pylot-cli 0.1.2 → 0.1.4

package/dist/index.mjs

@@ -3032,6 +3032,123 @@ var require_commander = __commonJS({
   }
 });
 
+// src/lib/http.mts
+var http_exports = {};
+__export(http_exports, {
+  ApiError: () => ApiError,
+  NetworkError: () => NetworkError,
+  request: () => request
+});
+function errorMessage(status, body, cfg) {
+  const err = body && typeof body === "object" ? body : {};
+  if (status === 401) {
+    return `unauthorized \u2014 the gateway rejected your token (source: ${cfg.tokenSource}).
+hint: check 'pylot auth status'; inside a Pylot container the right token is already in the environment, otherwise export PYLOT_API_TOKEN or run 'pylot config set token <token>'`;
+  }
+  if (status === 403 && err.error === "insufficient_scope" && typeof err.required === "string") {
+    return `forbidden \u2014 your token (source: ${cfg.tokenSource}) lacks the '${err.required}' scope.
+hint: mission broker tokens can only heartbeat and mint git tokens; session tokens cannot use admin routes. Use a token with the '${err.required}' scope (an admin can mint one: pylot auth tokens create --scopes ${err.required})`;
+  }
+  const parts = [`${status}${err.error ? ` ${err.error}` : ""}`];
+  if (err.detail) parts.push(String(err.detail));
+  if (err.hint) parts.push(`hint: ${err.hint}`);
+  const extras = Object.entries(err).filter(([k]) => !["error", "detail", "hint"].includes(k));
+  if (extras.length > 0) {
+    parts.push(extras.map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" "));
+  }
+  if (!err.error && !err.detail && extras.length === 0) {
+    const text = typeof body === "string" ? body : JSON.stringify(body);
+    if (text && text !== "null") parts.push(text.slice(0, 300));
+  }
+  return `API error ${parts.join(" \u2014 ")}`;
+}
+async function request(cfg, path5, opts = {}) {
+  const method = opts.method ?? "GET";
+  const retry = opts.retry ?? method === "GET";
+  const timeoutMs = opts.timeoutMs ?? 3e4;
+  const url = new URL(cfg.baseUrl + path5);
+  for (const [k, v] of Object.entries(opts.query ?? {})) {
+    if (v !== void 0) url.searchParams.set(k, String(v));
+  }
+  const headers = {};
+  if (cfg.token) headers.authorization = `Bearer ${cfg.token}`;
+  let bodyText;
+  if (opts.rawBody !== void 0) {
+    bodyText = opts.rawBody;
+    headers["content-type"] = "text/plain; charset=utf-8";
+  } else if (opts.body !== void 0) {
+    bodyText = JSON.stringify(opts.body);
+    headers["content-type"] = "application/json";
+  }
+  const maxAttempts = retry ? RETRY_DELAYS_MS.length + 1 : 1;
+  let lastError;
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    if (attempt > 0) await new Promise((r) => setTimeout(r, RETRY_DELAYS_MS[attempt - 1]));
+    let res;
+    try {
+      res = await fetch(url, {
+        method,
+        headers,
+        body: bodyText,
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (err) {
+      lastError = err;
+      continue;
+    }
+    if (retry && RETRYABLE_STATUSES.has(res.status) && attempt < maxAttempts - 1) {
+      lastError = new ApiError(`API error ${res.status}`, res.status, null);
+      continue;
+    }
+    const text = await res.text();
+    let json = null;
+    try {
+      json = JSON.parse(text);
+    } catch {
+    }
+    const ok = res.status >= 200 && res.status < 300 || (opts.okStatuses ?? []).includes(res.status);
+    if (!ok) {
+      const apiErr = new ApiError(errorMessage(res.status, json ?? text, cfg), res.status, json ?? text);
+      const errBody = json;
+      if (res.status === 403 && errBody?.error === "insufficient_scope") apiErr.requiredScope = errBody.required;
+      throw apiErr;
+    }
+    return { status: res.status, json, text, headers: res.headers };
+  }
+  const cause = lastError instanceof Error ? lastError.message : String(lastError);
+  const maybeDelivered = method !== "GET";
+  throw new NetworkError(
+    `request failed: ${method} ${url.pathname} \u2014 ${cause}` + (maybeDelivered ? "\nhint: the request may still have been received \u2014 verify before retrying (e.g. pylot ps)" : ""),
+    maybeDelivered
+  );
+}
+var ApiError, NetworkError, RETRYABLE_STATUSES, RETRY_DELAYS_MS;
+var init_http = __esm({
+  "src/lib/http.mts"() {
+    "use strict";
+    ApiError = class extends Error {
+      status;
+      body;
+      requiredScope;
+      constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+      }
+    };
+    NetworkError = class extends Error {
+      /** True when the request may have reached the server (sent, then failed). */
+      maybeDelivered;
+      constructor(message, maybeDelivered) {
+        super(message);
+        this.maybeDelivered = maybeDelivered;
+      }
+    };
+    RETRYABLE_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
+    RETRY_DELAYS_MS = [500, 1500];
+  }
+});
+
 // node_modules/dot-prop/index.js
 function getPathSegments(path5) {
   const parts = [];
@@ -7322,7 +7439,7 @@ var require_schemes = __commonJS({
       urnComponent.nss = (uuidComponent.uuid || "").toLowerCase();
       return urnComponent;
     }
-    var http = (
+    var http2 = (
       /** @type {SchemeHandler} */
       {
         scheme: "http",
@@ -7335,7 +7452,7 @@ var require_schemes = __commonJS({
       /** @type {SchemeHandler} */
       {
         scheme: "https",
-        domainHost: http.domainHost,
+        domainHost: http2.domainHost,
         parse: httpParse,
         serialize: httpSerialize
       }
@@ -7379,7 +7496,7 @@ var require_schemes = __commonJS({
     var SCHEMES = (
       /** @type {Record<SchemeName, SchemeHandler>} */
       {
-        http,
+        http: http2,
         https,
         ws,
         wss,
@@ -14120,112 +14237,70 @@ var {
   Help
 } = import_index.default;
 
