runKeysAddLocal(deps.config ?? loadOrExit(), provider, {
+        ...(argValue("--label", "-label") === undefined
+            ? {} : { label: argValue("--label", "-label") }),
+        ...(argValue("--env-name", "-env-name") === undefined
+            ? {} : { envName: argValue("--env-name", "-env-name") }),
+        check: hasFlag("--check", "-check"),
+    }, deps);
+}
+export async function runKeysList(deps = {}) {
+    runKeysListLocal(deps.config ?? loadOrExit(), deps);
+}
+export async function runKeysRotate(credential = getPositionalArgs(process.argv)[2], deps = {}) {
+    await runKeysRotateLocal(deps.config ?? loadOrExit(), credential, deps);
+}
+export async function runKeysRevoke(credential = getPositionalArgs(process.argv)[2], deps = {}) {
+    runKeysRevokeLocal(credential, deps);
+}
+export async function runKeysRemove(credential = getPositionalArgs(process.argv)[2], deps = {}) {
+    runKeysRemoveLocal(credential, hasFlag("--purge", "-purge"), deps);
+}
+export async function runKeysDisable(credential = getPositionalArgs(process.argv)[2], deps = {}) {
+    runKeysDisableLocal(credential, deps);
+}
+export async function runKeysEnable(credential = getPositionalArgs(process.argv)[2], deps = {}) {
+    runKeysEnableLocal(credential, deps);
+}
+export async function runKeysExport(deps = {}) {
+    await runKeysExportLocal(argValue("--out", "-out"), deps);
+}
+export async function runKeysImport(importPath = getPositionalArgs(process.argv)[2], deps = {}) {
+    await runKeysImportLocal(deps.config ?? loadOrExit(), importPath, deps);
+}
+export async function runKeysUnlock(deps = {}) {
+    await runKeysUnlockLocal(deps);
+}
 /**
  * Talk to a RUNNING proxy if there is one. The offload switch has to reach the live process to
  * take effect without a restart, and `candidates` gets better data from it (warm ping history,
@@ -2716,12 +2758,98 @@ import { importKeysFromFile } from "./key-import.js";
 import { setupClaudeCli, setupClaudeDesktop } from "./setup-claude.js";
 import { getTelemetryReport } from "./telemetry.js";
 import { globalCircuitBreaker } from "./circuit-breaker.js";
+const KEYS_SUBCOMMANDS = [
+    "add", "list", "rotate", "revoke", "remove", "disable", "enable", "export", "import",
+    "unlock", "check",
+];
+const KEYS_GLOBAL_FLAGS = ["--config", "-config", "-c"];
+const KEYS_FLAGS = {
+    add: ["--label", "-label", "--env-name", "-env-name", "--check", "-check"],
+    list: [],
+    rotate: [],
+    revoke: [],
+    remove: ["--purge", "-purge"],
+    disable: [],
+    enable: [],
+    export: ["--out", "-out"],
+    import: [],
+    unlock: [],
+    check: [],
+};
+const KEYS_POSITIONAL_COUNT = {
+    add: 3,
+    list: 2,
+    rotate: 3,
+    revoke: 3,
+    remove: 3,
+    disable: 3,
+    enable: 3,
+    export: 2,
+    import: 3,
+    unlock: 2,
+    check: 2,
+};
+/** Strict, secret-safe keys parser. Diagnostics deliberately never echo rejected argv tokens. */
+export function validateKeysCommandArgs(argv) {
+    const positionals = getPositionalArgs(argv);
+    const candidate = positionals[1];
+    if (candidate !== undefined && !KEYS_SUBCOMMANDS.includes(candidate)) {
+        return `unknown subcommand; valid subcommands: ${KEYS_SUBCOMMANDS.join(", ")}`;
+    }
+    const subcommand = candidate;
+    const allowed = new Set(KEYS_GLOBAL_FLAGS);
+    if (subcommand !== undefined) {
+        for (const flag of KEYS_FLAGS[subcommand])
+            allowed.add(flag);
+    }
+    for (let index = 2; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (arg === undefined || !arg.startsWith("-"))
+            continue;
+        const equalsAt = arg.indexOf("=");
+        const flag = equalsAt === -1 ? arg : arg.slice(0, equalsAt);
+        if (!allowed.has(flag))
+            return "unsupported option";
+        if (VALUE_FLAGS.has(flag)) {
+            if (equalsAt !== -1) {
+                if (arg.slice(equalsAt + 1).length === 0)
+                    return "invalid arguments";
+            }
+            else {
+                const value = argv[index + 1];
+                if (value === undefined || value.startsWith("-"))
+                    return "invalid arguments";
+                index += 1;
+            }
+        }
+        else if (equalsAt !== -1) {
+            return "invalid arguments";
+        }
+    }
+    const expected = subcommand === undefined ? 1 : KEYS_POSITIONAL_COUNT[subcommand];
+    return positionals.length === expected ? null : "invalid arguments";
+}
+function reportKeysCommandError(error) {
+    process.stderr.write(`llm-relay keys: ${error.message}\n`);
+    process.exit(1);
+}
+function runKeysPromise(operation) {
+    operation.catch(reportKeysCommandError);
+}
 export function main() {
     const rawCommand = rawCliCommand(process.argv);
     const positionals = getPositionalArgs(process.argv);
     const arg2 = positionals[0];
     const arg3 = positionals[1];
     const arg4 = positionals[2];
+    if (arg2 === "keys") {
+        const validationError = validateKeysCommandArgs(process.argv);
+        if (validationError !== null) {
+            process.stderr.write(`llm-relay keys: ${validationError}\n`);
+            process.exit(1);
+            return;
+        }
+    }
     // Mutation parsing owns its raw argv so help/version-shaped typos cannot bypass fail-closed
     // validation and turn a scoped clear into a wider request.
