sima-cli 2.1.19__tar.gz → 2.1.21__tar.gz

{sima_cli-2.1.19/sima_cli.egg-info → sima_cli-2.1.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sima-cli
-Version: 2.1.19
+Version: 2.1.21
 Summary: CLI tool for SiMa Developer Portal to download models, firmware, and apps.
 Home-page: https://community.sima.ai/
 Author: SiMa.ai

{sima_cli-2.1.19 → sima_cli-2.1.21}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sima-cli"
-version = "2.1.19"
+version = "2.1.21"
 description = "CLI tool for SiMa Developer Portal to download models, firmware, and apps."
 readme = "README.md"
 requires-python = ">=3.8"

{sima_cli-2.1.19 → sima_cli-2.1.21}/sima_cli/__version__.py

@@ -1,2 +1,2 @@
 # sima_cli/__version__.py
-__version__ = "2.1.19"
+__version__ = "2.1.21"

{sima_cli-2.1.19 → sima_cli-2.1.21}/sima_cli/cli.py

@@ -180,14 +180,14 @@ class InspectionAwareGroup(click.Group):
             _command_name_from_argv(['sima-cli'] + options) == 'bootimg'
             and any(arg in ('--netboot', '-n', '--autoflash', '-a') for arg in options)
         )
-        if _command_name_from_argv(['sima-cli'] + options) == 'update' and any(arg in ('--inspect', '--swap') for arg in options):
+        if _command_name_from_argv(['sima-cli'] + options) == 'update' and any(arg in ('--inspect', '--swap', '--reset-overlay') for arg in options):
             ctx.meta['update_inspect'] = True
         return super().parse_args(ctx, args)
 
 
 # Entry point for the CLI tool using Click's command group decorator
 @click.group(cls=InspectionAwareGroup, context_settings=dict(help_option_names=["-h", "--help", "-?"], max_content_width=120))
-@click.option('-i', '--internal', is_flag=True, help="Use internal Artifactory resources, Authorized Sima employees only")
+@click.option('-i', '--internal', is_flag=True, help="Use internal SiMa services, authorized SiMa employees only")
 @click.option('-y', '--yes', is_flag=True, help="Assume yes for confirmation prompts.")
 @click.version_option(version=f"{__version__}", message="SiMa CLI version: %(version)s")
 @click.pass_context
@@ -196,7 +196,7 @@ def main(ctx, internal, yes):
     sima-cli – SiMa Developer Portal CLI Tool
 
     Global Options:
-      --internal  Use internal Artifactory resources (can also be set via env variable SIMA_CLI_INTERNAL=1)
+      --internal  Use internal SiMa services (can also be set via env variable SIMA_CLI_INTERNAL=1)
     """
     internal = internal or os.getenv("SIMA_CLI_INTERNAL", "0") in ("1", "true", "yes")
     if internal:
@@ -204,7 +204,10 @@ def main(ctx, internal, yes):
             Text("Pre-release software may be unstable. Use at your own risk.", style="yellow"),
             title="Pre-release software", border_style="yellow", width=72,
         ))
-    if ctx.meta.get('update_inspect'):
+    # CloudEx selects Developer Portal or internal NeatOps authentication itself;
+    # its internal Vulcan flow does not require Artifactory setup.
+    if ctx.meta.get('update_inspect') or ctx.invoked_subcommand == 'cloudex':
+        _configure_stdio_errors()
         ctx.ensure_object(dict)
         ctx.obj.update(internal=internal, yes=yes)
         return
@@ -363,15 +366,16 @@ def download(ctx, url, dest):
     "--dryrun",
     is_flag=True,
     default=False,
-    help="For eLxr, preview an update or slot swap without installing, switching slots, or rebooting."
+    help="For eLxr, preview an update, slot swap, or overlay reset without making changes."
 )
 @click.option("--inspect", "inspect_state", is_flag=True, help="Show eLxr 3.0+ A/B slots and overlay customizations without updating (local or --ip).")
+@click.option("--reset-overlay", is_flag=True, help="Discard local overlay software and settings without updating firmware; reboot to use the clean system (eLxr 3.0+).")
 @click.option("--swap", is_flag=True, help="Select the available inactive eLxr 3.0+ slot for next boot; use --reboot to restart now.")
 @click.option("--verbose", is_flag=True, help="Show detailed overlay file categories during eLxr 3.0+ inspection or update.")
 @click.option("--signing-cert", metavar="URL_OR_FILE", help="SWUpdate PEM verification certificate: HTTP(S) URL or local file. Defaults to the certificate for the selected channel when configured (eLxr 3.0+).")
-@click.option("--reboot", is_flag=True, help="Reboot after successful eLxr 3.0+ installation or slot selection; verify remote boot health.")
+@click.option("--reboot", is_flag=True, help="Reboot after successful eLxr 3.0+ installation, slot selection, or overlay reset.")
 @click.pass_context
-def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force, troot_only, dryrun, inspect_state, verbose, reboot, signing_cert, swap):
+def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force, troot_only, dryrun, inspect_state, verbose, reboot, signing_cert, swap, reset_overlay):
     """
     Update a SiMa DevKit, remote device, or Linux PCIe host.
 
