Fix/vm create related bugs (#16)

* fix: improve VM wizard SSH key UX and add action shortcut commands

- Require at least one SSH key selection (WithMinSelections) to prevent
  proceeding with empty selection that would fail at create time
- Show newly added SSH keys at top of list instead of bottom
- Add "Load from file" option for SSH key creation with file validation
  and auto-populated default from ~/.ssh/*.pub
- Add shortcut commands: vm start, vm shutdown, vm hibernate, vm delete
  that accept positional instance ID and filter instance list by valid status

* fix: show SSH pub key picker instead of hardcoded default path

When loading SSH key from file, scan ~/.ssh/*.pub and present a select
list with "Enter path manually..." option, instead of auto-populating
a single hardcoded default. Well-known key types sorted first.

* fix: correct OS image in vm create help example

Use ubuntu-24.04-cuda-13.0-open-docker which is a valid image for the
1V100.6V instance type at FIN-01.

* fix: allow extra SSH args after -- separator

cobra.MaximumNArgs(1) was rejecting args after "--" since Cobra counts
all positional args together. Use ArbitraryArgs instead; the existing
ArgsLenAtDash logic already splits target from extra SSH args correctly.

Fixes: verda ssh <id> -- -L 8080:localhost:8080

* fix: upgrade verdagostack to v1.1.3 and add package release configs

Upgrade verdagostack to v1.1.3 which fixes wizard back-navigation:
- Esc in Loader-managed steps (SSH keys, storage, startup script) now
  goes back instead of cancelling the wizard
- Back navigates to the immediate prior step instead of skipping all
  completed steps

Add goreleaser configs for Homebrew tap, Scoop bucket, and Linux
packages (deb/rpm/apk).

* docs: add package install methods to README and rename release test

Add Homebrew, Scoop, and Linux package (deb/rpm/apk) install sections
to README. Fix OS image in the non-interactive example. Rename
install-test.sh to test-release-packages.sh for clarity.

* fix: configure HOMEBREW_TAP_TOKEN for brew/scoop release

Add token config to goreleaser brews/scoops sections and pass
HOMEBREW_TAP_TOKEN secret in the release workflow so goreleaser
can push formula/manifest to the homebrew-tap repo.

* fix: suppress gosec G304 false positive on user-provided SSH key path

Author: hi-lei

internal/verda-cli/cmd/ssh/ssh.go

@@ -48,7 +48,7 @@ func NewCmdSSH(f cmdutil.Factory, ioStreams cmdutil.IOStreams) *cobra.Command {
 			# Pass extra ssh arguments
 			verda ssh gpu-runner -- -L 8080:localhost:8080
 		`),
-		Args:               cobra.MaximumNArgs(1),
+		Args:               cobra.ArbitraryArgs, // extra args after "--" are passed to ssh
 		DisableFlagParsing: false,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			var target string

internal/verda-cli/cmd/vm/action.go

@@ -169,7 +169,13 @@ func runAction(cmd *cobra.Command, f cmdutil.Factory, ioStreams cmdutil.IOStream
 
 	// Select instance if not provided.
 	if opts.InstanceID == "" {
-		selected, err := selectInstance(ctx, f, ioStreams, client)
+		// When action is pre-set (shortcut commands), only show instances
+		// with statuses valid for that action.
+		var statusFilter []string
+		if opts.Action != "" {
+			statusFilter = validFromForAction(opts.Action)
+		}
+		selected, err := selectInstance(ctx, f, ioStreams, client, statusFilter...)
 		if err != nil {
 			return err
 		}
@@ -329,7 +335,7 @@ func runDeleteAgent(ctx context.Context, f cmdutil.Factory, ioStreams cmdutil.IO
 	return nil
 }
 
-func selectInstance(ctx context.Context, f cmdutil.Factory, ioStreams cmdutil.IOStreams, client *verda.Client) (string, error) {
+func selectInstance(ctx context.Context, f cmdutil.Factory, ioStreams cmdutil.IOStreams, client *verda.Client, statusFilter ...string) (string, error) {
 	var sp interface{ Stop(string) }
 	if status := f.Status(); status != nil {
 		sp, _ = status.Spinner(ctx, "Loading instances...")
@@ -342,8 +348,26 @@ func selectInstance(ctx context.Context, f cmdutil.Factory, ioStreams cmdutil.IO
 		return "", err
 	}
 
+	// Filter by status when the caller restricts to specific statuses.
+	if len(statusFilter) > 0 {
+		filtered := instances[:0]
+		for i := range instances {
+			for _, s := range statusFilter {
+				if instances[i].Status == s {
+					filtered = append(filtered, instances[i])
+					break
+				}
+			}
+		}
+		instances = filtered
+	}
+
 	if len(instances) == 0 {
-		_, _ = fmt.Fprintln(ioStreams.Out, "No instances found.")
+		if len(statusFilter) > 0 {
+			_, _ = fmt.Fprintf(ioStreams.Out, "No instances with status %s found.\n", strings.Join(statusFilter, ", "))
+		} else {
+			_, _ = fmt.Fprintln(ioStreams.Out, "No instances found.")
+		}
 		return "", nil
 	}
 
