syndai 0.4.1 → 0.6.0

package/src/main.js

@@ -1,18 +1,21 @@
 // Command table, argument parsing and the one error report. `main(argv, io)` takes all
 // process I/O as `io`, so tests drive it in-process with a fake server and fake clocks.
 
+import { spawn } from "node:child_process";
 import { setTimeout as sleep } from "node:timers/promises";
 import { parseArgs } from "node:util";
-import { createContext, login, logout, whoami } from "./auth.js";
+import { createContext, login, logout, signup, whoami } from "./auth.js";
 import { answer, cancel, change, editText, goLive, newProject, review, revert, status, watch } from "./changes.js";
-import { CliError, EXIT, explain } from "./errors.js";
+import { ApiError, CliError, EXIT, explain, PORTAL_PAGES } from "./errors.js";
 import { VERSION } from "./http.js";
 import { mcp } from "./mcp.js";
-import { link } from "./projects.js";
+import { billing, connect } from "./portal.js";
+import { link, publish } from "./projects.js";
 import { api } from "./api.js";
 import { repeat, schedule } from "./schedules.js";
+import { env, run, secrets } from "./secrets.js";
 import { settings } from "./settings.js";
-import { closeInput, openBrowser, page } from "./ui.js";
+import { closeInput, openBrowser, openPage, page } from "./ui.js";
 
 const str = { type: "string" };
 const bool = { type: "boolean" };
@@ -20,10 +23,15 @@ const COMMON = { json: bool, "no-input": bool, help: { type: "boolean", short: "
 
