urun-cli 0.5.2__tar.gz → 0.5.4__tar.gz

urun_cli-0.5.4/CHANGELOG.md

@@ -0,0 +1,123 @@
+# Changelog
+
+## 0.5.4
+
+- Ship the serving-engine dependency map (`urun.catalog.ENGINE_DEPS`) additions
+  and pin syncs that landed on `main` after `v0.5.3` but were never released:
+  the `kyutai-moshi`, `moshi-vis`, `stt`, `tts`, `echo-stt`, and `echo-speak`
+  engine shapes (#98), the sphn 0.2.x / `moshi==0.2.13` pin syncs (#100, #101),
+  and the platform `llamacpp-diffusion` wheel pin (#104). The installed
+  `v0.5.3` CLI's strict fail-loud guard therefore refused live dev deploys of
+  `urun serve hibiki-zero-3b:bf16` / `urun serve moshivis:bf16` ("serve engine
+  'kyutai-moshi' is not in the CLI's known serving-engine set ...") even though
+  `main`'s map was already in sync with urun-python — the drift was the stale
+  RELEASE, not the source. This release carries the synced map to PyPI.
+- Make that strict refusal self-diagnosing: the error now names the RUNNING
+  CLI version and tells the operator to upgrade first (`uv tool upgrade
+  urun-cli`), and only then to suspect genuine source drift from urun-python's
+  `urun.serve.engines.extras.ENGINE_DEPS` (which the cross-repo parity test
+  guards in CI). The old text sent operators to edit a map that was already
+  correct at `origin/main`.
+
+- Make the org-secrets store the canonical source for app-declared
+  `Credentials(env=..., optional_env=...)`. On `urun deploy`, each declared name
+  is resolved against the org-secrets store FIRST — org-level secrets plus this
+  app's app-level secrets, exactly the set the control plane injects into the
+  runtime pod env. A name already in the store is used as-is and is NEVER read
+  from or overridden by the deployer's shell (no silent shadowing of an org
+  secret by a stray local value). Only declared names the store does not yet hold
+  are filled from the local environment and delivered through the documented
+  app-scoped fallback channel. A REQUIRED credential resolvable from NEITHER the
+  store NOR the local env fails loud at deploy (never a silent drop that
+  resurfaces as a 401 inside the cluster); a missing OPTIONAL credential is
+  skipped silently (its contract). Previously the deploy read declared
+  credentials ONLY from the deployer's shell and failed if they were unset there
+  even when the org secret existed — and pushed the local value as an app secret
+  that shadowed the canonical org secret. Secret values are never printed.
+- Add `urun get secret <NAME>` (metadata only — the store never returns values)
+  to round out the secret CRUD alongside `urun set secret` / `urun list secrets`
+  / `urun delete secret`. `urun set secret <NAME>` with neither `--value` nor
+  `--from-file` now reads the value from a non-echoing secure prompt so it never
+  lands in shell history / argv.
+
+- Make `urun deploy` resilient to transient network blips. The manifest/blob
+  push and the "Waiting for build to complete" build-status poll now retry on
+  transient failures (read/connect timeouts, connection resets, 5xx, 429) with
+  exponential backoff + jitter (base 1s, factor 2, cap 30s) instead of fatally
+  exiting on the first `network error: The read operation timed out`. A single
+  failed status read backs off and re-polls — the build continues server-side —
+  while a real build failure or a 4xx auth/validation error still fails fast and
+  loud. Every retry is logged (`transient ...; retrying in Ns`) so backoff is
+  visible, never silent. New `urun.retry` module centralizes the
+  transient-vs-terminal classification and backoff policy.
+
+- Add experimental `urun list apps` subcommand. Reads from a new control-plane
+  endpoint `GET /apps` (server-side edge function not yet shipped). The STATUS
+  column projects the app's current lifecycle phase to one of `provisioning`,
+  `ready`, `pending`, `paused`, or `failed`; see the README or
+  `urun list apps --help` for the full mapping. Supports `--json` for the raw