-// src/lib/http.mts
-var ApiError = class extends Error {
-  status;
-  body;
-  requiredScope;
-  constructor(message, status, body) {
-    super(message);
-    this.status = status;
-    this.body = body;
-  }
-};
-var NetworkError = class extends Error {
-  /** True when the request may have reached the server (sent, then failed). */
-  maybeDelivered;
-  constructor(message, maybeDelivered) {
-    super(message);
-    this.maybeDelivered = maybeDelivered;
-  }
-};
-var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
-var RETRY_DELAYS_MS = [500, 1500];
-function errorMessage(status, body, cfg) {
-  const err = body && typeof body === "object" ? body : {};
-  if (status === 401) {
-    return `unauthorized \u2014 the gateway rejected your token (source: ${cfg.tokenSource}).
-hint: check 'pylot auth status'; inside a Pylot container the right token is already in the environment, otherwise export PYLOT_API_TOKEN or run 'pylot config set token <token>'`;
-  }
-  if (status === 403 && err.error === "insufficient_scope" && typeof err.required === "string") {
-    return `forbidden \u2014 your token (source: ${cfg.tokenSource}) lacks the '${err.required}' scope.
-hint: mission broker tokens can only heartbeat and mint git tokens; session tokens cannot use admin routes. Use a token with the '${err.required}' scope (an admin can mint one: pylot auth tokens create --scopes ${err.required})`;
-  }
-  const parts = [`${status}${err.error ? ` ${err.error}` : ""}`];
-  if (err.detail) parts.push(String(err.detail));
-  if (err.hint) parts.push(`hint: ${err.hint}`);
-  const extras = Object.entries(err).filter(([k]) => !["error", "detail", "hint"].includes(k));
-  if (extras.length > 0) {
-    parts.push(extras.map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" "));
-  }
-  if (!err.error && !err.detail && extras.length === 0) {
-    const text = typeof body === "string" ? body : JSON.stringify(body);
-    if (text && text !== "null") parts.push(text.slice(0, 300));
-  }
-  return `API error ${parts.join(" \u2014 ")}`;
+// src/lib/output.mts
+init_http();
+
+// src/lib/config.mts
+import { readFileSync, writeFileSync as writeFileSync2, chmodSync, mkdirSync, renameSync } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join, dirname } from "node:path";
+function credentialsPath() {
+  return join(homedir2(), ".pylot", "credentials");
 }
-async function request(cfg, path5, opts = {}) {
-  const method = opts.method ?? "GET";
-  const retry = opts.retry ?? method === "GET";
-  const timeoutMs = opts.timeoutMs ?? 3e4;
-  const url = new URL(cfg.baseUrl + path5);
-  for (const [k, v] of Object.entries(opts.query ?? {})) {
-    if (v !== void 0) url.searchParams.set(k, String(v));
-  }
-  const headers = {};
-  if (cfg.token) headers.authorization = `Bearer ${cfg.token}`;
-  let bodyText;
-  if (opts.rawBody !== void 0) {
-    bodyText = opts.rawBody;
-    headers["content-type"] = "text/plain; charset=utf-8";
-  } else if (opts.body !== void 0) {
-    bodyText = JSON.stringify(opts.body);
-    headers["content-type"] = "application/json";
-  }
-  const maxAttempts = retry ? RETRY_DELAYS_MS.length + 1 : 1;
-  let lastError;
-  for (let attempt = 0; attempt < maxAttempts; attempt++) {
-    if (attempt > 0) await new Promise((r) => setTimeout(r, RETRY_DELAYS_MS[attempt - 1]));
-    let res;
-    try {
-      res = await fetch(url, {
-        method,
-        headers,
-        body: bodyText,
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-    } catch (err) {
-      lastError = err;
-      continue;
-    }
-    if (retry && RETRYABLE_STATUSES.has(res.status) && attempt < maxAttempts - 1) {
-      lastError = new ApiError(`API error ${res.status}`, res.status, null);
-      continue;
-    }
-    const text = await res.text();
-    let json = null;
-    try {
-      json = JSON.parse(text);
-    } catch {
-    }
-    const ok = res.status >= 200 && res.status < 300 || (opts.okStatuses ?? []).includes(res.status);
-    if (!ok) {
-      const apiErr = new ApiError(errorMessage(res.status, json ?? text, cfg), res.status, json ?? text);
-      const errBody = json;
-      if (res.status === 403 && errBody?.error === "insufficient_scope") apiErr.requiredScope = errBody.required;
-      throw apiErr;
+function isNearExpiry(expiresAt) {
+  if (!expiresAt) return false;
+  const t = new Date(expiresAt).getTime();
+  if (Number.isNaN(t)) return false;
+  return t - Date.now() <= 5 * 60 * 1e3;
+}
+async function refreshOrgCredential(baseUrl, org, entry) {
+  const { request: request2, ApiError: ApiError2 } = await Promise.resolve().then(() => (init_http(), http_exports));
+  const cfg = { baseUrl, token: null, tokenSource: "none", urlSource: "credentials-refresh" };
+  try {
+    const resp = await request2(cfg, "/auth/oauth/refresh", {
+      method: "POST",
+      body: { refresh_token: entry.refresh_token },
+      retry: false
+    });
+    const d = resp.json;
+    if (!d?.token || !d.refresh_token) return null;
+    return {
+      token_id: d.id,
+      token: d.token,
+      scopes: d.scopes,
+      expires_at: d.expires_at,
+      refresh_token: d.refresh_token,
+      refresh_expires_at: d.refresh_expires_at
+    };
+  } catch (err) {
+    if (err instanceof ApiError2 && err.status === 409) {
+      try {
+        const latest = readCredentials().orgs[org];
+        if (latest && latest.token !== entry.token) return latest;
+      } catch {
+      }
+      return null;
     }
-    return { status: res.status, json, text, headers: res.headers };
+    throw err;
   }
-  const cause = lastError instanceof Error ? lastError.message : String(lastError);
-  const maybeDelivered = method !== "GET";
-  throw new NetworkError(
-    `request failed: ${method} ${url.pathname} \u2014 ${cause}` + (maybeDelivered ? "\nhint: the request may still have been received \u2014 verify before retrying (e.g. pylot ps)" : ""),
-    maybeDelivered
-  );
 }
-
-// src/lib/config.mts
+function readCredentials() {
+  try {
+    const raw = readFileSync(credentialsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed.orgs === "object") return parsed;
+  } catch {
+  }
+  return { orgs: {} };
+}
+function writeCredentials(data) {
+  const path5 = credentialsPath();
+  mkdirSync(dirname(path5), { recursive: true });
+  const tmp = `${path5}.${process.pid}.tmp`;
+  writeFileSync2(tmp, JSON.stringify(data, null, 2), { encoding: "utf8", mode: 384 });
+  chmodSync(tmp, 384);
+  renameSync(tmp, path5);
+}
 var UsageError = class extends Error {
 };
 function normalizeBaseUrl(raw) {
@@ -14294,6 +14369,31 @@ async function resolveConfig(opts) {
     pickUrl(env2.PYLOT_API, "PYLOT_API");
     pickToken(await confGet("token"), "config file");
     pickUrl(await confGet("url"), "config file");
+    if (token === null) {
+      const org = opts.org ?? await confGet("org");
+      if (org) {
+        try {
+          const creds = readCredentials();
+          let entry = creds.orgs[org];
+          if (entry?.token && entry.refresh_token && baseUrl && isNearExpiry(entry.expires_at)) {
+            const rotated = await refreshOrgCredential(baseUrl, org, entry).catch(() => null);
+            if (rotated) {
+              creds.orgs[org] = rotated;
+              try {
+                writeCredentials(creds);
+              } catch {
+              }
+              entry = rotated;
+            } else if (new Date(entry.expires_at).getTime() <= Date.now()) {
+              throw new UsageError(`stored token for ${org} expired and refresh failed \u2014 run: pylot auth login`);
+            }
+          }
+          if (entry?.token) pickToken(entry.token, "credentials file");
+        } catch (err) {
+          if (err instanceof UsageError) throw err;
+        }
+      }
+    }
     if (!baseUrl) {
       throw new UsageError(
         "no gateway URL configured \u2014 set PYLOT_DISPATCH_URL / PYLOT_API_URL / PYLOT_GATEWAY_URL, pass --url, or run: pylot config set url <url>"
@@ -14375,6 +14475,7 @@ async function ctx(cmd) {
 }
 