@@ -383,6 +387,10 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
     eLxr 3.0+ uses signed full-system SWU bundles. Use --inspect for A/B
     state, --ip for remote updates, and --reboot to reboot after installation.
 
+    Use --reset-overlay to discard local software and settings without updating
+    firmware or switching slots. Save needed files first; the saved inventory
+    contains metadata only. Reboot promptly, or add --reboot. Use --dryrun to preview.
+
     Use --swap to select the valid inactive slot without downloading an update.
     The current and target versions are shown before confirmation; --yes skips
     confirmation. Reboot separately to apply, or add --reboot to restart now.
@@ -393,7 +401,8 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
 
     The verification certificate is downloaded for the selected channel when configured; use
     --signing-cert URL_OR_FILE for an image signed with your own certificate.
-    Developer-portal version lookup for 3.0 is not available yet.
+    For official eLxr 3.0+ releases, specify -v 3.0.0 (or -v 3.0) to
+    download the SWU from docs.sima.ai using your developer-portal login.
 
     Internal mode warns that pre-release software may be unstable and is used
     at your own risk. On eLxr 3.0+, unavailable Artifactory access falls back
@@ -501,6 +510,7 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
         or troot_only
         or inspect_state
         or swap
+        or reset_overlay
         or verbose
         or reboot
         or force
@@ -518,6 +528,8 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
         return
 
     is_elxr = is_devkit_running_elxr()
+    if reset_overlay and (inspect_state or swap or version_or_url or force or troot_only or signing_cert is not None or flavor != "auto"):
+        raise click.UsageError("--reset-overlay cannot be combined with --inspect, --swap, or installation options.")
     if swap and (inspect_state or version_or_url or force or troot_only or signing_cert is not None or flavor != "auto"):
         raise click.UsageError("--swap cannot be combined with --inspect or installation options.")
     if inspect_state and (version_or_url or dryrun or force or troot_only or reboot or signing_cert is not None or flavor != 'auto'):
@@ -527,7 +539,7 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
                          internal=ctx.obj.get("internal", False),
                          auto_confirm=yes or ctx.obj.get("yes", False), dryrun=dryrun,
                          signing_cert=signing_cert, reboot=reboot, inspect=inspect_state, force=force,
-                         troot_only=troot_only, flavor=flavor, local_elxr=is_elxr, verbose=verbose, swap=swap):
+                         troot_only=troot_only, flavor=flavor, local_elxr=is_elxr, verbose=verbose, swap=swap, reset_overlay=reset_overlay):
             return
     except (click.ClickException, click.Abort):
         raise
@@ -815,6 +827,8 @@ def bootimg_cmd(ctx, version, boardtype, netboot, images, delete_cache, devkit_i
         else:
             write_image(version, boardtype, fwtype, internal, flavor='headless', recovery=recovery)
             click.echo("✅ Boot image successfully written.")
+    except click.ClickException:
+        raise
     except Exception as e:
         click.echo(f"❌ Failed to write boot image: {e}", err=True)
         ctx.exit(1)