+  payload.
+- Add experimental `urun list sessions` subcommand. Lists live and historical
+  sessions for the org, with per-row STARTED / DURATION / STATE / DETAIL.
+  Newest sessions print at the bottom of the table (tail-friendly). Supports
+  `--limit` (default 100), `--state` (filter to a single backend
+  status), and `--json`. Reads from a new control-plane endpoint
+  `GET /sessions` (server-side edge function not yet shipped).
+- Add experimental `urun list compute` subcommand. Lists the compute slices
+  the org currently has provisioned, broken down per (app, function,
+  compute_shape) with INSTANCES (allocated/ready), GPU UNITS
+  (allocated/ready), live SESSIONS count, and snapshot AGE. Slices with no
+  provisioned GPU units are omitted server-side so the listing reflects
+  what is running right now (`urun list apps` for the full deployment
+  catalogue; `urun list sessions` for history). Supports `--limit`
+  (default 100) and `--json`. Reads from a new control-plane
+  endpoint `GET /compute` (server-side edge function not yet shipped).
+- Add experimental `urun app status|scale|disable|enable` lifecycle commands
+  for managing a single deployed app (addressed by slug, org-scoped via the API
+  key). `app status` shows the build/deployment/capacity/live-session rollup;
+  `app scale --replicas N` sets the deployment's desired replica count (use 0 to
+  drain; GPU/shape stay fixed at deploy time, so only `--replicas` is exposed);
+  `app disable` disables an app — driving it to `paused`/
+  `disabled` so the control-plane materializer stops recreating its runtime —
+  with an interactive confirmation (`--yes` to skip); `app enable` reverses it.
+  All accept `--environment` (default `prod`) and `--json`. Backed by a
+  new server-side `app` edge function (`GET /app/<slug>`,
+  `POST /app/<slug>/scale`, `DELETE /app/<slug>`, `POST /app/<slug>/activate`).
+- Remove duplicate command surfaces in favor of one canonical spelling:
+  `urun app status` replaces `urun get app`, `urun app scale` replaces
+  `urun scale app`, and bare `urun org` replaces `urun org id` /
+  `urun get org-id`. `urun get org` remains for the richer org-config summary.
+
+## 0.5.3
+
+- Publish the previously-unreleased `urun app purge` and `urun build purge`
+  subcommands. Both landed on `main` after the `v0.5.2` tag was cut, and the
+  release workflow skips re-publishing when the `pyproject` version is unchanged,
+  so they were never available on PyPI. This is a version-bump-only release that
+  carries the existing, already-tested commands to PyPI so CI/operators can run
+  `uvx --from urun-cli==0.5.3 urun app purge <slug>` (hard-delete orphaned app
+  metadata after `urun app delete`) without a private git install. No CLI
+  behavior changes beyond making these commands installable.
+
+## 0.3.0
+
+- Implement the `urun org` / `urun org id` command: print the caller's org id
+  (resolved via the control-plane org-config endpoint).
+- Implement `urun auth jwks set`: register the org's trusted JWKS for federated
+  identity, via `--jwks-url` or `--jwks-json` (file or stdin), with optional
+  `--issuer`/`--audience`. This registers a trust relationship only; JWTs are
+  issued out of band and the CLI never mints, fetches, or stores one.
+- Add `ApiClient.register_trusted_jwks`, calling `POST /org-config/trusted-jwks`.
+
+## 0.2.0
+
+- Bumped past 0.1.1/0.1.2 because both filenames were occupied by previously-deleted PyPI artifacts.
+- Drop the org-id requirement from `urun deploy`; authentication now relies solely on the API key.
+- Add `urun login`, `urun run`, and `urun org`/`urun auth` subcommands.
+
+## 0.1.0
+
+- Initial public `urun deploy` CLI.
+- Deploy from a Python app file with local Python imports included automatically.
+- Source manifest generation, dependency declaration upload, and API deploy flow.
+- Public docs for the config-free v1 CLI surface.