 // src/commands/core.mts
+init_http();
 function registerCore(program3) {
   program3.command("health").description("gateway liveness, version, and counters (GET /health)").action(async (_opts, cmd) => {
     const { opts, cfg } = await ctx(cmd);
@@ -14386,6 +14487,12 @@ function registerCore(program3) {
   });
 }
 
+// src/commands/dispatch.mts
+init_http();
+
+// src/commands/missions.mts
+init_http();
+
 // src/lib/poll.mts
 var PollTimeoutError = class extends Error {
   last;
@@ -14635,8 +14742,8 @@ function registerMissions(program3) {
 async function bodyFromArgs(fields, file) {
   let body = {};
   if (file) {
-    const { readFileSync } = await import("node:fs");
-    const text = file === "-" ? readFileSync(0, "utf8") : readFileSync(file, "utf8");
+    const { readFileSync: readFileSync2 } = await import("node:fs");
+    const text = file === "-" ? readFileSync2(0, "utf8") : readFileSync2(file, "utf8");
     body = JSON.parse(text);
   }
   for (const field of fields) {
@@ -14712,6 +14819,64 @@ function registerDispatch(program3) {
 }
 
 // src/commands/auth.mts
+import * as http from "node:http";
+import * as net from "node:net";
+import { exec } from "node:child_process";
+init_http();
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? `open ${JSON.stringify(url)}` : process.platform === "win32" ? `start "" ${JSON.stringify(url)}` : `xdg-open ${JSON.stringify(url)}`;
+  exec(cmd, (err) => {
+    if (err) process.stderr.write(`[auth] could not open browser automatically.
+Open manually: ${url}
+`);
+  });
+}
+async function pickEphemeralPort() {
+  return new Promise((resolve, reject) => {
+    const srv = net.createServer();
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      srv.close((err) => {
+        if (err) reject(err);
+        else resolve(port);
+      });
+    });
+    srv.on("error", reject);
+  });
+}
+async function waitForCallback(port, timeoutMs = 3e5) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      server.close();
+      reject(new Error("timed out waiting for browser callback (5 min)"));
+    }, timeoutMs);
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+      const code = url.searchParams.get("code");
+      const error = url.searchParams.get("error");
+      const html = `<!doctype html><html><body style="font-family:sans-serif;padding:2em"><h2>You can close this tab</h2><p>Return to your terminal.</p></body></html>`;
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(html);
+      clearTimeout(timer);
+      server.close();
+      if (error) {
+        reject(new Error(`OAuth error: ${error}`));
+        return;
+      }
+      if (!code) {
+        reject(new Error("no code in callback"));
+        return;
+      }
+      resolve(code);
+    });
+    server.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
 function registerAuth(program3) {
   const auth = program3.command("auth").description("identity, tokens, and credentials");
   auth.command("status").description("who am I \u2014 token identity, scopes, and CLI config resolution (GET /auth/me)").action(async (_flags, cmd) => {
@@ -14787,12 +14952,129 @@ function registerAuth(program3) {
     const { opts, cfg } = await ctx(cmd);
     emit(opts, await request(cfg, "/bot-identity"));
   });
-  program3.command("login", { hidden: true }).description("OAuth login (not available yet \u2014 token-plane M5)").action(() => {
-    process.stderr.write(
-      "error: OAuth login is not available yet (token-plane M5, fellowship-dev/pylot#1889).\nGet a token instead:\n  - inside a Pylot container the right token is already in the environment\n  - an admin can mint one: pylot auth tokens create --org <org> --scopes dispatch,missions:read\n  - then: export PYLOT_API_TOKEN=<token>  (or: pylot config set token <token>)\n"
-    );
-    process.exit(1);
-  });
+  function isHeadless() {
+    if (process.env.SSH_TTY) return true;
+    if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) return true;
+    return false;
+  }
+  async function runDeviceLogin(flags, cmd) {
+    const parentOpts = cmd.parent?.parent?.opts() ?? cmd.parent?.opts() ?? {};
+    const rawUrl = flags.url ?? parentOpts.url ?? process.env.PYLOT_DISPATCH_URL ?? process.env.PYLOT_API_URL ?? process.env.PYLOT_GATEWAY_URL ?? process.env.PYLOT_API ?? "";
+    if (!rawUrl) throw new UsageError("no gateway URL configured \u2014 pass --url or set PYLOT_API_URL");
+    const baseUrl = normalizeBaseUrl(rawUrl);
+    const cfg = { baseUrl, token: null, tokenSource: "none", urlSource: "--url" };
+    const startResp = await request(cfg, "/auth/oauth/device/start", { method: "POST", body: {} });
+    const { user_code, verification_uri, interval: rawInterval, device_session } = startResp.json ?? {};
+    if (!user_code || !verification_uri || !device_session) throw new Error("gateway returned incomplete device-start response");
+    process.stderr.write(`
+Open in your browser:
+  ${verification_uri}
+
+Enter code: ${user_code}
+