{sima_cli-2.1.19 → sima_cli-2.1.21}/sima_cli/cloudex/client.py

@@ -7,6 +7,7 @@ import json
 import os
 import shutil
 import subprocess
+import sys
 import time
 import uuid
 from pathlib import Path
@@ -17,6 +18,8 @@ import requests
 
 DEFAULT_ROOT = Path.home() / ".sima-cli" / "cloudex"
 FORWARDER_NAME = "kerrigan-p2p-forwarder"
+MACOS_TUNNEL_PATH = "/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin:/usr/local/bin"
+MACOS_WIREGUARD_INSTALL = "Install WireGuard CLI support with: brew install wireguard-tools"
 CONNECTION_SETUP_TIMEOUT_SECONDS = 60
 DIAGNOSTIC_LOG_LINES = 50
 SAFE_FORWARDER_STAGES = {
@@ -68,8 +71,7 @@ def decode_key(value):
         raise CloudExError("--key contains an invalid value")
     if len(profile["allocation_secret"]) < 32:
         raise CloudExError("--key contains an invalid allocation secret")
-    if profile["environment"] != "vulcan-staging":
-        raise CloudExError("CloudEx currently supports only vulcan-staging allocation keys")
+    # The environment is a descriptive label; api_url selects the backend.
     return profile
 
 
@@ -393,6 +395,9 @@ def _forwarder_failure(log_path):
         "start wireguard-go": "the WireGuard interface could not start",
         "invalid session config": "the native forwarder rejected the session configuration",
     }
+    if sys.platform == "darwin":
+        for needle in ("wireguard is unavailable", "start wireguard-go"):
+            mappings[needle] += ". " + MACOS_WIREGUARD_INSTALL
     for needle, message in mappings.items():
         if needle in detail:
             return message + suffix
@@ -552,6 +557,50 @@ def _reconcile_existing_connection(profile, store, progress):
     return None
 
 
+def _forwarder_sudo_prefix(progress=None):
+    """Install missing macOS tools as the user, then expose them through sudo."""
+    prefix = ["sudo", "-n", "--"]
+    if sys.platform != "darwin":
+        return prefix
+    missing = [name for name in ("wg", "wireguard-go")
+               if shutil.which(name, path=MACOS_TUNNEL_PATH) is None]
+    if missing:
+        brew = shutil.which("brew", path=MACOS_TUNNEL_PATH)
+        if brew is None:
+            raise CloudExError(
+                "CloudEx requires {} on macOS. Install Homebrew, then retry CloudEx; "
+                "missing WireGuard dependencies will be installed automatically.".format(
+                    ", ".join(missing)
+                )
+            )
+        packages = ["wireguard-tools" if name == "wg" else name for name in missing]
+        if progress:
+            progress.update("Installing missing WireGuard dependencies with Homebrew")
+        environment = dict(os.environ, PATH=MACOS_TUNNEL_PATH)
+        try:
+            result = subprocess.run(
+                [brew, "install", *packages],
+                env=environment, stdin=subprocess.DEVNULL,
+                stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=600,
+            )
+        except (OSError, subprocess.TimeoutExpired) as exc:
+            raise CloudExError(
+                "Could not install WireGuard dependencies with Homebrew. " + MACOS_WIREGUARD_INSTALL
+            ) from exc
+        if result.returncode:
+            detail = (result.stderr or result.stdout or "Homebrew failed").strip()
+            raise CloudExError("WireGuard dependency installation failed: " + detail[-1024:])
+        missing = [name for name in ("wg", "wireguard-go")
+                   if shutil.which(name, path=MACOS_TUNNEL_PATH) is None]
+        if missing:
+            raise CloudExError(
+                "Homebrew completed but CloudEx still cannot find: {}. {}".format(
+                    ", ".join(missing), MACOS_WIREGUARD_INSTALL
+                )
+            )
+    return prefix + ["/usr/bin/env", "PATH=" + MACOS_TUNNEL_PATH]
+
+
 def connect(profile, store, progress, attempts=3, transport="auto"):
     """Create a session and return its durable local record."""
     from .installer import ensure_forwarder
@@ -561,6 +610,7 @@ def connect(profile, store, progress, attempts=3, transport="auto"):
     existing = _reconcile_existing_connection(profile, store, progress)
     if existing:
         return existing
+    sudo_prefix = _forwarder_sudo_prefix(progress=progress)
     forwarder = ensure_forwarder(progress=progress)
     choices = (["p2p"] * attempts + ["routed"] if transport == "auto"
                else ["routed"] if transport == "turn" else ["p2p"] * attempts)
@@ -610,8 +660,8 @@ def connect(profile, store, progress, attempts=3, transport="auto"):
             config_path.chmod(0o600)
             with log_path.open("x", encoding="utf-8") as log:
                 process = subprocess.Popen(
-                    [
-                        "sudo", "-n", "--", str(forwarder), "session", "--role", "user",
+                    sudo_prefix + [
+                        str(forwarder), "session", "--role", "user",
                         "--config", str(config_path), "--report", str(report_path),
                     ],
                     stdin=subprocess.DEVNULL,