 const COMMANDS = {
   change: {
-    usage: 'change "<what>" [--app A] [--review] [--image F]... [--no-wait] [--timeout D]',
-    summary: "Make a change; it goes live when its checks pass (--review: open a PR instead).",
+    usage:
+      'change "<what>" [--app A] [--review] [--learn URL [--sign-in]] [--image F]... [--no-wait] [--timeout D]',
+    summary:
+      "Make a change; it goes live when its checks pass (--review: open a PR instead; --learn: pick features to add from a product's public pages).\n" +
+      "      --sign-in: Sign in to the --learn product yourself on the run page first, so the run reads its in-app pages.",
     options: {
       app: str,
+      learn: str,
+      "sign-in": bool,
       review: bool,
       image: { type: "string", multiple: true },
       "no-wait": bool,
@@ -33,9 +41,11 @@ const COMMANDS = {
     stepUp: false,
   },
   new: {
-    usage: 'new "<what>" [--no-learn] [--no-wait] [--timeout D]',
-    summary: "Start a new project; a product URL in the text builds your own version of it.",
-    options: { "no-learn": bool, "no-wait": bool, timeout: str },
+    usage: 'new "<what>" [--no-learn | --sign-in] [--no-wait] [--timeout D]',
+    summary:
+      "Start a new project; a product URL in the text builds your own version of it.\n" +
+      "      --sign-in: Sign in to that product yourself on the run page first, so the run reads its in-app pages.",
+    options: { "no-learn": bool, "sign-in": bool, "no-wait": bool, timeout: str },
     run: (ctx, args) => newProject(ctx, args),
     stepUp: false,
   },
@@ -93,10 +103,19 @@ const COMMANDS = {
   login: {
     usage: "login [--with-token] [--scope S]...",
     summary:
-      "Log in by approving this computer in your browser (--scope adds access to the key's; --with-token reads a key from stdin).",
+      "Log in by approving this computer in your browser (--scope adds access to the key's; --with-token reads a key from stdin).\n" +
+      "      No workspace yet? syndai signup <email>",
     options: { "with-token": bool, scope: { type: "string", multiple: true } },
     run: (ctx) => login(ctx),
   },
+  signup: {
+    usage: "signup <email> [--code C]",
+    summary:
+      "Make a workspace and log in with a code emailed to you (continuing accepts the Terms and Privacy Policy).\n" +
+      "      Off a terminal it emails the code and exits 3; rerun with --code.",
+    options: { code: str },
+    run: (ctx, args) => signup(ctx, args),
+  },
   logout: {
     usage: "logout",
     summary: "Revoke and forget the stored key.",
@@ -109,12 +128,54 @@ const COMMANDS = {
     options: {},
     run: (ctx) => whoami(ctx),
   },
-  link: {
-    usage: "link [project]",
-    summary: "Remember which project this directory changes (stored outside the repo).",
+  publish: {
+    usage: "publish [--app A]",
+    summary: "Publish the project as a hosted app (or redeploy it) and print its live URL.",
     options: { app: str },
+    run: (ctx) => publish(ctx),
+  },
+  connect: {
+    usage: "connect <provider>",
+    summary:
+      "Open the workspace page that connects github, sentry, claude, chatgpt, openrouter, slack or a social account; finish in the browser.",
+    options: {},
+    run: (ctx, args) => connect(ctx, args),
+  },
+  billing: {
+    usage: "billing [--open] | packs | buy <pack> | plan <tier> [--interval month|year] [--country CC] | card | cancel",
+    summary:
+      "Plan and balance; buy and plan open a checkout a person pays in the browser (nothing is charged until then).",
+    options: { open: bool, interval: str, country: str },
+    run: (ctx, args) => billing(ctx, args),
+  },
+  link: {
+    usage: "link [project] [--env E]",
+    summary: "Remember which project (and environment) this directory uses (stored outside the repo).",
+    options: { app: str, env: str },
     run: (ctx, [ref]) => link(ctx, ref),
   },
+  env: {
+    usage: "env ls | use <env>",
+    summary: "List the workspace's environments, or pick the one this directory uses.",
+    options: {},
+    run: (ctx, args) => env(ctx, args),
+  },
+  secrets: {
+    usage:
+      "secrets [ls] | set KEY | rm KEY [--yes] | import FILE|- | get KEY [--plain] | download [-o FILE]\n" +