+Waiting for authorization\u2026
+`);
+    let intervalSecs = typeof rawInterval === "number" ? rawInterval : 5;
+    const timeoutAt = Date.now() + 15 * 60 * 1e3;
+    while (Date.now() < timeoutAt) {
+      await new Promise((r) => setTimeout(r, intervalSecs * 1e3));
+      const pollResp = await request(
+        cfg,
+        "/auth/oauth/device/poll",
+        { method: "POST", body: { device_session } }
+      ).catch((err) => {
+        throw new Error(`poll failed: ${err.message}`);
+      });
+      const data = pollResp.json;
+      if (data?.slow_down) {
+        intervalSecs += 5;
+        continue;
+      }
+      if (data?.status === "pending") continue;
+      if (Array.isArray(data?.tokens)) {
+        const tokens2 = data.tokens;
+        if (tokens2.length === 0) throw new Error("gateway returned no tokens");
+        const creds = readCredentials();
+        for (const t of tokens2) {
+          creds.orgs[t.org] = {
+            token_id: t.id,
+            token: t.token,
+            scopes: t.scopes,
+            expires_at: t.expires_at,
+            ...t.refresh_token ? { refresh_token: t.refresh_token, refresh_expires_at: t.refresh_expires_at } : {}
+          };
+        }
+        writeCredentials(creds);
+        const orgList = tokens2.map((t) => t.org).join(", ");
+        if (flags.org && !tokens2.find((t) => t.org === flags.org)) {
+          process.stderr.write(`warning: --org ${flags.org} not found in returned tokens (got: ${orgList})
+`);
+        }
+        process.stdout.write(`Logged in. Tokens stored for: ${orgList}
+`);
+        process.stdout.write(`Credentials written to ~/.pylot/credentials (mode 0600)
+`);
+        if (flags.org) {
+          process.stdout.write(`Active org: ${flags.org} \u2014 use PYLOT_API_TOKEN or pylot config set org ${flags.org}
+`);
+        }
+        return;
+      }
+      throw new Error(`unexpected poll response: ${JSON.stringify(data)}`);
+    }
+    throw new Error("device code expired \u2014 run pylot auth login again");
+  }
+  async function runLogin(flags, cmd) {
+    if (flags.device || isHeadless()) return runDeviceLogin(flags, cmd);
+    const parentOpts = cmd.parent?.parent?.opts() ?? cmd.parent?.opts() ?? {};
+    const rawUrl = flags.url ?? parentOpts.url ?? process.env.PYLOT_DISPATCH_URL ?? process.env.PYLOT_API_URL ?? process.env.PYLOT_GATEWAY_URL ?? process.env.PYLOT_API ?? "";
+    if (!rawUrl) throw new UsageError("no gateway URL configured \u2014 pass --url or set PYLOT_API_URL");
+    const baseUrl = normalizeBaseUrl(rawUrl);
+    const port = await pickEphemeralPort();
+    const loginUrl = `${baseUrl}/auth/oauth/cli/login?port=${port}`;
+    process.stderr.write(`Opening browser for login\u2026
+`);
+    openBrowser(loginUrl);
+    process.stderr.write(`Waiting for browser callback on http://localhost:${port}/callback
+`);
+    process.stderr.write(`If your browser did not open, visit:
+  ${loginUrl}
+`);
+    const exchangeCode = await waitForCallback(port);
+    const cfg = { baseUrl, token: null, tokenSource: "none", urlSource: "--url" };
+    const resp = await request(cfg, "/auth/oauth/complete", {
+      method: "POST",
+      body: { code: exchangeCode }
+    });
+    const tokens2 = resp.json?.tokens ?? [];
+    if (tokens2.length === 0) throw new Error("gateway returned no tokens");
+    const creds = readCredentials();
+    for (const t of tokens2) {
+      creds.orgs[t.org] = {
+        token_id: t.id,
+        token: t.token,
+        scopes: t.scopes,
+        expires_at: t.expires_at,
+        ...t.refresh_token ? { refresh_token: t.refresh_token, refresh_expires_at: t.refresh_expires_at } : {}
+      };
+    }
+    writeCredentials(creds);
+    const orgList = tokens2.map((t) => t.org).join(", ");
+    if (flags.org && !tokens2.find((t) => t.org === flags.org)) {
+      process.stderr.write(`warning: --org ${flags.org} not found in returned tokens (got: ${orgList})
+`);
+    }
+    process.stdout.write(`Logged in. Tokens stored for: ${orgList}
+`);
+    process.stdout.write(`Credentials written to ~/.pylot/credentials (mode 0600)
+`);
+    if (flags.org) {
+      process.stdout.write(`Active org: ${flags.org} \u2014 use PYLOT_API_TOKEN or pylot config set org ${flags.org}
+`);
+    }
+  }
+  auth.command("login").description("authenticate and store per-org tokens in ~/.pylot/credentials (browser or --device for headless)").option("--org <org>", "filter stored credentials to a single org").option("--url <url>", "gateway base URL (overrides env / config)").option("--device", "use device-code flow (auto-selected in headless/SSH environments)").action(runLogin);
+  program3.command("login", { hidden: true }).description("authenticate \u2014 alias for `pylot auth login` (M5a #2145, M5b #2146)").option("--org <org>", "filter stored credentials to a single org").option("--url <url>", "gateway base URL").option("--device", "use device-code flow (auto-selected in headless/SSH environments)").action(runLogin);
 }
 