{sima_cli-2.1.19 → sima_cli-2.1.21}/sima_cli/cloudex/commands.py

@@ -1,10 +1,14 @@
 """Hidden, experimental CloudEx command group."""
 
+import base64
+import json
 import os
+import uuid
 import stat
 import sys
 import time
 from datetime import datetime, timezone
+from functools import wraps
 from pathlib import Path
 
 import click
@@ -25,6 +29,7 @@ from .client import (
     run_benchmark,
 )
 from .installer import DEFAULT_BRANCH, install_forwarder
+from .neatops import NeatOps
 
 
 console = Console()
@@ -206,9 +211,33 @@ def _session_table(rows, show_benchmark=False):
     return table
 
 
+def _internal_cloudex():
+    ctx = click.get_current_context(silent=True)
+    return bool(ctx and isinstance(ctx.obj, dict) and ctx.obj.get("internal"))
+
+
+def _require_vulcan():
+    if not _internal_cloudex():
+        raise click.ClickException(
+            "CloudEx is not available on Arthas yet. Use sima-cli -i cloudex for Vulcan."
+        )
+
+
+def _vulcan_only(function):
+    @wraps(function)
+    def wrapped(*args, **kwargs):
+        _require_vulcan()
+        return function(*args, **kwargs)
+    return wrapped
+
+
 @click.group(name="cloudex", hidden=True)
-def cloudex_group():
-    """Connect to allocated DevKits through CloudEx."""
+@click.option("-i", "--internal", is_flag=True, help="Use internal Vulcan CloudEx and NeatOps authentication.")
+@click.pass_context
+def cloudex_group(ctx, internal):
+    """Manage CloudEx devices; use -i for internal Vulcan access."""
+    ctx.ensure_object(dict)
+    ctx.obj["internal"] = internal or ctx.obj.get("internal", False) or os.getenv("SIMA_CLI_INTERNAL", "0") in ("1", "true", "yes")
 