+      "               [--env E] [--app A] [--project]",
+    summary:
+      "An environment's secrets: names only in lists and JSON; set reads the value from a hidden prompt or stdin; get and download need a browser-approved login (production: a fresh approval).",
+    options: { env: str, app: str, project: bool, plain: bool, output: { type: "string", short: "o" }, yes: bool },
+    run: (ctx, args) => secrets(ctx, args),
+  },
+  run: {
+    usage: "run [--env E] [--app A] [--] <command> [args...]",
+    summary: "Run a local command with the environment's values in its environment only; its exit code is syndai's.",
+    options: { env: str, app: str },
+    passthrough: true,
+    run: (ctx, command) => run(ctx, command),
+  },
   settings: {
     usage: "settings [--app A] [get | set key=value...]",
     summary: "autonomy, feature_requests, bug_scan, protected_paths (a key can only tighten them).",
@@ -129,8 +190,8 @@ const COMMANDS = {
   },
   schedule: {
     usage:
-      'schedule list [--app A | --all] | show <id> | add "<what>" --every E [--at T] [--tz Z] [--budget USD] [--app A]\n' +
-      "               | edit <id> [--prompt P] [--every E] [--at T] [--tz Z] [--budget USD|none]\n" +
+      'schedule list [--app A | --all] | show <id> | add "<what>" --every E [--at T] [--tz Z] [--budget CREDITS] [--app A]\n' +
+      "               | edit <id> [--prompt P] [--every E] [--at T] [--tz Z] [--budget CREDITS|none]\n" +
       "               | pause | resume | run-now | delete <id> [--yes]",
     summary:
       'A project\'s recurring runs. E: hourly (--at :MM), daily or weekdays (--at HH:MM), weekly (--at "mon HH:MM"), or a 5-field cron.',
@@ -138,7 +199,7 @@ const COMMANDS = {
     run: (ctx, args) => schedule(ctx, args),
   },
   repeat: {
-    usage: "repeat <run> --every E [--at T] [--tz Z] [--budget USD]",
+    usage: "repeat <run> --every E [--at T] [--tz Z] [--budget CREDITS]",
     summary: "Run a change you liked again on a schedule (its first run is the next scheduled time).",
     options: { every: str, at: str, tz: str, budget: str },
     run: (ctx, args) => repeat(ctx, args),
@@ -167,7 +228,8 @@ export function helpText() {
     "",
     "Every command: --json (machine output; also when stdout is not a terminal),",
     "--no-input (never prompt), -h/--help.",
-    "Environment: SYNDAI_API_KEY (wins over `syndai login`), SYNDAI_APP, SYNDAI_API_URL, NO_COLOR.",
+    "Environment: SYNDAI_API_KEY (wins over `syndai login`; never reads production values),",
+    "SYNDAI_APP, SYNDAI_ENV, SYNDAI_API_URL, NO_COLOR.",
     "Exit codes: 0 done, 1 failed, 2 usage or no project, 3 needs you, 4 live but unverified,",
     "5 auth/scope/plan, 6 --timeout reached, 7 service unavailable, 130 interrupted.",
     "",
@@ -187,6 +249,33 @@ export function processIo(signal) {
     sleep: (ms, abortSignal) => sleep(ms, undefined, { signal: abortSignal }),
     openUrl: openBrowser,
     page: (text) => page(process, text),
+    /**
+     * `syndai run`: the child shares the terminal; resolves `{code, signal}` (ENOENT rejects).
+     * While it runs the parent never exits first (that would orphan a child holding the
+     * secrets): Ctrl-C reaches the child through the terminal, and SIGTERM/SIGHUP are passed on.
+     */
+    exec: (file, args, childEnv) =>
+      new Promise((resolve, reject) => {
+        const child = spawn(file, args, { stdio: "inherit", env: childEnv });
+        const saved = process.listeners("SIGINT");
+        process.removeAllListeners("SIGINT");
+        const forward = (sig) => child.kill(sig);
+        process.on("SIGINT", () => {});
+        for (const sig of ["SIGTERM", "SIGHUP"]) process.on(sig, forward);
+        const restore = () => {
+          process.removeAllListeners("SIGINT");
+          for (const listener of saved) process.on("SIGINT", listener);
+          for (const sig of ["SIGTERM", "SIGHUP"]) process.off(sig, forward);
+        };
+        child.once("error", (err) => {
+          restore();
+          reject(err);
+        });
+        child.once("exit", (code, exitSignal) => {
+          restore();
+          resolve({ code, signal: exitSignal });
+        });
+      }),
   };
 }
 