 // src/commands/config-cmd.mts
@@ -14843,6 +15125,7 @@ function registerConfig(program3) {
 }
 
 // src/commands/observability.mts
+init_http();
 function registerObservability(program3) {
   program3.command("events").description("event ledger entries (GET /events)").option("--type <type>", "filter by event type").option("--since <iso>", "events since this timestamp").option("--org <org>", "filter by org").option("--limit <n>", "max rows (server caps at 200)", (v) => parseInt(v, 10)).action(async (flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
@@ -14921,7 +15204,7 @@ function registerObservability(program3) {
     const { opts, cfg } = await ctx(cmd);
     emit(opts, await request(cfg, "/logs/router", { query: { lines: flags.lines } }));
   });
-  logs.command("admin").description("gateway Lambda CloudWatch logs by source (GET /admin/logs/:source)").argument("<source>", "api | ingress | processor | executor | notifier | scheduler | chat").option("--minutes <n>", "lookback minutes (max 180)", (v) => parseInt(v, 10)).option("--grep <pattern>", "filter pattern").option("--limit <n>", "max entries (max 1000)", (v) => parseInt(v, 10)).action(async (source, flags, cmd) => {
+  logs.command("admin").description("gateway Lambda CloudWatch logs by source (GET /admin/logs/:source)").argument("<source>", "api | ingress | processor | executor | notifier | scheduler | chat | proxy | slack-events | slack-processor").option("--minutes <n>", "lookback minutes (max 180)", (v) => parseInt(v, 10)).option("--grep <pattern>", "filter pattern").option("--limit <n>", "max entries (max 1000)", (v) => parseInt(v, 10)).action(async (source, flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
     emit(
       opts,
@@ -14943,6 +15226,7 @@ function registerObservability(program3) {
 }
 
 // src/commands/workers.mts
+init_http();
 function scopedBase(flags) {
   if (Boolean(flags.mission) === Boolean(flags.conversation)) {
     throw new UsageError("pass exactly one of --mission <id> / --conversation <id>");
@@ -14995,6 +15279,7 @@ function registerWorkers(program3) {
 }
 