 
 @cloudex_group.command("connect")
@@ -222,6 +251,8 @@ def cloudex_group():
     is_flag=True,
     help="Read the allocation key from standard input for automation.",
 )
+@click.option("--allocation", help="Connect to your NeatOps allocation ID without copying a key.")
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
 @click.option("--transport", type=click.Choice(["auto", "p2p", "turn"]), default="auto", hidden=True)
 @click.option("--attempts", type=click.IntRange(1, 5), default=3, hidden=True)
 @click.option(
@@ -229,11 +260,16 @@ def cloudex_group():
     is_flag=True,
     help="Print each sanitized connection stage for troubleshooting.",
 )
-def connect_command(key_file, key_stdin, transport, attempts, verbose):
+@_vulcan_only
+def connect_command(key_file, key_stdin, allocation, environment, transport, attempts, verbose):
     """Connect to an allocated DevKit using a securely supplied key."""
-    if key_file and key_stdin:
-        raise click.UsageError("Use either --key-file or --key-stdin, not both.")
+    if sum(bool(value) for value in (key_file, key_stdin, allocation)) > 1:
+        raise click.UsageError("Use either --key-file or --key-stdin, not both; --allocation must be used alone.")
     try:
+        if allocation:
+            profile = _allocation_profile(_neatops_api(environment), _allocation_id(allocation))
+            _connect_profile(profile, verbose=verbose, attempts=attempts, transport=transport)
+            return
         if key_file:
             key = _read_key_file(key_file)
         elif key_stdin:
@@ -243,16 +279,7 @@ def connect_command(key_file, key_stdin, transport, attempts, verbose):
         else:
             key = click.prompt("CloudEx allocation key", hide_input=True).strip()
         profile = decode_key(key)
-        console.print("[cyan]→[/cyan] Authorizing encrypted tunnel access")
-        _authorize_supported_host()
-        with StageProgress("Preparing CloudEx connection", verbose=verbose) as progress:
-            session = connect(profile, _store(), progress, attempts=attempts, transport=transport)
-            progress.success("Connected to {}".format(session["device"]))
-        path = session.get("ice_path", "unknown")
-        path_text = "direct" if path == "direct" else "relayed" if path == "relay" else path
-        console.print("  [dim]Session[/dim]  {}".format(_short(session["session_id"])))
-        console.print("  [dim]Path[/dim]     {}".format(path_text))
-        console.print("  [dim]SSH[/dim]      [bold]ssh sima@{}[/bold]".format(session["target"]))
+        _connect_profile(profile, verbose=verbose, attempts=attempts, transport=transport)
     except CloudExError as exc:
         raise click.ClickException(str(exc)) from exc
 
@@ -264,6 +291,7 @@ def connect_command(key_file, key_stdin, transport, attempts, verbose):
     show_default=True,
     help="Kerrigan branch whose latest forwarder should be installed.",
 )
+@_vulcan_only
 def update_command(branch):
     """Install or update the native CloudEx forwarder."""
     try:
@@ -326,6 +354,7 @@ def _choose_sessions(sessions):
 @cloudex_group.command("disconnect")
 @click.option("--session", "session_id", help="Session ID or unique prefix to disconnect.")
 @click.option("--all", "disconnect_all", is_flag=True, help="Disconnect every recorded CloudEx session.")
+@_vulcan_only
 def disconnect_command(session_id, disconnect_all):
     """Disconnect one or all CloudEx sessions."""
     if session_id and disconnect_all:
@@ -373,6 +402,7 @@ def disconnect_command(session_id, disconnect_all):
 @click.option("--benchmark", is_flag=True, help="Stress-test RTT and maximum bidirectional throughput for each connection.")
 @click.option("--duration", type=click.IntRange(1, 60), default=10, show_default=True,
               help="Throughput measurement window in seconds.")
+@_vulcan_only
 def list_command(benchmark, duration):
     """List locally recorded CloudEx connections."""
     store = _store()
@@ -420,3 +450,192 @@ def list_command(benchmark, duration):
 