@@ -446,6 +470,21 @@ func runDeleteFlow(ctx context.Context, f cmdutil.Factory, ioStreams cmdutil.IOS
 	return nil
 }
 
+// validFromForAction returns the ValidFrom statuses for a given action name.
+// Returns nil (no filter) if the action is unknown or has no status restriction (e.g. delete).
+func validFromForAction(actionName string) []string {
+	label, ok := actionNameMap[strings.ToLower(actionName)]
+	if !ok {
+		return nil
+	}
+	for _, a := range allActions {
+		if a.Label == label {
+			return a.ValidFrom
+		}
+	}
+	return nil
+}
+
 // resolveAction maps a CLI --action flag value to an instanceAction from the valid set.
 func resolveAction(actionName string, validActions []instanceAction) (instanceAction, error) {
 	label, ok := actionNameMap[strings.ToLower(actionName)]

internal/verda-cli/cmd/vm/create.go

@@ -68,7 +68,7 @@ func NewCmdCreate(f cmdutil.Factory, ioStreams cmdutil.IOStreams) *cobra.Command
 			  --kind gpu \
 			  --instance-type 1V100.6V \
 			  --location FIN-01 \
-			  --os ubuntu-24.04-cuda-12.8-open-docker \
+			  --os ubuntu-24.04-cuda-13.0-open-docker \
 			  --os-volume-size 100 \
 			  --hostname gpu-runner \
 			  --description "GPU runner for batch jobs" \

internal/verda-cli/cmd/vm/shortcuts.go

@@ -0,0 +1,66 @@
+package vm
+
+import (
+	"github.com/spf13/cobra"
+
+	cmdutil "github/verda-cloud/verda-cli/internal/verda-cli/cmd/util"
+)
+
+// shortcutDef describes a shortcut command that delegates to runAction.
+type shortcutDef struct {
+	Use     string
+	Aliases []string
+	Short   string
+	Action  string // value passed as --action to runAction
+}
+
+var shortcuts = []shortcutDef{
+	{
+		Use:    "start <instance-id>",
+		Short:  "Start a VM instance",
+		Action: "start",
+	},
+	{
+		Use:     "shutdown <instance-id>",
+		Short:   "Shutdown a VM instance",
+		Aliases: []string{"stop"},
+		Action:  "shutdown",
+	},
+	{
+		Use:    "hibernate <instance-id>",
+		Short:  "Hibernate a VM instance",
+		Action: "hibernate",
+	},
+	{
+		Use:     "delete <instance-id>",
+		Aliases: []string{"rm"},
+		Short:   "Delete a VM instance",
+		Action:  "delete",
+	},
+}
+
+// newShortcutCmd creates a thin command that pre-sets the action and delegates to runAction.
+func newShortcutCmd(f cmdutil.Factory, ioStreams cmdutil.IOStreams, def shortcutDef) *cobra.Command {
+	opts := &actionOptions{
+		Action: def.Action,
+	}
+
+	cmd := &cobra.Command{
+		Use:     def.Use,
+		Aliases: def.Aliases,
+		Short:   def.Short,
+		Args:    cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if len(args) > 0 {
+				opts.InstanceID = args[0]
+			}
+			return runAction(cmd, f, ioStreams, opts)
+		},
+	}
+
+	cmd.Flags().StringVar(&opts.InstanceID, "id", "", "Instance ID (alternative to positional argument)")
+	cmd.Flags().BoolVar(&opts.Yes, "yes", false, "Skip confirmation for destructive actions")
+	opts.Wait.AddFlags(cmd.Flags(), true)
+
+	return cmd
+}

internal/verda-cli/cmd/vm/vm.go

@@ -25,5 +25,10 @@ func NewCmdVM(f cmdutil.Factory, ioStreams cmdutil.IOStreams) *cobra.Command {
 		NewCmdAction(f, ioStreams),
 		NewCmdAvailability(f, ioStreams),
 	)
+
+	// Shortcut commands for common actions.
+	for _, def := range shortcuts {
+		cmd.AddCommand(newShortcutCmd(f, ioStreams, def))
+	}
 	return cmd
 }