 // src/commands/devboxes.mts
+init_http();
 function registerDevboxes(program3) {
   const devboxes = program3.command("devboxes").description("devbox environments (Fargate dev containers)");
   devboxes.command("projects").description("projects with devbox configs (GET /devboxes/projects)").action(async (_flags, cmd) => {
@@ -15005,9 +15290,16 @@ function registerDevboxes(program3) {
     const { opts, cfg } = await ctx(cmd);
     emit(opts, await request(cfg, `/devboxes/projects/${encodeURIComponent(project)}`));
   });
-  devboxes.command("spawn").description("spawn a devbox environment (POST /devboxes/projects/:project)").argument("<org/repo>").argument("[fields...]", "key=value pairs").option("--file <path>", "JSON body from file ('-' for stdin)").action(async (project, fields, flags, cmd) => {
+  devboxes.command("spawn").description("spawn a devbox environment (POST /devboxes/projects/:project)").argument("<org/repo>").argument("[fields...]", "key=value pairs").option("--file <path>", "JSON body from file ('-' for stdin)").option("--idle-ttl <secs>", "idle-reap TTL in seconds (0\u2013604800); 0 = never idle-reap").action(async (project, fields, flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
     const body = fields.length || flags.file ? await bodyFromArgs(fields, flags.file) : {};
+    if (flags.idleTtl != null) {
+      const secs = Number(flags.idleTtl);
+      if (!Number.isInteger(secs) || secs < 0 || secs > 604800) {
+        throw new UsageError("--idle-ttl must be an integer between 0 and 604800 (0 = never idle-reap)");
+      }
+      body.idle_ttl_secs = secs;
+    }
     emit(opts, await request(cfg, `/devboxes/projects/${encodeURIComponent(project)}`, { method: "POST", body }));
   });
   devboxes.command("list").description("running devbox environments for a project (GET /devboxes/projects/:project/list)").argument("<org/repo>").action(async (project, _flags, cmd) => {
@@ -15034,6 +15326,7 @@ function registerDevboxes(program3) {
 }
 
 // src/commands/conversations.mts
+init_http();
 function convPath(id, sub = "") {
   return `/conversations/${encodeURIComponent(id)}${sub}`;
 }
@@ -15178,9 +15471,10 @@ function registerConversations(program3) {
 }
 
 // src/commands/teams.mts
+init_http();
 async function readText(file) {
-  const { readFileSync } = await import("node:fs");
-  return file === "-" ? readFileSync(0, "utf8") : readFileSync(file, "utf8");
+  const { readFileSync: readFileSync2 } = await import("node:fs");
+  return file === "-" ? readFileSync2(0, "utf8") : readFileSync2(file, "utf8");
 }
 function registerTeams(program3) {
   const teams = program3.command("teams").description("team config, operators, playbooks, goals, ledger");
@@ -15309,6 +15603,7 @@ function registerTeams(program3) {
 }
 
 // src/commands/admin.mts
+init_http();
 function registerAdmin(program3) {
   const admin = program3.command("admin").description("system config, audit, org caps, DB migrations");
   admin.command("config").description("read the config table (GET /admin/config) or one runtime key (GET /admin/config/:key)").argument("[key]", "system_state key, e.g. snapshot.mission_workers_enabled").action(async (key, _flags, cmd) => {
@@ -15350,6 +15645,7 @@ function registerAdmin(program3) {
 }
 
