fix cli argv parsing and sdk parity

Author: MajorTal

cli-argv.test.mjs

@@ -0,0 +1,273 @@
+/**
+ * Regression tests for CLI argv parsing.
+ *
+ * These stay separate from cli-e2e.test.mjs so parser failures are fast and
+ * focused: no command should reach the network when argv itself is invalid.
+ */
+
+import { describe, it, before, after, beforeEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const tempDir = mkdtempSync(join(tmpdir(), "run402-argv-"));
+const API = "https://test-api.run402.com";
+process.env.RUN402_CONFIG_DIR = tempDir;
+process.env.RUN402_API_BASE = API;
+
+const originalFetch = globalThis.fetch;
+const originalLog = console.log;
+const originalError = console.error;
+const originalExit = process.exit;
+let stdout = [];
+let stderr = [];
+let calls = [];
+
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+function requestInfo(input, init) {
+  const url = typeof input === "string" ? input : (input instanceof Request ? input.url : String(input));
+  const method = (init?.method || (input instanceof Request ? input.method : "GET") || "GET").toUpperCase();
+  const parsed = new URL(url);
+  const path = parsed.origin === API ? `${parsed.pathname}${parsed.search}` : url;
+  return { url, method, path, init };
+}
+
+function mockFetch(input, init) {
+  const info = requestInfo(input, init);
+  calls.push(info);
+  const pathNoQuery = info.path.split("?")[0];
+
+  if (pathNoQuery === "/storage/v1/blobs" && info.method === "GET") {
+    return Promise.resolve(json({ blobs: [{ key: "file.txt" }] }));
+  }
+  if (/\/functions\/hello\/logs$/.test(pathNoQuery) && info.method === "GET") {
+    return Promise.resolve(json({ logs: [{ timestamp: "2026-05-01T00:00:00Z", message: "ok" }] }));
+  }
+  if (/\/functions\/hello$/.test(pathNoQuery) && info.method === "PATCH") {
+    return Promise.resolve(json({ name: "hello", status: "updated" }));
+  }
+
+  return Promise.resolve(json({ ok: true }));
+}
+
+function captureStart() {
+  stdout = [];
+  stderr = [];
+  console.log = (...args) => stdout.push(args.map(String).join(" "));
+  console.error = (...args) => stderr.push(args.map(String).join(" "));
+}
+
+function captureStop() {
+  console.log = originalLog;
+  console.error = originalError;
+}
+
+function stderrJson() {
+  const line = stderr.find((s) => s.trim().startsWith("{"));
+  assert.ok(line, `expected JSON stderr, got: ${stderr.join("\n")}`);
+  return JSON.parse(line);
+}
+
+async function expectExit1(fn) {
+  let threw = null;
+  captureStart();
+  try {
+    await fn();
+  } catch (err) {
+    threw = err;
+  } finally {
+    captureStop();
+  }
+  assert.equal(threw?.message, "process.exit(1)");
+  return stderrJson();
+}
+
+before(async () => {
+  globalThis.fetch = mockFetch;
+  process.exit = (code) => { throw new Error(`process.exit(${code})`); };
+  const { saveProject, setActiveProjectId } = await import("./cli/core-dist/keystore.js");
+  saveProject("prj_test123", {
+    anon_key: "anon_test_key",
+    service_key: "svc_test_key",
+  });
+  setActiveProjectId("prj_test123");
+});
+
+after(() => {
+  globalThis.fetch = originalFetch;
+  console.log = originalLog;
+  console.error = originalError;
+  process.exit = originalExit;
+  delete process.env.RUN402_CONFIG_DIR;
+  delete process.env.RUN402_API_BASE;
+  rmSync(tempDir, { recursive: true, force: true });
+});
+
+beforeEach(() => {
+  calls = [];
+  captureStop();
+});
+
+describe("unknown flags", () => {
+  it("status rejects unknown flags before doing any work (GH-190)", async () => {
+    const { run } = await import("./cli/lib/status.mjs");
+    const err = await expectExit1(() => run(["--unknownflag"]));
+
+    assert.equal(err.code, "UNKNOWN_FLAG");
+    assert.equal(err.details.flag, "--unknownflag");
+    assert.equal(calls.length, 0, "invalid argv must not hit the network");
+  });
+
+  it("functions logs rejects unknown flags before fetching logs (GH-190)", async () => {
+    const { run } = await import("./cli/lib/functions.mjs");
+    const err = await expectExit1(() =>
+      run("logs", ["prj_test123", "hello", "--no-such-flag", "value"]));
+
+    assert.equal(err.code, "UNKNOWN_FLAG");
+    assert.equal(err.details.flag, "--no-such-flag");
+    assert.equal(calls.length, 0, "invalid argv must not hit the network");
+  });
+});
+
+describe("--flag=value", () => {
+  it("blob ls accepts equals-form flags (GH-189)", async () => {
+    const { run } = await import("./cli/lib/blob.mjs");
+    captureStart();
+    await run("ls", ["--project=prj_test123", "--limit=500"]);
+    captureStop();
+
+    const call = calls.find((c) => c.path.startsWith("/storage/v1/blobs?"));
+    assert.ok(call, `expected blob list request, got ${JSON.stringify(calls)}`);
+    assert.match(call.url, /limit=500/);
+    assert.ok(stdout.join("\n").includes("file.txt"));
+  });
+
+  it("functions logs accepts equals-form numeric flags (GH-189)", async () => {
+    const { run } = await import("./cli/lib/functions.mjs");