 def register_cloudex_commands(main):
     main.add_command(cloudex_group)
+
+
+def _connect_profile(profile, verbose=False, attempts=3, transport="auto"):
+    console.print("[cyan]→[/cyan] Authorizing encrypted tunnel access")
+    _authorize_supported_host()
+    with StageProgress("Preparing CloudEx connection", verbose=verbose) as progress:
+        session = connect(profile, _store(), progress, attempts=attempts, transport=transport)
+        progress.success("Connected to {}".format(session["device"]))
+    path = session.get("ice_path", "unknown")
+    path_text = "direct" if path == "direct" else "relayed" if path == "relay" else path
+    console.print("  [dim]Session[/dim]  {}".format(_short(session["session_id"])))
+    console.print("  [dim]Path[/dim]     {}".format(path_text))
+    console.print("  [dim]SSH[/dim]      [bold]ssh sima@{}[/bold]".format(session["target"]))
+
+
+DURATIONS = {"1h": 3600, "4h": 14400, "8h": 28800, "1d": 86400, "7d": 604800, "4w": 2419200}
+
+
+def _allocation_id(value):
+    if len(value) != 32 or any(c not in "0123456789abcdef" for c in value):
+        raise CloudExError("Use the full 32-character allocation ID from sima-cli -i cloudex devices")
+    return value
+
+
+def _allocation_profile(api, allocation_id, timeout=180):
+    deadline = time.monotonic() + timeout
+    with StageProgress("Waiting for device preparation") as progress:
+        while True:
+            inventory = api.call("GET", "/devkits")
+            allocation = next((a for a in inventory.get("allocations", []) if a["session_id"] == allocation_id), None)
+            if not allocation or allocation.get("status") in {"released", "releasing", "expired", "failed"}:
+                raise CloudExError("Allocation is unavailable; check sima-cli -i cloudex devices")
+            if allocation.get("status") in {"ready", "active"}:
+                profile = api.call("POST", "/devkits/allocations/" + allocation_id + "/profile", {})
+                # Reuse the same strict profile validation as manually supplied keys.
+                profile = decode_key(base64.b64encode(json.dumps(profile).encode()).decode())
+                progress.success("Device is ready")
+                return profile
+            if time.monotonic() >= deadline:
+                raise CloudExError("Device preparation timed out. Allocation {} is retained; retry with sima-cli -i cloudex connect --allocation {} or release it".format(allocation_id, allocation_id))
+            time.sleep(2)
+
+
+def _neatops_login(api):
+    api.login(lambda url: console.print("Open this URL in a browser on this computer:\n" + url, markup=False, soft_wrap=True))
+    console.print("[green]Signed in to NeatOps ({})[/green]".format(api.environment))
+
+
+def _neatops_api(environment):
+    _require_vulcan()
+    return NeatOps(environment, on_login_required=_neatops_login)
+
+
+@cloudex_group.command("login")
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
+def login_command(environment):
+    """Sign in to the Developer Portal, or NeatOps with -i."""
+    if not _internal_cloudex():
+        if environment != "production":
+            raise click.UsageError("--environment selects a Vulcan environment and requires -i.")
+        from sima_cli.auth.devportal import login_external
+        if not login_external(loginDocker=False):
+            raise click.ClickException("Developer Portal sign-in was not completed.")
+        console.print("Signed in to the Developer Portal. CloudEx is not available on Arthas yet.")
+        return
+    try:
+        _neatops_login(NeatOps(environment))
+    except CloudExError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
+@cloudex_group.command("logout")
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
+def logout_command(environment):
+    """Sign out of the Developer Portal, or NeatOps with -i; keep leases."""
+    if not _internal_cloudex():
+        if environment != "production":
+            raise click.UsageError("--environment selects a Vulcan environment and requires -i.")
+        from sima_cli.auth.auth0 import clear_external_login_state
+        clear_external_login_state()
+        console.print("Signed out of the Developer Portal.")
+        return
+    try:
+        NeatOps(environment).logout()
+        console.print("Signed out of NeatOps. Existing device leases are unchanged.")
+    except CloudExError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
+@cloudex_group.command("devices")
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
+@_vulcan_only
+def devices_command(environment):
+    """Show NeatOps device availability and your allocation IDs."""
+    try:
+        inventory = _neatops_api(environment).call("GET", "/devkits")
+        table = Table("Device type", "Firmware version", "ID", "Allocation ID", "State")
+        allocations = {(a["cluster_id"], a["target_id"]): a for a in inventory.get("allocations", [])}
+        visible_devices = set()
+        for d in inventory.get("devices", []):
+            device_key = (d["cluster_id"], d["id"])
+            visible_devices.add(device_key)
+            a = d.get("allocation") or allocations.get(device_key, {})