 // src/commands/deploy.mts
+init_http();
 var TERMINAL_BUILD_STATUSES = /* @__PURE__ */ new Set(["SUCCEEDED", "FAILED", "FAULT", "STOPPED", "TIMED_OUT"]);
 function printNewPhases(opts, body, seen) {
   for (const p of body?.phases ?? []) {
@@ -15358,7 +15654,7 @@ function printNewPhases(opts, body, seen) {
     note(opts, `phase ${p.phase}${p.status ? ` ${p.status}` : ""}`);
   }
 }
-async function waitForBuild(opts, cfg, buildId, { timeoutMs, promoteKey }) {
+async function waitForBuild(opts, cfg, buildId, { timeoutMs }) {
   const seenPhases = /* @__PURE__ */ new Set();
   const resp = await pollUntil(
     () => request(cfg, `/admin/build-worker/${encodeURIComponent(buildId)}`),
@@ -15372,13 +15668,21 @@ async function waitForBuild(opts, cfg, buildId, { timeoutMs, promoteKey }) {
   printNewPhases(opts, resp.json, seenPhases);
   const body = resp.json;
   const status = String(body?.status ?? "");
-  let ok = status === "SUCCEEDED";
-  if (ok && promoteKey) {
-    const promote = body?.[promoteKey];
-    ok = promote != null && (promote.failed ?? []).length === 0;
-    if (!ok) note(opts, `${buildId} SUCCEEDED but ${promoteKey} reported failures \u2014 NOT promoted`);
+  note(opts, `${buildId} ${status}${status === "SUCCEEDED" ? "" : " (failed)"}`);
+  if (status !== "SUCCEEDED") {
+    emit(opts, resp);
+    process.exit(1);
   }
-  note(opts, `${buildId} ${status}${ok ? "" : " (failed)"}`);
+  return resp;
+}
+async function promoteBuild(opts, cfg, buildId, { promoteKey, smoke = false }) {
+  const resp = await request(cfg, `/admin/build-worker/${encodeURIComponent(buildId)}/promote`, {
+    method: "POST",
+    body: promoteKey === "worker_promote" ? { smoke } : {}
+  });
+  const promote = resp.json?.[promoteKey];
+  const ok = resp.status >= 200 && resp.status < 300 && promote != null && (promote.failed ?? []).length === 0;
+  if (!ok) note(opts, `${buildId} ${promoteKey} failed`);
   emit(opts, resp);
   process.exit(ok ? 0 : 1);
 }
@@ -15417,6 +15721,13 @@ function registerDeploy(program3) {
     const { opts, cfg } = await ctx(cmd);
     emit(opts, await request(cfg, `/admin/build-worker/${encodeURIComponent(buildId)}`));
   });
+  deploy.command("promote").description("promote a successful operator/worker image build (POST /admin/build-worker/:build_id/promote)").argument("<build_id>").option("--smoke", "for worker builds, run the live Fargate smoke gate before pinning").action(async (buildId, flags, cmd) => {
+    const { opts, cfg } = await ctx(cmd);
+    emit(opts, await request(cfg, `/admin/build-worker/${encodeURIComponent(buildId)}/promote`, {
+      method: "POST",
+      body: flags.smoke ? { smoke: true } : {}
+    }));
+  });
   deploy.command("logs").description("CodeBuild log tail via CloudWatch (GET /admin/deploy/logs/:build_id)").argument("<build_id>").option("--stage <stage>", "staging | production (default staging)").action(async (buildId, flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
     emit(
@@ -15427,8 +15738,8 @@ function registerDeploy(program3) {
     );
   });
   deploy.command("build-operator").description(
-    'rebuild the operator image (POST /admin/build-operator). With --wait: SUCCEEDED alone is not "promoted" \u2014 completion requires operator_promote with no failures'
-  ).option("--source-version <ref>", "git ref to build (default: gateway's stage branch)").option("--wait", "poll until promoted (exit 0 only on SUCCEEDED + clean operator_promote)").option("--timeout <seconds>", "max seconds to wait (default 1500)", (v) => parseInt(v, 10), 1500).action(async (flags, cmd) => {
+    "rebuild the operator image (POST /admin/build-operator). With --wait: poll to SUCCEEDED, then explicitly promote"
+  ).option("--source-version <ref>", "git ref to build (default: gateway's stage branch)").option("--wait", "poll until SUCCEEDED, then promote (exit 0 only on clean operator_promote)").option("--timeout <seconds>", "max seconds to wait (default 1500)", (v) => parseInt(v, 10), 1500).action(async (flags, cmd) => {
     flags = withParentBuildOpts(flags, cmd);
     const { opts, cfg } = await ctx(cmd);
     const body = {};
@@ -15444,7 +15755,8 @@ function registerDeploy(program3) {
       process.exit(1);
     }
     note(opts, `operator build started: ${buildId}`);
-    await waitForBuild(opts, cfg, buildId, { timeoutMs: flags.timeout * 1e3, promoteKey: "operator_promote" });
+    await waitForBuild(opts, cfg, buildId, { timeoutMs: flags.timeout * 1e3 });
+    await promoteBuild(opts, cfg, buildId, { promoteKey: "operator_promote" });
   });
   deploy.command("publish-cli").description(
     "publish modules/cli to npm as pylot-cli (POST /admin/publish-cli). Idempotent: no-ops when the tree's version is already on npm. Staging builders always dry-run"
@@ -15468,8 +15780,8 @@ function registerDeploy(program3) {
     await waitForBuild(opts, cfg, buildId, { timeoutMs: flags.timeout * 1e3 });
   });
   deploy.command("build-worker").description(
-    "build a repo's worker image (POST /admin/build-worker, body {repo}); --batch --file posts {repos: [...]} to /admin/build-worker/batch. With --wait: completion requires worker_promote with no failures"
-  ).argument("[org/repo]", "repo to build (omit with --batch)").option("--source-version <ref>", "git ref to build the worker overlay from").option("--batch", "batch mode (POST /admin/build-worker/batch)").option("--file <path>", "JSON body from file ('-' for stdin; required with --batch)").option("--wait", "poll until promoted (exit 0 only on SUCCEEDED + clean worker_promote)").option("--timeout <seconds>", "max seconds to wait (default 1500)", (v) => parseInt(v, 10), 1500).action(async (repo, flags, cmd) => {
+    "build a repo's worker image (POST /admin/build-worker, body {repo}); --batch --file posts {repos: [...]} to /admin/build-worker/batch. With --wait: poll to SUCCEEDED, then explicitly promote"
+  ).argument("[org/repo]", "repo to build (omit with --batch)").option("--source-version <ref>", "git ref to build the worker overlay from").option("--batch", "batch mode (POST /admin/build-worker/batch)").option("--file <path>", "JSON body from file ('-' for stdin; required with --batch)").option("--wait", "poll until SUCCEEDED, then promote (exit 0 only on clean worker_promote)").option("--smoke", "with --wait, run the live Fargate smoke gate before pinning").option("--timeout <seconds>", "max seconds to wait (default 1500)", (v) => parseInt(v, 10), 1500).action(async (repo, flags, cmd) => {
     flags = withParentBuildOpts(flags, cmd);
     const { opts, cfg } = await ctx(cmd);
     if (flags.batch) {
@@ -15492,7 +15804,8 @@ function registerDeploy(program3) {
       process.exit(1);
     }
     note(opts, `worker build started: ${buildId}`);
-    await waitForBuild(opts, cfg, buildId, { timeoutMs: flags.timeout * 1e3, promoteKey: "worker_promote" });
+    await waitForBuild(opts, cfg, buildId, { timeoutMs: flags.timeout * 1e3 });
+    await promoteBuild(opts, cfg, buildId, { promoteKey: "worker_promote", smoke: flags.smoke === true });
   });
   deploy.command("ensure-taskdefs").description("backfill per-role operator task definitions (POST /admin/operators/ensure-taskdefs)").action(async (_flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
@@ -15501,6 +15814,7 @@ function registerDeploy(program3) {
 }
 