+    captureStart();
+    await run("logs", ["prj_test123", "hello", "--tail=10"]);
+    captureStop();
+
+    const call = calls.find((c) => /\/logs\?/.test(c.path));
+    assert.ok(call, `expected logs request, got ${JSON.stringify(calls)}`);
+    assert.match(call.url, /tail=10/);
+  });
+});
+
+describe("numeric flag validation", () => {
+  it("blob ls validates --limit before network (GH-186)", async () => {
+    const { run } = await import("./cli/lib/blob.mjs");
+    for (const value of ["notanumber", "0", "999999"]) {
+      calls = [];
+      const err = await expectExit1(() => run("ls", ["--project", "prj_test123", "--limit", value]));
+      assert.equal(err.code, "BAD_FLAG");
+      assert.match(err.message, /--limit/);
+      assert.equal(calls.length, 0, `bad --limit ${value} must not hit network`);
+    }
+  });
+
+  it("blob sign validates --ttl before network (GH-186)", async () => {
+    const { run } = await import("./cli/lib/blob.mjs");
+    for (const value of ["abc", "-1", "99999999"]) {
+      calls = [];
+      const err = await expectExit1(() => run("sign", ["reports/a.pdf", "--project", "prj_test123", "--ttl", value]));
+      assert.equal(err.code, "BAD_FLAG");
+      assert.match(err.message, /--ttl/);
+      assert.equal(calls.length, 0, `bad --ttl ${value} must not hit network`);
+    }
+  });
+
+  it("blob put validates --concurrency before upload init (GH-186)", async () => {
+    const { run } = await import("./cli/lib/blob.mjs");
+    const file = join(tempDir, "upload.txt");
+    writeFileSync(file, "hello");
+    const err = await expectExit1(() =>
+      run("put", [file, "--project", "prj_test123", "--concurrency", "0"]));
+
+    assert.equal(err.code, "BAD_FLAG");
+    assert.match(err.message, /--concurrency/);
+    assert.equal(calls.length, 0, "bad --concurrency must not init an upload");
+  });
+
+  it("blob put surfaces upload-init gateway errors as structured JSON (GH-186)", async () => {
+    const { run } = await import("./cli/lib/blob.mjs");
+    const file = join(tempDir, "upload-init-fails.txt");
+    writeFileSync(file, "hello");
+    const prevFetch = globalThis.fetch;
+    globalThis.fetch = (input, init) => {
+      const info = requestInfo(input, init);
+      calls.push(info);
+      if (info.path === "/storage/v1/uploads" && info.method === "POST") {
+        return Promise.resolve(json({
+          error: "Invalid apikey",
+          message: "Invalid apikey",
+          code: "INVALID_AUTH",
+          trace_id: "trc_init",
+        }, 401));
+      }
+      return mockFetch(input, init);
+    };
+    const err = await expectExit1(() =>
+      run("put", [file, "--project", "prj_test123", "--concurrency", "1"]));
+    globalThis.fetch = prevFetch;
+
+    assert.equal(err.http, 401);
+    assert.equal(err.code, "INVALID_AUTH");
+    assert.equal(err.trace_id, "trc_init");
+    assert.ok(!/\\\"code\\\"/.test(err.message ?? ""), `message should not contain stringified JSON: ${err.message}`);
+  });
+
+  it("functions update validates --memory before network (GH-186)", async () => {
+    const { run } = await import("./cli/lib/functions.mjs");
+    const err = await expectExit1(() =>
+      run("update", ["prj_test123", "hello", "--memory", "abc"]));
+
+    assert.equal(err.code, "BAD_FLAG");
+    assert.match(err.message, /--memory/);
+    assert.equal(calls.length, 0, "bad --memory must not hit network");
+  });
+});
+
+describe("project-id heuristic", () => {
+  it("projects info refuses non-prj first positional instead of using active project (GH-184)", async () => {
+    const { run } = await import("./cli/lib/projects.mjs");
+    const err = await expectExit1(() => run("info", ["proj-001"]));
+
+    assert.equal(err.code, "BAD_PROJECT_ID");
+    assert.match(err.message, /proj-001/);
+    assert.equal(calls.length, 0);
+  });
+
+  it("projects sql keeps one-arg query active-project shorthand but rejects bad-id plus extra query (GH-184)", async () => {
+    const { run } = await import("./cli/lib/projects.mjs");
+
+    captureStart();
+    await run("sql", ["SELECT 1"]);
+    captureStop();
+    assert.equal(calls.some((c) => /\/projects\/v1\/admin\/prj_test123\/sql$/.test(c.path)), true);
+
+    calls = [];
+    const err = await expectExit1(() => run("sql", ["badly-typed-id", "DELETE FROM users"]));
+    assert.equal(err.code, "BAD_PROJECT_ID");
+    assert.match(err.message, /badly-typed-id/);
+    assert.equal(calls.length, 0);
+  });
+
+  it("projects sql refuses a non-prj positional before --file (GH-184)", async () => {
+    const { run } = await import("./cli/lib/projects.mjs");
+    const sqlFile = join(tempDir, "danger.sql");
+    writeFileSync(sqlFile, "SELECT 1");
+
+    const err = await expectExit1(() => run("sql", ["proj-001", "--file", sqlFile]));
+    assert.equal(err.code, "BAD_PROJECT_ID");
+    assert.match(err.message, /proj-001/);
+    assert.equal(calls.length, 0);
+  });
+});