{urun_cli-0.5.2 → urun_cli-0.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: urun-cli
-Version: 0.5.2
+Version: 0.5.4
 Summary: End-user CLI for deploying apps to urun
 Project-URL: Homepage, https://urun.sh
 Project-URL: Repository, https://github.com/urun-sh/urun-cli
@@ -51,21 +51,26 @@ uvx urun-cli --version
 
 ## Quick start
 
-Today, an operator manually vends an org-scoped deploy API key. Save it locally
-with `urun login`:
+Save an org-scoped deploy API key locally with `urun login`:
 
 ```bash
-urun login --api-key urun_<32hex>
+urun login
 ```
 
-`urun login` verifies the key with the urun API and stores credentials for later
-commands. The future browser-based login flow is not available in this CLI
-release.
+If `URUN_API_KEY` is not already set, `urun login` opens the urun console API
+keys page, prompts you to paste the generated `urun_sk_...` key, verifies it
+with the urun API, and stores credentials for later commands.
+
+If you already have a key, you can pass it directly:
+
+```bash
+urun login --api-key urun_sk_<secret>
+```
 
 For CI or one-off commands, you can still use the environment variable:
 
 ```bash
-export URUN_API_KEY=urun_<32hex>
+export URUN_API_KEY=urun_sk_<secret>
 ```
 
 Create `app.py`:
@@ -93,6 +98,24 @@ In this release, `urun run` uses the same deploy pipeline as `urun deploy`.
 `deploy` remains available as the lower-level command while the full
 deploy/run/monitor workflow is being built.
 
+### Launch the prompt-canary browser demo
+
+For the official `urun-examples` prompt-canary app, the shortest browser stream
+path is:
+
+```bash
+cd ~/workspace/urun-examples
+urun deploy prompt_canary/backend/app.py --name prompt-canary --timeout 900
+urun demo prompt-canary
+```
+
+`urun demo` currently supports `prompt-canary` only. It uses your stored API key
+server-side to request a short-lived browser JWT, sets the required
+`NEXT_PUBLIC_URUN_*` environment variables, starts the local Next.js frontend,
+and opens it in your browser. Override the examples checkout with
+`--examples-root` or `URUN_EXAMPLES_ROOT`; override the session API with
+`--session-url` or `URUN_SESSION_BASE_URL`.
+
 ## Serve a model from the catalog
 
 `urun serve` deploys a model straight from the urun model catalog — no app code
@@ -274,20 +297,26 @@ urun app scale lingbot --replicas 0   # drain to zero without retiring
 GPU count and compute shape are fixed at deploy time per release (set via
 `@app.function`), so `scale` intentionally exposes only `--replicas`.
 
-Retire an app so the control plane stops running it (drives the deployment
+Disable an app so the control plane stops running it (drives the deployment
 to `paused` and the app to `disabled`, so the materializer stops recreating
 its runtime). This is the clean, reversible, API-driven alternative to a
 manual database edit:
 
 ```bash
-urun app delete lingbot-handle      # prompts for confirmation
-urun app delete lingbot-handle --yes  # or urun app rm lingbot-handle --yes
+urun app disable lingbot-handle        # prompts for confirmation
+urun app disable lingbot-handle --yes  # skip confirmation
+```
+
+Enable a disabled app and bring it back online:
+
+```bash
+urun app enable lingbot-handle
 ```
 
-Reverse a retire and bring the app back online:
+Stop a queued, starting, or live session:
 
 ```bash
-urun app activate lingbot-handle
+urun stop session sess_123 --yes
 ```
 
 All `app` subcommands accept `--environment` (default `prod`) and `--json`.

{urun_cli-0.5.2 → urun_cli-0.5.4}/README.md

@@ -29,21 +29,26 @@ uvx urun-cli --version
 
 ## Quick start
 
-Today, an operator manually vends an org-scoped deploy API key. Save it locally
-with `urun login`:
+Save an org-scoped deploy API key locally with `urun login`:
 
 ```bash
-urun login --api-key urun_<32hex>
+urun login
 ```
 
-`urun login` verifies the key with the urun API and stores credentials for later
-commands. The future browser-based login flow is not available in this CLI
-release.
+If `URUN_API_KEY` is not already set, `urun login` opens the urun console API
+keys page, prompts you to paste the generated `urun_sk_...` key, verifies it
+with the urun API, and stores credentials for later commands.
+
+If you already have a key, you can pass it directly:
+
+```bash
+urun login --api-key urun_sk_<secret>
+```
 
 For CI or one-off commands, you can still use the environment variable:
 
 ```bash
-export URUN_API_KEY=urun_<32hex>
+export URUN_API_KEY=urun_sk_<secret>
 ```
 
 Create `app.py`:
@@ -71,6 +76,24 @@ In this release, `urun run` uses the same deploy pipeline as `urun deploy`.
 `deploy` remains available as the lower-level command while the full
 deploy/run/monitor workflow is being built.
 