 // src/commands/secrets.mts
+init_http();
 function registerSecrets(program3) {
   const secrets = program3.command("secrets").description("ASM secret bundles (path-based, admin-scoped)");
   secrets.command("tree").description("full secrets tree (GET /admin/secrets)").action(async (_flags, cmd) => {
@@ -15536,8 +15850,8 @@ function registerSecrets(program3) {
     }
     let value;
     if (flags.stdin) {
-      const { readFileSync } = await import("node:fs");
-      value = readFileSync(0, "utf8").replace(/\r?\n$/, "");
+      const { readFileSync: readFileSync2 } = await import("node:fs");
+      value = readFileSync2(0, "utf8").replace(/\r?\n$/, "");
     } else {
       value = String(flags.value);
     }
@@ -15568,6 +15882,7 @@ function registerSecrets(program3) {
 }
 
 // src/commands/skills.mts
+init_http();
 function registerSkills(program3) {
   const skills = program3.command("skills").description("skills catalog, sync pipeline, procedures");
   skills.command("list").description("skills catalog (GET /admin/skills)").option("--org <org>", "scope to one org (default: all orgs)").option("--tag <tag>", "filter by tag").option("--origin <org/repo>", "filter by origin repo").option("--search <text>", "search name/description").action(async (flags, cmd) => {
@@ -15583,9 +15898,9 @@ function registerSkills(program3) {
     const { opts, cfg } = await ctx(cmd);
     emit(opts, await request(cfg, "/admin/skills/lock"));
   });
-  skills.command("staleness").description("SHA-mismatch report vs origin HEAD (GET /admin/skills/staleness)").action(async (_flags, cmd) => {
+  skills.command("staleness").description("SHA-mismatch report vs origin HEAD (GET /admin/skills/staleness?org=<org>)").requiredOption("--org <org>", "GitHub org to check (staleness is per-org, #1919)").action(async (flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
-    emit(opts, await request(cfg, "/admin/skills/staleness"));
+    emit(opts, await request(cfg, "/admin/skills/staleness", { query: { org: flags.org } }));
   });
   skills.command("sync").description(
     "trigger the CodeBuild skills-sync job for one org (POST /admin/skills/sync, body {org}) or every installed org (--all \u2192 POST /admin/skills/sync-all)"
@@ -15639,6 +15954,7 @@ function registerSkills(program3) {
 }
 
 // src/commands/automations.mts
+init_http();
 function registerAutomations(program3) {
   const automations = program3.command("automations").description("event-driven automation rules");
   automations.command("list").description("automation rules with run stats (GET /automations); --db raw DB view; --snapshots snapshot history").option("--db", "raw DB view (GET /automations/_db)").option("--snapshots", "snapshot history (GET /automations/_snapshots)").option("--limit <n>", "max snapshot rows (with --snapshots, default 20)", (v) => parseInt(v, 10)).action(async (flags, cmd) => {
@@ -15685,6 +16001,7 @@ function registerAutomations(program3) {
 }
 
 // src/commands/providers.mts
+init_http();
 function registerProviders(program3) {
   const providers = program3.command("providers").description("LLM provider instances and org purpose-chains");
   providers.command("list").description("provider instances for an org (GET /admin/providers?org=)").requiredOption("--org <org>", "org to list (required by the gateway)").action(async (flags, cmd) => {
@@ -15741,6 +16058,7 @@ function registerProviders(program3) {
 }
 
 // src/commands/orgs.mts
+init_http();
 function registerOrgs(program3) {
   const orgs = program3.command("orgs").description("GitHub orgs and repo onboarding");
   orgs.command("list").description("orgs visible to this token (GET /orgs)").action(async (_flags, cmd) => {
@@ -15757,6 +16075,7 @@ function registerOrgs(program3) {
 }
 
 // src/commands/assets.mts
+init_http();
 function registerAssets(program3) {
   const assets = program3.command("assets").description("S3 asset presign, view, publish");
   assets.command("presign").description("mint a presigned upload URL (POST /assets/presign) \u2014 needs one of --conversation/--job/--repo").requiredOption("--content-type <ct>", "asset content type, e.g. image/png").requiredOption("--size <bytes>", "upload size in bytes", (v) => parseInt(v, 10)).option("--conversation <id>", "attach to a conversation").option("--job <id>", "attach to a mission job").option("--repo <org/repo>", "attach to a repo").action(async (flags, cmd) => {
@@ -15794,7 +16113,7 @@ function registerAssets(program3) {
 }
 
 // src/index.mts
-var VERSION = true ? "0.1.2" : "0.0.0-dev";
+var VERSION = true ? "0.1.4" : "0.0.0-dev";
 installEpipeGuard();
 var program2 = new Command();
 program2.name("pylot").description(

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "pylot-cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
-  "description": "pylot — first-class CLI for the Pylot gateway API. Replaces curl workflows for operators and humans.",
+  "description": "pylot \u2014 first-class CLI for the Pylot gateway API. Replaces curl workflows for operators and humans.",
   "bin": {
     "pylot": "dist/index.mjs"
   },