@@ -205,9 +294,11 @@ export async function main(argv, io) {
     io.stderr.write(`error: unknown command "${command}"\n\n${helpText()}`);
     return EXIT.USAGE;
   }
+  const options = { ...COMMON, ...spec.options };
+  const [own, child] = spec.passthrough ? splitCommand(rest, options) : [rest, null];
   let parsed;
   try {
-    parsed = parseArgs({ args: rest, options: { ...COMMON, ...spec.options }, allowPositionals: true });
+    parsed = parseArgs({ args: own, options, allowPositionals: true });
   } catch (err) {
     io.stderr.write(`error: ${err.message}\n  usage: syndai ${spec.usage}\n`);
     return EXIT.USAGE;
@@ -218,18 +309,38 @@ export async function main(argv, io) {
   }
   const ctx = createContext(io, parsed.values, { stepUp: spec.stepUp !== false });
   try {
-    return await spec.run(ctx, parsed.positionals);
+    return await spec.run(ctx, child ?? parsed.positionals);
   } catch (err) {
-    return report(ctx, err);
+    return await report(ctx, err);
   } finally {
     closeInput(io);
   }
 }
 
-/** One error line (plus the next command) on stderr; a JSON error on stdout for machines. */
-function report(ctx, err) {
+/**
+ * A passthrough command's own options end at `--` or at the child command's first word
+ * (`syndai run npm test --watch`): everything after belongs to the child, unparsed.
+ */
+function splitCommand(args, options) {
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--") return [args.slice(0, i), args.slice(i + 1)];
+    if (!arg.startsWith("-")) return [args.slice(0, i), args.slice(i)];
+    const name = arg.replace(/^--?/, "").split("=")[0];
+    const option = options[name] ?? Object.values(options).find((o) => o.short === name);
+    if (option?.type === "string" && !arg.includes("=")) i += 1; // its value is the next word
+  }
+  return [args, []];
+}
+
+/**
+ * One error line (plus the next command) on stderr; a JSON error on stdout for machines. An
+ * error a workspace page fixes (billing, GitHub) names that page, opened on a terminal.
+ */
+async function report(ctx, err) {
   const { ui, io } = ctx;
-  const { exitCode, message, next } = explain(err);
+  const page = err instanceof ApiError ? PORTAL_PAGES[err.code] : null;
+  const { exitCode, message, next } = explain(err, page ? await ctx.customerId().catch(() => null) : null);
   if (io.env.SYNDAI_DEBUG && err?.stack) io.stderr.write(`${err.stack}\n`);
   const extra = err instanceof CliError ? err.result : null;
   if (exitCode === EXIT.INTERRUPTED) {
@@ -245,5 +356,6 @@ function report(ctx, err) {
     }
   }
   if (next) ui.progress(`  next: ${next}`);
+  if (page) openPage(ctx, next);
   return exitCode;
 }