+### Launch the prompt-canary browser demo
+
+For the official `urun-examples` prompt-canary app, the shortest browser stream
+path is:
+
+```bash
+cd ~/workspace/urun-examples
+urun deploy prompt_canary/backend/app.py --name prompt-canary --timeout 900
+urun demo prompt-canary
+```
+
+`urun demo` currently supports `prompt-canary` only. It uses your stored API key
+server-side to request a short-lived browser JWT, sets the required
+`NEXT_PUBLIC_URUN_*` environment variables, starts the local Next.js frontend,
+and opens it in your browser. Override the examples checkout with
+`--examples-root` or `URUN_EXAMPLES_ROOT`; override the session API with
+`--session-url` or `URUN_SESSION_BASE_URL`.
+
 ## Serve a model from the catalog
 
 `urun serve` deploys a model straight from the urun model catalog — no app code
@@ -252,20 +275,26 @@ urun app scale lingbot --replicas 0   # drain to zero without retiring
 GPU count and compute shape are fixed at deploy time per release (set via
 `@app.function`), so `scale` intentionally exposes only `--replicas`.
 
-Retire an app so the control plane stops running it (drives the deployment
+Disable an app so the control plane stops running it (drives the deployment
 to `paused` and the app to `disabled`, so the materializer stops recreating
 its runtime). This is the clean, reversible, API-driven alternative to a
 manual database edit:
 
 ```bash
-urun app delete lingbot-handle      # prompts for confirmation
-urun app delete lingbot-handle --yes  # or urun app rm lingbot-handle --yes
+urun app disable lingbot-handle        # prompts for confirmation
+urun app disable lingbot-handle --yes  # skip confirmation
+```
+
+Enable a disabled app and bring it back online:
+
+```bash
+urun app enable lingbot-handle
 ```
 
-Reverse a retire and bring the app back online:
+Stop a queued, starting, or live session:
 
 ```bash
-urun app activate lingbot-handle
+urun stop session sess_123 --yes
 ```
 
 All `app` subcommands accept `--environment` (default `prod`) and `--json`.

{urun_cli-0.5.2 → urun_cli-0.5.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "urun-cli"
-version = "0.5.2"
+version = "0.5.4"
 description = "End-user CLI for deploying apps to urun"
 readme = "README.md"
 requires-python = ">=3.11"

{urun_cli-0.5.2 → urun_cli-0.5.4}/src/urun/api.py

@@ -117,6 +117,12 @@ class ApiClient:
             {"reason": reason} if reason else {},
         )
 
+    def create_demo_token(self, app: str, function_name: str | None = None) -> dict[str, Any]:
+        body: dict[str, Any] = {"app": app}
+        if function_name:
+            body["function"] = function_name
+        return self._post("/cli/demo-token", body)
+
     def list_compute(self, limit: int | None = None) -> dict[str, Any]:
         """List currently-provisioned compute slices for the authenticated org.
 
@@ -163,12 +169,6 @@ class ApiClient:
     def get_capacity_lease(self, lease_id: str) -> dict[str, Any]:
         return self._get(f"/cli/capacity-leases/{urllib.parse.quote(lease_id, safe='')}")
 
-    def create_capacity_lease(self, payload: dict[str, Any]) -> dict[str, Any]:
-        return self._post("/cli/capacity-leases", payload)
-
-    def cancel_capacity_lease(self, lease_id: str) -> dict[str, Any]:
-        return self._post(f"/cli/capacity-leases/{urllib.parse.quote(lease_id, safe='')}/cancel")
-
     def list_builds(self, params: dict[str, Any] | None = None) -> dict[str, Any]:
         return self._get("/cli/builds", params)
 
@@ -180,6 +180,78 @@ class ApiClient:
             f"/cli/builds/{urllib.parse.quote(build_id, safe='')}/logs", {"tail": tail}
         )
 