+            table.add_row(d.get("type") or "Unknown", d.get("firmware") or "Unknown", d["id"],
+                          a.get("session_id") or "—", "Available" if d["available"] else "Not available")
+        # Allocations can survive an appliance disappearing from inventory.
+        for a in inventory.get("allocations", []):
+            if (a["cluster_id"], a["target_id"]) not in visible_devices:
+                table.add_row("Unknown", "Unknown", a["target_id"], a["session_id"], "Not available")
+        console.print(table)
+    except CloudExError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
+@cloudex_group.command("request")
+@click.option("--device", help="Device ID or exact name; otherwise choose interactively.")
+@click.option("--cluster", help="Appliance ID, to disambiguate devices.")
+@click.option("--duration", type=click.Choice(list(DURATIONS)), default="1h", show_default=True)
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
+@click.option("--verbose", is_flag=True, help="Print sanitized connection stages.")
+@_vulcan_only
+def request_command(device, cluster, duration, environment, verbose):
+    """Request a NeatOps device, wait for preparation, and connect automatically."""
+    allocation_id = None
+    try:
+        api = _neatops_api(environment)
+        entitlement = api.call("GET", "/users/me/entitlement")["entitlement"]
+        if DURATIONS[duration] > entitlement["max_lease_duration_seconds"]:
+            raise CloudExError("Requested duration exceeds your NeatOps lease limit; choose a shorter duration")
+        inventory = api.call("GET", "/devkits")
+        if len(inventory.get("allocations", [])) >= entitlement["max_active_leases"]:
+            raise CloudExError("Your device lease limit is reached; connect to an existing allocation or release one")
+        candidates = [d for d in inventory.get("devices", []) if d.get("available")
+                      and (not cluster or d["cluster_id"] == cluster)
+                      and (not device or device in {d["id"], d["name"]})]
+        if not candidates:
+            raise CloudExError("No matching devices are available; check sima-cli -i cloudex devices")
+        if device and len(candidates) > 1:
+            raise CloudExError("Device name or ID is ambiguous; specify --cluster")
+        if not device:
+            table = Table("#", "Device type", "Software version", "ID")
+            for index, d in enumerate(candidates, 1):
+                table.add_row(str(index), d.get("type") or "Unknown", d.get("firmware") or "Unknown", d["id"])
+            console.print(table)
+            choice = click.prompt("Choose a device", type=click.IntRange(1, len(candidates)))
+            selected = candidates[choice - 1]
+        else:
+            selected = candidates[0]
+        # Get local administrator authorization before reserving scarce hardware.
+        _authorize_supported_host()
+        allocation_id = uuid.uuid4().hex
+        console.print("Allocation {} · {} · {}".format(allocation_id, selected["name"], duration), markup=False)
+        api.call("POST", "/devkits/allocations", {"request_id": allocation_id,
+                 "cluster_id": selected["cluster_id"], "target_id": selected["id"], "duration_seconds": DURATIONS[duration]})
+        profile = _allocation_profile(api, allocation_id)
+        _connect_profile(profile, verbose=verbose)
+    except CloudExError as exc:
+        if allocation_id:
+            console.print("Inspect: sima-cli -i cloudex devices --environment {}\nResume: sima-cli -i cloudex connect --allocation {} --environment {}\nRelease: sima-cli -i cloudex release {} --environment {}".format(environment, allocation_id, environment, allocation_id, environment), markup=False, soft_wrap=True)
+        raise click.ClickException(str(exc)) from exc
+
+
+@cloudex_group.command("release")
+@click.argument("allocation_id")
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
+@_vulcan_only
+def release_command(allocation_id, environment):
+    """Release your NeatOps lease and disconnect its local CloudEx sessions."""
+    try:
+        allocation_id = _allocation_id(allocation_id)
+        store = _store()
+        failures = []
+        for session in store.list():
+            if session.get("allocation_id") == allocation_id:
+                try:
+                    with StageProgress("Disconnecting CloudEx") as progress:
+                        disconnect_session(session, store, progress)
+                except CloudExError as exc:
+                    failures.append("Tunnel cleanup failed: {}. Local retry state retained; retry sima-cli -i cloudex disconnect.".format(exc))
+        try:
+            _neatops_api(environment).call("DELETE", "/devkits/allocations/" + allocation_id)
+        except CloudExError as exc:
+            failures.append("Lease release failed: {}".format(exc))
+        else:
+            console.print("Lease released; device availability returns after cleanup is confirmed.")
+        if failures:
+            raise CloudExError("; ".join(failures))
+    except CloudExError as exc:
+        raise click.ClickException(str(exc)) from exc