     if (rawCommand === "cooldowns" || arg2 === "cooldowns") {
@@ -2779,13 +2907,57 @@ export function main() {
         process.stdout.write(JSON.stringify(report, null, 2) + "\n");
         return;
     }
-    if (arg2 === "keys" || arg2 === "check-keys") {
+    if (arg2 === "check-keys") {
         runCheckKeys().catch((e) => {
             process.stderr.write(`llm-relay check-keys: ${e.message}\n`);
             process.exit(1);
         });
         return;
     }
+    if (arg2 === "keys") {
+        switch (arg3) {
+            case undefined:
+            case "check":
+                // Bare `keys` remains byte-for-byte the same status command as `check-keys`.
+                runCheckKeys().catch((e) => {
+                    process.stderr.write(`llm-relay check-keys: ${e.message}\n`);
+                    process.exit(1);
+                });
+                return;
+            case "add":
+                runKeysPromise(runKeysAdd(arg4));
+                return;
+            case "list":
+                runKeysPromise(runKeysList());
+                return;
+            case "rotate":
+                runKeysPromise(runKeysRotate(arg4));
+                return;
+            case "revoke":
+                runKeysPromise(runKeysRevoke(arg4));
+                return;
+            case "remove":
+                runKeysPromise(runKeysRemove(arg4));
+                return;
+            case "disable":
+                runKeysPromise(runKeysDisable(arg4));
+                return;
+            case "enable":
+                runKeysPromise(runKeysEnable(arg4));
+                return;
+            case "export":
+                runKeysPromise(runKeysExport());
+                return;
+            case "import":
+                runKeysPromise(runKeysImport(arg4));
+                return;
+            case "unlock":
+                runKeysPromise(runKeysUnlock());
+                return;
+            default:
+                throw new Error("unreachable keys subcommand after validation");
+        }
+    }
     if (arg2 === "models") {
         runModels().catch((e) => {
             process.stderr.write(`llm-relay: ${e.message}\n`);
@@ -2934,6 +3106,12 @@ export function classifyCommand(argv) {
         // Clears process-local relay state through the authenticated mutation plane.
         case "cooldowns":
             return arg3 === "clear" ? "mutating" : "read-only";
+        case "keys":
+            return arg3 === "add" || arg3 === "rotate" || arg3 === "revoke" ||
+                arg3 === "remove" || arg3 === "disable" || arg3 === "enable" ||
+                arg3 === "export" || arg3 === "import"
+                ? "mutating"
+                : "read-only";
         case "config":
             return arg3 === "set" || arg3 === "unset" ? "mutating" : "read-only";
         case "routing":
@@ -2952,7 +3130,7 @@ export function classifyCommand(argv) {
             return arg3 === "accept" || arg3 === "reject" || arg3 === "propose" ? "mutating" : "read-only";
         case "dashboard":
             return "read-only";
-        // keys, check-keys, models, telemetry, dispatch, candidates, pools, ping, help, version —
+        // check-keys, models, telemetry, dispatch, candidates, pools, ping, help, version —
         // and anything not yet listed. `dispatch -x` is included on purpose: it reports spend to a
         // running proxy's in-memory cooldowns and changes nothing on this machine.
         default:
@@ -2964,9 +3142,19 @@ export function classifyCommand(argv) {
  * and re-exec), then the command itself. `main` stays synchronous so its exit paths are direct.
  */
 export async function run() {
-    // Reject malformed mutation argv before the self-update gate can perform any network request.
-    if (rawCliCommand(process.argv) === "cooldowns")
+    // Reject malformed mutation argv before the self-update gate can perform any network request
+    // or replace the installed CLI. Keys diagnostics stay generic so rejected argv is never echoed.
+    const command = rawCliCommand(process.argv);
+    if (command === "cooldowns")
         parseCooldownClearArgs(process.argv);
+    if (command === "keys") {
+        const validationError = validateKeysCommandArgs(process.argv);
+        if (validationError !== null) {
+            process.stderr.write(`llm-relay keys: ${validationError}\n`);
+            process.exit(1);
+            return;
+        }
+    }
     if (shouldCheckUpdates(process.argv, process.env, classifyCommand(process.argv))) {
         try {
             await ensureUpToDate();