+    def purge_build(self, manifest_hash_or_prefix: str) -> dict[str, Any]:
+        return self._delete(
+            f"/cli/builds/{urllib.parse.quote(manifest_hash_or_prefix, safe='')}/purge"
+        )
+
+    def build_app(
+        self, prompt: str, app: str | None = None, visibility: str | None = None
+    ) -> dict[str, Any]:
+        """Enqueue a steerable builder-agent run.
+
+        Mirrors the uRun MCP builder surface (``build_app`` / ``iterate_app`` /
+        ``debug_app`` plus the builder steering tools). The MCP tools enqueue by
+        INSERTing rows directly into Supabase (``public.builder_runs`` /
+        ``public.builder_steering``) with a service-role key — there is no
+        costly-agents HTTP service. A CLI must never hold a service-role key, so
+        the CLI mirrors the same logical operations and the same request-body
+        field names but routes them through the org-API-key control-plane REST
+        plane (``/cli/builders...``), which performs the privileged insert
+        server-side (edge function TBD, same convention as
+        ``list_apps``/``list_sessions``).
+        """
+        body: dict[str, Any] = {"mode": "build", "prompt": prompt}
+        if app:
+            body["app"] = app
+        if visibility:
+            body["visibility"] = visibility
+        return self._post("/cli/builders", body)
+
+    def iterate_app(self, app: str, request: str, repo: str | None = None) -> dict[str, Any]:
+        body: dict[str, Any] = {"mode": "feature", "app": app, "request": request}
+        if repo:
+            body["repo"] = repo
+        return self._post("/cli/builders", body)
+
+    def debug_app(
+        self, app: str, symptom: str | None = None, repo: str | None = None
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"mode": "debug", "app": app}
+        if symptom:
+            body["symptom"] = symptom
+        if repo:
+            body["repo"] = repo
+        return self._post("/cli/builders", body)
+
+    def list_builders(self, limit: int | None = None) -> dict[str, Any]:
+        return self._get("/cli/builders", {"limit": limit})
+
+    def get_builder(self, agent_id: str) -> dict[str, Any]:
+        return self._get(f"/cli/builders/{urllib.parse.quote(agent_id, safe='')}")
+
+    def message_builder(self, agent_id: str, message: str) -> dict[str, Any]:
+        return self._post(
+            f"/cli/builders/{urllib.parse.quote(agent_id, safe='')}/message", {"message": message}
+        )
+
+    def resolve_builder_checkpoint(
+        self,
+        agent_id: str,
+        decision: str,
+        amend: dict[str, Any] | None = None,
+        reason: str | None = None,
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"decision": decision}
+        if amend is not None:
+            body["amend"] = amend
+        if reason is not None:
+            body["reason"] = reason
+        return self._post(f"/cli/builders/{urllib.parse.quote(agent_id, safe='')}/resolve", body)
+
+    def stop_builder(self, agent_id: str) -> dict[str, Any]:
+        return self._post(f"/cli/builders/{urllib.parse.quote(agent_id, safe='')}/stop")
+
     def list_releases(self, app: str, environment: str | None = None) -> dict[str, Any]:
         return self._get("/cli/releases", {"app": app, "environment": environment})
 
@@ -238,35 +310,15 @@ class ApiClient:
     def list_api_keys(self) -> dict[str, Any]:
         return self._get("/cli/api-keys")
 
-    def create_api_key(self, label: str, service_account: str | None = None) -> dict[str, Any]:
-        return self._post("/cli/api-keys", {"label": label, "service_account": service_account})
-
-    def revoke_api_key(self, key_id: str) -> dict[str, Any]:
-        return self._post(f"/cli/api-keys/{urllib.parse.quote(key_id, safe='')}/revoke")
-
     def list_service_accounts(self) -> dict[str, Any]:
         return self._get("/cli/service-accounts")
 
-    def create_service_account(self, name: str) -> dict[str, Any]:
-        return self._post("/cli/service-accounts", {"name": name})
-
-    def delete_service_account(self, account_id: str) -> dict[str, Any]:
-        return self._delete(f"/cli/service-accounts/{urllib.parse.quote(account_id, safe='')}")
-
     def list_members(self) -> dict[str, Any]:
         return self._get("/cli/members")
 
     def get_member(self, actor_id: str) -> dict[str, Any]:
         return self._get(f"/cli/members/{urllib.parse.quote(actor_id, safe='')}")
 
-    def invite_member(self, email: str, role: str) -> dict[str, Any]:
-        return self._post("/cli/members/invite", {"email": email, "role": role})
-
-    def set_member_role(self, actor_id: str, role: str) -> dict[str, Any]:
-        return self._post(
-            f"/cli/members/{urllib.parse.quote(actor_id, safe='')}/role", {"role": role}
-        )
-
     def list_activity(self, params: dict[str, Any] | None = None) -> dict[str, Any]:
         return self._get("/cli/activity", params)
 
@@ -279,74 +331,27 @@ class ApiClient:
     def get_issue(self, issue: str) -> dict[str, Any]:
         return self._get(f"/cli/issues/{urllib.parse.quote(issue, safe='')}")
 