package/src/portal.js

@@ -0,0 +1,156 @@
+// What stays in the browser, one step away: `connect` and `billing` hand off to the exact
+// workspace page (G1: `portalUrl`). Connections and payment need a person there, so no key
+// may read connection status or pay; the CLI prints the page, opens it on a terminal and
+// never polls. `billing` reads the balance and starts a checkout a person then pays.
+
+import { CliError, EXIT, UnavailableError, portalUrl } from "./errors.js";
+import { openPage } from "./ui.js";
+
+/** `syndai connect <provider>` -> its card. The `connect` list is the portal's
+ * `CONNECT_PROVIDERS` (apps/portal-v2/src/lib/connection-link.ts). */
+const CONNECTIONS = [
+  "claude",
+  "chatgpt",
+  "openrouter",
+  "linkedin",
+  "instagram",
+  "x",
+  "threads",
+  "bluesky",
+  "buffer",
+  "tiktok",
+  "youtube",
+  "slack",
+];
+export const CONNECT_PAGES = Object.freeze({
+  github: "settings#repositories",
+  sentry: "sentry",
+  ...Object.fromEntries(CONNECTIONS.map((provider) => [provider, `connections?connect=${provider}`])),
+});
+
+/** Print a workspace page (JSON: `{url}`), say what to do there, open it on a terminal. */
+function handOff(ctx, url, line, data = {}) {
+  ctx.ui.result({ ...data, url }, url);
+  if (!ctx.ui.json) ctx.ui.progress(line);
+  openPage(ctx, url);
+  return EXIT.OK;
+}
+
+export async function connect(ctx, [provider]) {
+  const names = Object.keys(CONNECT_PAGES).join(", ");
+  const page = provider ? CONNECT_PAGES[provider.toLowerCase()] : null;
+  if (!page) {
+    throw new CliError(EXIT.USAGE, provider ? `Unknown provider "${provider}". One of: ${names}.` : `Connect what? One of: ${names}.`);
+  }
+  return handOff(ctx, portalUrl(await ctx.customerId(), page), "Finish in the browser.");
+}
+
+export async function billing(ctx, [sub = "status", arg]) {
+  switch (sub) {
+    case "status":
+      return billingStatus(ctx);
+    case "packs":
+      return packs(ctx);
+    case "buy":
+      return buy(ctx, arg);
+    case "plan":
+      return plan(ctx, arg);
+    case "card":
+    case "cancel":
+      return handOff(
+        ctx,
+        portalUrl(await ctx.customerId(), "billing"),
+        "Change the card, plan or cancel on this page.",
+      );
+    default:
+      throw new CliError(EXIT.USAGE, `Unknown billing command "${sub}". Use packs, buy, plan, card or cancel.`);
+  }
+}
+
+const dollars = (usd) => `${usd < 0 ? "-" : ""}$${Math.abs(usd).toFixed(2)}`;
+
+async function billingStatus(ctx) {
+  const { client, ui, io, flags } = ctx;
+  const [usage, subscription, customerId] = await Promise.all([
+    client.call("usage"),
+    // The plan's renewal comes from the payment provider: its outage only drops that line.
+    client.call("subscription").then(
+      (body) => body?.subscription ?? null,
+      (err) => {
+        if (err instanceof UnavailableError) return null;
+        throw err;
+      },
+    ),
+    ctx.customerId(),
+  ]);
+  // The portal's `balanceUsd` (apps/portal-v2/src/sync/usage-api.ts): packs + included left - holds.
+  const held = usage.bids_usd ?? 0;
+  const balance = usage.pack_balance_usd + usage.included_remaining_usd - held;
+  const url = portalUrl(customerId, "billing");
+  const planCode = subscription?.plan_code ?? usage.plan_code ?? null;
+  const renews = subscription?.current_period_end
+    ? ` (${subscription.interval ?? ""}ly, ${subscription.cancel_at_period_end ? "ends" : "renews"} ${subscription.current_period_end.slice(0, 10)})`
+    : "";
+  const parts = [`packs ${dollars(usage.pack_balance_usd)}`, `included ${dollars(usage.included_remaining_usd)} left`];
+  if (held) parts.push(`${dollars(held)} held`);
+  ui.result(
+    {
+      plan_code: planCode,
+      subscription,
+      balance_usd: balance,
+      pack_balance_usd: usage.pack_balance_usd,
+      included_remaining_usd: usage.included_remaining_usd,
+      bids_usd: held,
+      included_resets_at: usage.included_resets_at ?? null,
+      url,
+    },
+    [`Plan     ${planCode ?? "unknown"}${renews}`, `Balance  ${dollars(balance)} (${parts.join(", ")})`, `Billing  ${url}`].join("\n"),
+  );
+  if (flags.open && ui.interactive) io.openUrl(url);
+  return EXIT.OK;
+}
+
+async function packs(ctx) {
+  const body = await ctx.client.call("packs");
+  const lines = (body.packs ?? []).map(
+    (p) => `  ${p.key.padEnd(14)} ${String(p.credits).padStart(5)} credits  ${p.prices?.usd === undefined ? "" : dollars(p.prices.usd / 100)}`,
+  );
+  ctx.ui.result(body, ["Credit packs (syndai billing buy <pack>):", ...lines].join("\n"));
+  return EXIT.OK;
+}
+
+async function buy(ctx, pack) {
+  if (!pack) throw new CliError(EXIT.USAGE, "Which pack? syndai billing buy <pack>", { next: "syndai billing packs" });
+  const packKey = pack.startsWith("pack_") ? pack : `pack_${pack}`;
+  const { checkout_url: url } = await ctx.client.call("packCheckout", {
+    body: { pack_key: packKey, country: buyerCountry(ctx) },
+  });
+  return checkout(ctx, url);
+}
+
+async function plan(ctx, tier) {
+  if (!tier) throw new CliError(EXIT.USAGE, "Which plan? syndai billing plan <tier> [--interval month|year]");
+  const interval = ctx.flags.interval ?? "month";
+  if (!["month", "year"].includes(interval)) throw new CliError(EXIT.USAGE, "--interval is month or year.");
+  const { checkout_url: url } = await ctx.client.call("planCheckout", {
+    body: { plan_code: tier.startsWith("tier_") ? tier : `tier_${tier}`, interval, country: buyerCountry(ctx) },
+  });
+  return checkout(ctx, url);
+}
+
+function checkout(ctx, url) {
+  return handOff(ctx, url, "A person pays on this page; nothing is charged until then.", { checkout_url: url });
+}
+
+/**
+ * The billing country a checkout is priced in (ISO alpha-2): `--country`, else the locale's
+ * region, else US. A claim only: the provider's billing address re-checks it.
+ */
+function buyerCountry({ flags, io }) {
+  if (flags.country !== undefined) {
+    if (!/^[A-Za-z]{2}$/.test(flags.country)) throw new CliError(EXIT.USAGE, "--country is a two-letter code, like US or DE.");
+    return flags.country.toUpperCase();
+  }
+  const locale = io.env.LC_ALL || io.env.LC_MONETARY || io.env.LANG || "";
+  return /^[a-z]{2,3}_([A-Z]{2})\b/.exec(locale)?.[1] ?? "US";
+}