internal/verda-cli/cmd/vm/wizard.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"math"
 	"os"
+	"path/filepath"
 	"slices"
 	"strconv"
 	"strings"
@@ -659,7 +660,7 @@ func stepSSHKeys(getClient clientFunc, opts *createOptions) wizard.Step {
 				for i, c := range choices {
 					labels[i] = c.Label
 				}
-				indices, err := prompter.MultiSelect(ctx, "SSH keys to inject", labels)
+				indices, err := prompter.MultiSelect(ctx, "SSH keys to inject", labels, tui.WithMinSelections(1))
 				if err != nil {
 					return nil, err
 				}
@@ -697,7 +698,7 @@ func stepSSHKeys(getClient clientFunc, opts *createOptions) wizard.Step {
 					return nil, err
 				}
 				if newKey != nil {
-					keys = append(keys, *newKey)
+					keys = append([]verda.SSHKey{*newKey}, keys...)
 					choices = buildSSHKeyChoices(keys)
 				}
 			}
@@ -727,10 +728,40 @@ func promptAddSSHKey(ctx context.Context, prompter tui.Prompter, client *verda.C
 	if err != nil || strings.TrimSpace(name) == "" {
 		return nil, nil //nolint:nilerr // User canceled or left input blank.
 	}
-	pubKey, err := prompter.TextInput(ctx, "Public key (paste)")
-	if err != nil || strings.TrimSpace(pubKey) == "" {
-		return nil, nil //nolint:nilerr // User canceled or left input blank.
+
+	// Ask for source: load from file or paste.
+	sourceIdx, err := prompter.Select(ctx, "Public key source", []string{
+		"Load from file",
+		"Paste content",
+	})
+	if err != nil {
+		return nil, nil //nolint:nilerr // User canceled.
+	}
+
+	var pubKey string
+	switch sourceIdx {
+	case 0: // Load from file
+		filePath, err := promptSSHKeyFilePath(ctx, prompter)
+		if err != nil || filePath == "" {
+			return nil, nil //nolint:nilerr // User canceled.
+		}
+		data, err := os.ReadFile(filePath) //nolint:gosec // User-provided path from interactive prompt, validated by validateFilePath.
+		if err != nil {
+			_, _ = prompter.Confirm(ctx, fmt.Sprintf("Error: %v. Press Enter to continue.", err), tui.WithConfirmDefault(true))
+			return nil, nil
+		}
+		pubKey = string(data)
+	case 1: // Paste content
+		pubKey, err = prompter.TextInput(ctx, "Public key (paste)")
+		if err != nil || strings.TrimSpace(pubKey) == "" {
+			return nil, nil //nolint:nilerr // User canceled or left input blank.
+		}
 	}
+
+	if strings.TrimSpace(pubKey) == "" {
+		return nil, nil
+	}
+
 	created, err := client.SSHKeys.AddSSHKey(ctx, &verda.CreateSSHKeyRequest{
 		Name:      strings.TrimSpace(name),
 		PublicKey: strings.TrimSpace(pubKey),
@@ -743,6 +774,94 @@ func promptAddSSHKey(ctx context.Context, prompter tui.Prompter, client *verda.C
 	return created, nil
 }
 
+// validateFilePath checks that the input is a non-empty path to an existing file.
+var validateFilePath = func(s string) error {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return errors.New("file path is required")
+	}
+	if _, err := os.Stat(s); err != nil {
+		return fmt.Errorf("file not found: %s", s)
+	}
+	return nil
+}
+
+// promptSSHKeyFilePath discovers .pub files in ~/.ssh/ and lets the user pick
+// one, or enter a path manually. Returns "" if the user cancels.
+func promptSSHKeyFilePath(ctx context.Context, prompter tui.Prompter) (string, error) {
+	pubFiles := discoverSSHPubKeys()
+
+	if len(pubFiles) == 0 {
+		p, err := prompter.TextInput(ctx, "Public key file path",
+			tui.WithPlaceholder("~/.ssh/id_ed25519.pub"),
+			tui.WithValidation(validateFilePath),
+		)
+		if err != nil || strings.TrimSpace(p) == "" {
+			return "", err
+		}
+		return strings.TrimSpace(p), nil
+	}
+
+	labels := make([]string, len(pubFiles)+1)
+	copy(labels, pubFiles)
+	labels[len(pubFiles)] = "Enter path manually..."
+
+	idx, err := prompter.Select(ctx, "Select public key file", labels)
+	if err != nil {
+		return "", err
+	}
+	if idx < len(pubFiles) {
+		return pubFiles[idx], nil
+	}
+
+	// Manual path entry.
+	p, err := prompter.TextInput(ctx, "Public key file path",
+		tui.WithValidation(validateFilePath),
+	)
+	if err != nil || strings.TrimSpace(p) == "" {
+		return "", err
+	}
+	return strings.TrimSpace(p), nil
+}
+
+// discoverSSHPubKeys returns all .pub files found in ~/.ssh/, with well-known
+// key types (id_ed25519, id_rsa, id_ecdsa) sorted first.
+func discoverSSHPubKeys() []string {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return nil
+	}
+	sshDir := filepath.Join(home, ".ssh")
+
+	matches, _ := filepath.Glob(filepath.Join(sshDir, "*.pub"))
+	if len(matches) == 0 {
+		return nil
+	}
+
+	// Sort well-known key types to the front.
+	preferred := map[string]int{
+		"id_ed25519.pub": 0,
+		"id_rsa.pub":     1,
+		"id_ecdsa.pub":   2,
+	}
+	slices.SortFunc(matches, func(a, b string) int {
+		pa, oka := preferred[filepath.Base(a)]
+		pb, okb := preferred[filepath.Base(b)]
+		if oka && okb {
+			return pa - pb
+		}
+		if oka {
+			return -1
+		}
+		if okb {
+			return 1
+		}
+		return strings.Compare(a, b)
+	})
+
+	return matches
+}
+
 // --- Step 10: Startup Script ---
 
 const addNewScriptValue = "__add_new_script__"