-    def set_issue_status(self, issue: str, status: str, note: str | None = None) -> dict[str, Any]:
-        return self._post(
-            f"/cli/issues/{urllib.parse.quote(issue, safe='')}/status",
-            {"status": status, "note": note},
-        )
-
     def list_alert_rules(self) -> dict[str, Any]:
         return self._get("/cli/alert-rules")
 
     def get_alert_rule(self, rule_id: str) -> dict[str, Any]:
         return self._get(f"/cli/alert-rules/{urllib.parse.quote(rule_id, safe='')}")
 
-    def create_alert_rule(self, payload: dict[str, Any]) -> dict[str, Any]:
-        return self._post("/cli/alert-rules", payload)
-
-    def update_alert_rule(self, rule_id: str, payload: dict[str, Any]) -> dict[str, Any]:
-        return self._post(f"/cli/alert-rules/{urllib.parse.quote(rule_id, safe='')}", payload)
-
-    def delete_alert_rule(self, rule_id: str) -> dict[str, Any]:
-        return self._delete(f"/cli/alert-rules/{urllib.parse.quote(rule_id, safe='')}")
-
     def list_alert_channels(self) -> dict[str, Any]:
         return self._get("/cli/alert-channels")
 
-    def create_alert_channel(self, kind: str, payload: dict[str, Any]) -> dict[str, Any]:
-        return self._post(f"/cli/alert-channels/{urllib.parse.quote(kind, safe='')}", payload)
-
-    def set_alert_channel_enabled(self, channel_id: str, enabled: bool) -> dict[str, Any]:
-        return self._post(
-            f"/cli/alert-channels/{urllib.parse.quote(channel_id, safe='')}/enabled",
-            {"enabled": enabled},
-        )
-
-    def delete_alert_channel(self, channel_id: str) -> dict[str, Any]:
-        return self._delete(f"/cli/alert-channels/{urllib.parse.quote(channel_id, safe='')}")
-
     def list_git_installations(self) -> dict[str, Any]:
         return self._get("/cli/git-installations")
 
     def list_git_repos(self) -> dict[str, Any]:
         return self._get("/cli/git-repos")
 
-    def link_app(self, app: str, payload: dict[str, Any]) -> dict[str, Any]:
-        return self._post(f"/cli/apps/{urllib.parse.quote(app, safe='')}/git", payload)
-
-    def unlink_app(self, app: str) -> dict[str, Any]:
-        return self._delete(f"/cli/apps/{urllib.parse.quote(app, safe='')}/git")
-
-    def deploy_app_from_git(self, app: str, branch: str | None = None) -> dict[str, Any]:
-        body: dict[str, Any] = {}
-        if branch is not None:
-            body["branch"] = branch
-        return self._post(f"/cli/apps/{urllib.parse.quote(app, safe='')}/deploy", body)
-
     def list_marketplace_apps(self, params: dict[str, Any] | None = None) -> dict[str, Any]:
         return self._get("/cli/marketplace-apps", params)
 
     def get_marketplace_app(self, slug: str) -> dict[str, Any]:
         return self._get(f"/cli/marketplace-apps/{urllib.parse.quote(slug, safe='')}")
 
-    def install_app(self, slug: str, environment: str | None = None) -> dict[str, Any]:
-        body: dict[str, Any] = {}
-        if environment is not None:
-            body["environment"] = environment
-        return self._post(
-            f"/cli/marketplace-apps/{urllib.parse.quote(slug, safe='')}/install", body
-        )
-
     def app_status(self, app: str, environment: str | None = None) -> dict[str, Any]:
         """Fetch the detailed lifecycle status for a single app.
 
@@ -378,19 +383,19 @@ class ApiClient:
         return self._json("POST", f"/app/{urllib.parse.quote(app, safe='')}/scale", body)
 
     def delete_app(self, app: str, environment: str | None = None) -> dict[str, Any]:
-        """Retire (deactivate) an app deployment.
+        """Disable an app deployment.
 
         Hits ``DELETE /app/<slug>``, which drives the deployment to ``paused``
         (and the app to ``disabled``) so the control-plane materializer stops
         recreating the app's runtime StatefulSet. Reversible with
         :meth:`activate_app`. The org is derived from the API key. Returns
-        ``{"app": {...}}`` with the retired deployment.
+        ``{"app": {...}}`` with the disabled deployment.
         """
         body: dict[str, Any] | None = {"environment": environment} if environment else None
         return self._json("DELETE", f"/app/{urllib.parse.quote(app, safe='')}", body)
 
     def activate_app(self, app: str, environment: str | None = None) -> dict[str, Any]:
-        """Reverse a retire: reactivate a previously-deleted app deployment.
+        """Enable a previously disabled app deployment.
 