package/src/projects.js

@@ -3,6 +3,9 @@
 // connected repo, the only project, a picker on a terminal. Otherwise exit 2 with the list.
 //
 // A project is a connected repository, joined with its app (live URL, slug) when it has one.
+// A link may also name an environment (`syndai env use`, `link --env`): one without a project
+// only picks the environment, so the project falls through to the next rule. The workspace's
+// environments are looked up here too, so `link --env` and `syndai env` share one check.
 
 import { execFileSync } from "node:child_process";
 import path from "node:path";
@@ -74,7 +77,7 @@ export async function resolveProject(ctx, { app, required = true, picker = true,
   if (io.env.SYNDAI_APP) return pick(io.env.SYNDAI_APP, "SYNDAI_APP");
   if (useLink) {
     const link = findLink(paths, io.cwd);
-    if (link) {
+    if (link?.project_id) {
       const linked = projects.find((p) => p.id === link.project_id);
       if (linked) return linked;
       throw noProject(projects, `The project linked to ${link.dir} is no longer in this workspace.`);
@@ -156,13 +159,58 @@ export function normalizeRemote(url) {
   return normal.replace(/\.git$/, "").replace(/\/+$/, "");
 }
 
+export async function listEnvironments(ctx) {
+  return (await ctx.client.call("listEnvironments")).environments;
+}
+
+/** The workspace environment named `slug` (exit 2 with the list when there is none). */
+export async function environmentBySlug(ctx, slug, environments) {
+  const envs = environments ?? (await listEnvironments(ctx));
+  const hit = envs.find((env) => env.slug === slug);
+  if (hit) return hit;
+  throw new CliError(EXIT.USAGE, `This workspace has no "${slug}" environment.`, {
+    next: "syndai env ls",
+    result: { data: { environments: envs.map((env) => env.slug) }, human: `Environments: ${envs.map((env) => env.slug).join(", ")}` },
+  });
+}
+
+/** `syndai link [project] [--env E]`: the project (and environment) this directory uses. */
 export async function link(ctx, ref) {
   const project = await resolveProject(ctx, { app: ref ?? ctx.flags.app, useLink: false });
   const dir = path.resolve(ctx.io.cwd);
-  saveLink(ctx.paths, dir, { project_id: project.id, name: project.name, customer_id: project.customer_id });
+  const here = findLink(ctx.paths, dir);
+  // A re-link keeps the environment this directory already chose, unless --env names one.
+  const environment = ctx.flags.env
+    ? (await environmentBySlug(ctx, ctx.flags.env)).slug
+    : here?.dir === dir
+      ? here.environment
+      : undefined;
+  saveLink(ctx.paths, dir, {
+    project_id: project.id,
+    name: project.name,
+    customer_id: project.customer_id,
+    ...(environment ? { environment } : {}),
+  });
+  ctx.ui.result(
+    { dir, project_id: project.id, name: project.name, environment: environment ?? null },
+    `Linked ${dir} to ${projectLabel(project)}${environment ? ` (${environment})` : ""}.`,
+  );
+  return EXIT.OK;
+}
+
+/** `syndai publish [--app A]`: put the project's default branch live as a hosted app. */
+export async function publish(ctx) {
+  const project = await resolveProject(ctx, { app: ctx.flags.app });
+  // A call while a deploy is in flight answers that deploy, so a retry never starts a second.
+  const { publication } = await ctx.client.call("publishApp", {
+    params: { customer_id: project.customer_id, coding_repository_id: project.id },
+    retry: true,
+  });
+  const url = publication?.url ?? project.live_url;
   ctx.ui.result(
-    { dir, project_id: project.id, name: project.name },
-    `Linked ${dir} to ${projectLabel(project)}.`,
+    { project_id: project.id, url, state: publication?.state ?? null, publication },
+    url ? `Publishing ${projectLabel(project)}: ${url}` : `Publishing ${projectLabel(project)}.`,
   );
+  if (!ctx.ui.json) ctx.ui.progress(ctx.ui.dim("It is live there once the deploy finishes (a minute or two)."));
   return EXIT.OK;
 }

package/src/routes.js

@@ -8,6 +8,8 @@ const EXT = "/api/v1/external/coding";
 export const ROUTES = Object.freeze({
   deviceStart: ["POST", "/api/v1/cli/device"],
   deviceToken: ["POST", "/api/v1/cli/device/token"],
+  signup: ["POST", "/api/v1/signup"],
+  signupVerify: ["POST", "/api/v1/signup/verify"],
   me: ["GET", `${EXT}/me`],
   revokeMe: ["DELETE", `${EXT}/me`],
   listRepos: ["GET", `${EXT}/repos`],
@@ -20,6 +22,12 @@ export const ROUTES = Object.freeze({
     "PATCH",
     `${EXT}/customers/{customer_id}/repositories/{coding_repository_id}/publication`,
   ],
+  publishApp: ["POST", `${EXT}/customers/{customer_id}/repositories/{coding_repository_id}/publish`],
+  usage: ["GET", `${EXT}/usage/current-period`],
+  subscription: ["GET", `${EXT}/purchases/subscription`],
+  packs: ["GET", `${EXT}/purchases/packs`],
+  packCheckout: ["POST", `${EXT}/purchases/pack-checkout`],
+  planCheckout: ["POST", `${EXT}/purchases/subscription-checkout`],
   getBugScan: ["GET", `${EXT}/repositories/{repository_id}/bug-scan`],
   setBugScan: ["PUT", `${EXT}/repositories/{repository_id}/bug-scan`],
   getPolicy: ["GET", `${EXT}/policy/defaults`],
@@ -45,6 +53,14 @@ export const ROUTES = Object.freeze({
   pauseSchedule: ["POST", `${EXT}/schedules/{schedule_id}/pause`],
   resumeSchedule: ["POST", `${EXT}/schedules/{schedule_id}/resume`],
   runScheduleNow: ["POST", `${EXT}/schedules/{schedule_id}/run-now`],
+  listEnvironments: ["GET", `${EXT}/environments`],
+  listSecrets: ["GET", `${EXT}/secrets`],
+  putSecret: ["PUT", `${EXT}/secrets/{key_name}`],
+  deleteSecret: ["DELETE", `${EXT}/secrets/{key_name}`],
+  importSecrets: ["POST", `${EXT}/secrets/import`],
+  resolveSecrets: ["POST", `${EXT}/secrets/resolve`],
+  startProductionAccess: ["POST", `${EXT}/cli/production-access`],
+  redeemProductionAccess: ["POST", `${EXT}/cli/production-access/token`],
 });
 