cli/lib/ai.mjs

@@ -13,10 +13,10 @@ Subcommands:
   usage     <project_id>
 
 Examples:
-  run402 ai translate proj-001 "Hello world" --to es
-  run402 ai translate proj-001 "Hello" --to ja --from en --context "formal business email"
-  run402 ai moderate proj-001 "content to check"
-  run402 ai usage proj-001
+  run402 ai translate prj_abc123 "Hello world" --to es
+  run402 ai translate prj_abc123 "Hello" --to ja --from en --context "formal business email"
+  run402 ai moderate prj_abc123 "content to check"
+  run402 ai usage prj_abc123
 
 Notes:
   - translate requires the AI Translation add-on on the project
@@ -44,8 +44,8 @@ Notes:
   - Counts against the project's translation word quota
 
 Examples:
-  run402 ai translate proj-001 "Hello world" --to es
-  run402 ai translate proj-001 "Hello" --to ja --from en \\
+  run402 ai translate prj_abc123 "Hello world" --to es
+  run402 ai translate prj_abc123 "Hello" --to ja --from en \\
     --context "formal business email"
 `,
 };

cli/lib/apps.mjs

@@ -23,11 +23,11 @@ Examples:
   run402 apps browse
   run402 apps browse --tag auth
   run402 apps fork ver_abc123 my-todo --tier prototype
-  run402 apps publish proj123 --description "Todo app" --tags todo,auth --visibility public --fork-allowed
-  run402 apps versions proj123
+  run402 apps publish prj_abc123 --description "Todo app" --tags todo,auth --visibility public --fork-allowed
+  run402 apps versions prj_abc123
   run402 apps inspect ver_abc123
-  run402 apps update proj123 ver_abc123 --description "Updated" --tags todo
-  run402 apps delete proj123 ver_abc123
+  run402 apps update prj_abc123 ver_abc123 --description "Updated" --tags todo
+  run402 apps delete prj_abc123 ver_abc123
 `;
 
 const SUB_HELP = {
@@ -76,8 +76,8 @@ Options:
   --fork-allowed      Allow other users to fork this app
 
 Examples:
-  run402 apps publish proj123 --description "Todo app" --tags todo,auth
-  run402 apps publish proj123 --visibility public --fork-allowed
+  run402 apps publish prj_abc123 --description "Todo app" --tags todo,auth
+  run402 apps publish prj_abc123 --visibility public --fork-allowed
 `,
   update: `run402 apps update — Update a published version's metadata
 
@@ -96,9 +96,9 @@ Options:
   --no-fork           Disable forking for this version
 
 Examples:
-  run402 apps update proj123 ver_abc123 --description "Updated"
-  run402 apps update proj123 ver_abc123 --tags todo,auth --fork-allowed
-  run402 apps update proj123 ver_abc123 --no-fork
+  run402 apps update prj_abc123 ver_abc123 --description "Updated"
+  run402 apps update prj_abc123 ver_abc123 --tags todo,auth --fork-allowed
+  run402 apps update prj_abc123 ver_abc123 --no-fork
 `,
 };