         Hits ``POST /app/<slug>/activate`` (status back to ``active``), so the
         materializer resumes recreating the app's StatefulSet. The org is
@@ -399,6 +404,15 @@ class ApiClient:
         body: dict[str, Any] | None = {"environment": environment} if environment else None
         return self._json("POST", f"/app/{urllib.parse.quote(app, safe='')}/activate", body)
 
+    def purge_app(self, app: str) -> dict[str, Any]:
+        """Permanently purge orphaned app metadata for a partially-deleted app.
+
+        Hits ``DELETE /cli/apps/<slug>/purge``. The backend scopes the purge to
+        the API key's org and refuses to act while deployment rows still exist,
+        so ordinary deployed apps must use lifecycle commands first.
+        """
+        return self._delete(f"/cli/apps/{urllib.parse.quote(app, safe='')}/purge")
+
     def org_config(self) -> dict[str, Any]:
         return self._json("GET", "/org-config", None)
 
@@ -415,6 +429,73 @@ class ApiClient:
         """
         return self._json("POST", "/org-config/auth-connections", payload)
 
+    # --- MCP-parity reads -------------------------------------------------- #
+    # The uRun MCP reads GPU metrics straight from cube and runtime/deploy state
+    # straight from Supabase PostgREST with privileged server-only credentials
+    # (cube API secret / service-role key). The CLI cannot and must not hold
+    # those, so — exactly like the existing query_logs -> /cli/logs and
+    # list_failure_groups -> /cli/failure-groups mirrors — it routes the SAME
+    # semantics through the org-API-key control-plane edge surface (/cli/...).
+
+    def get_gpu_metrics(self, app: str, params: dict[str, Any] | None = None) -> dict[str, Any]:
+        return self._get(f"/cli/gpu-metrics/{urllib.parse.quote(app, safe='')}", params)
+
+    def get_runtime_health(self, app: str, function_name: str | None = None) -> dict[str, Any]:
+        return self._get(
+            f"/cli/runtime-health/{urllib.parse.quote(app, safe='')}",
+            {"function": function_name},
+        )
+
+    def get_deploy_status(self, app: str, environment: str | None = None) -> dict[str, Any]:
+        return self._get(
+            f"/cli/deploy-status/{urllib.parse.quote(app, safe='')}",
+            {"environment": environment},
+        )
+
+    # --- Platform feedback ------------------------------------------------- #
+    def raise_feedback(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/cli/feedback", payload)
+
+    def comment_feedback(self, feedback_id: str, body: str) -> dict[str, Any]:
+        return self._post(
+            f"/cli/feedback/{urllib.parse.quote(feedback_id, safe='')}/comments",
+            {"body": body},
+        )
+
+    def get_feedback(self, feedback_id: str) -> dict[str, Any]:
+        return self._get(f"/cli/feedback/{urllib.parse.quote(feedback_id, safe='')}")
+
+    def list_feedback(self) -> dict[str, Any]:
+        return self._get("/cli/feedback")
+
+    # --- Dev gate ---------------------------------------------------------- #
+    def run_dev_gate(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/cli/dev-gate", payload)
+
+    # --- Console: dashboards + view defaults ------------------------------- #
+    def create_dashboard(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/cli/dashboards", payload)
+
+    def save_dashboard_config(self, dashboard_ref: str, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post(
+            f"/cli/dashboards/{urllib.parse.quote(dashboard_ref, safe='')}/config", payload
+        )
+
+    def set_view_default(self, surface: str, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post(f"/cli/view-defaults/{urllib.parse.quote(surface, safe='')}", payload)
+
+    def clear_view_default(self, surface: str, scope: str) -> dict[str, Any]:
+        return self._delete(
+            f"/cli/view-defaults/{urllib.parse.quote(surface, safe='')}", {"scope": scope}
+        )
+
+    # --- Org config deltas ------------------------------------------------- #
+    def set_org_limits(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/org-config/limits", payload)
+
+    def remove_auth_connection(self, issuer: str) -> dict[str, Any]:
+        return self._delete("/org-config/auth-connections", {"issuer": issuer})
+
     def _json(self, method: str, path: str, body: dict[str, Any] | None) -> dict[str, Any]:
         data = (
             None