 /** The MCP endpoint `syndai mcp install` points clients at (JSON-RPC, not REST). */

package/src/schedules.js

@@ -16,6 +16,9 @@ const PAUSE_REASONS = {
   consecutive_failures: "it failed 5 times in a row",
   invalid_trigger: "its schedule is no longer valid",
 };
+// The fixed, published peg (backend `billing/tier_catalog.USD_PER_CREDIT`): the API stores the
+// per-run cap in USD, the CLI takes and shows it in credits like the portal.
+const USD_PER_CREDIT = 0.25;
 const CADENCE_HELP = 'hourly --at :MM, daily|weekdays --at HH:MM, weekly --at "mon HH:MM", or a 5-field cron';
 
 // --- cadence -------------------------------------------------------------------------------
@@ -106,15 +109,20 @@ function dayIndex(text) {
   return index >= 0 && full[index].startsWith(text) ? index : -1;
 }
 
-/** `--budget 5` -> 5; `--budget none` -> null (no per-run cap) where allowed. */
+/** USD -> credits for display: whole numbers bare, else up to two decimals ("20", "6", "0.08"). */
+function credits(usd) {
+  return String(Math.round((usd / USD_PER_CREDIT) * 100) / 100);
+}
+
+/** `--budget 20` (credits) -> 5 (USD); `--budget none` -> null (no per-run cap) where allowed. */
 function budgetOf(text, { allowNone }) {
   if (text === undefined) return undefined;
   if (allowNone && text.trim().toLowerCase() === "none") return null;
-  const value = Number(text.replace(/^\$/, ""));
+  const value = Number(text);
   if (!Number.isFinite(value) || value <= 0) {
-    throw new CliError(EXIT.USAGE, `--budget is a dollar amount per run${allowNone ? ", or none" : ""}, not "${text}".`);
+    throw new CliError(EXIT.USAGE, `--budget is a number of credits per run${allowNone ? ", or none" : ""}, not "${text}".`);
   }
-  return value;
+  return value * USD_PER_CREDIT;
 }
 
 function triggerOf(ctx, { every, at, tz }) {
@@ -162,7 +170,7 @@ function card(s, occurrences = []) {
   const lines = [`${labelOf(s)} · ${stateOf(s)}`, `"${firstLine(s.prompt)}"`];
   if (s.repo_name) lines.push(`Project ${s.repo_name}`);
   if (s.occurrence_budget_usd !== null && s.occurrence_budget_usd !== undefined) {
-    lines.push(`Cap $${s.occurrence_budget_usd} per run`);
+    lines.push(`Cap ${credits(s.occurrence_budget_usd)} credits per run`);
   }
   if (s.status !== "paused") lines.push(upcomingLine(s));
   lines.push("", occurrences.length ? "History:" : "History: none yet");
@@ -368,7 +376,7 @@ export async function repeat(ctx, [runId]) {
     trigger,
     ...(budget === undefined ? {} : { occurrence_budget_usd: budget }),
   });
-  const cost = typeof run.cost_usd === "number" ? ` (last run cost $${run.cost_usd.toFixed(2)})` : "";
+  const cost = typeof run.cost_usd === "number" ? ` (last run cost ${credits(run.cost_usd)} credits)` : "";
   return printCreated(
     ctx,
     created,