agent_infra_cli/

lib.rs

use std::{
    fs,
    io::{self, Read},
    path::{Path, PathBuf},
    sync::Arc,
    time::Duration,
};

use agent_infra_sdk::{
    CallOptions, InfraClient, StaticCredentials,
    agent_contract::{
        AgentId, AgentStatus, CreateAgentRequest, ListAgentsRequest, UpdateAgentRequest,
    },
    context_contract::ConversationRecord,
    evaluate_contract::{
        CreateEvalRunRequest, GetOperationRequest, GetReportRequest, ListCaseRunsRequest,
        RegisterEnvironmentProfileRequest, RegisterEvaluatorVersionRequest, RegisterSuiteRequest,
    },
    runtime_identity_contract::{
        CreateRuntimeIdentityRequest, IssueRuntimeCredentialRequest, ReplacePermissionsRequest,
        RuntimeIdentityId, RuntimeIdentityKind, TransitionIdentityRequest,
        UpdateRuntimeIdentityRequest,
    },
    trace_contract::{
        CreateLangfuseProjectRequest, ListLangfuseProjectsRequest, MAX_METRICS_LOOKBACK_DAYS,
        MetricsDataSource, MetricsQuery,
    },
    workspace_contract::{
        CreateComputerRequest, CreateSpaceRequest, ListEnvironmentResourcesQuery, OwnerKind,
    },
};
use anyhow::{Context, Result, anyhow, bail};
use clap::{Args, Parser, Subcommand, ValueEnum};
use serde::{Serialize, de::DeserializeOwned};
use serde_json::Value;

mod config;

use config::{ConfigStore, resolve_credential};

const DEFAULT_GATEWAY: &str = "http://127.0.0.1:5200";

#[derive(Debug, Parser)]
#[command(
    name = "infra",
    version,
    about = "Operate Agent Infra through the typed Infra SDK",
    arg_required_else_help = true
)]
pub struct Cli {
    /// Agent Infra Gateway base URL.
    #[arg(long, global = true)]
    pub gateway: Option<String>,

    /// Gateway bearer token. Prefer SKY_GATEWAY_TOKEN over command-line use.
    #[arg(long, global = true, hide_env_values = true)]
    pub token: Option<String>,

    /// Override the local Infra CLI config file.
    #[arg(long, global = true, env = "AGENT_INFRA_CONFIG", value_name = "PATH")]
    pub config: Option<PathBuf>,

    /// Override the Sky CLI home used for local credential discovery.
    #[arg(
        long,
        global = true,
        env = "AGENT_INFRA_SKY_HOME",
        value_name = "PATH",
        hide = true
    )]
    pub sky_home: Option<PathBuf>,

    /// Request timeout in seconds.
    #[arg(long, global = true, default_value_t = 30, value_parser = clap::value_parser!(u64).range(1..=600))]
    pub timeout: u64,

    /// Permit plaintext HTTP to non-loopback hosts protected by a trusted service mesh.
    #[arg(long, global = true)]
    pub trusted_mesh_http: bool,

    /// JSON rendering mode.
    #[arg(long, global = true, value_enum, default_value_t = OutputFormat::Pretty)]
    pub output: OutputFormat,

    #[command(subcommand)]
    pub command: Command,
}

#[derive(Clone, Copy, Debug, Default, Eq, PartialEq, ValueEnum)]
pub enum OutputFormat {
    /// Indented JSON.
    #[default]
    Pretty,
    /// Compact JSON.
    Json,
}

#[derive(Debug, Subcommand)]
pub enum Command {
    /// Persist and inspect local CLI settings.
    Config {
        #[command(subcommand)]
        command: ConfigCommand,
    },
    /// Inspect local Gateway credential discovery.
    Auth {
        #[command(subcommand)]
        command: AuthCommand,
    },
    /// Inspect Gateway health, discovery, routing, and policy.
    Gateway {
        #[command(subcommand)]
        command: GatewayCommand,
    },
    /// Query trace events and Langfuse-backed usage metrics.
    Trace {
        #[command(subcommand)]
        command: TraceCommand,
    },
    /// Create and inspect Agent Registry resources.
    Agent {
        #[command(subcommand)]
        command: AgentCommand,
    },
    /// Create and manage Runtime Identity resources.
    Runtime {
        #[command(subcommand)]
        command: RuntimeCommand,
    },
    /// Read and append durable conversation context.
    Context {
        #[command(subcommand)]
        command: ContextCommand,
    },
    /// Manage Environment computers.
    Computer {
        #[command(subcommand)]
        command: ComputerCommand,
    },
    /// Manage Environment spaces.
    Space {
        #[command(subcommand)]
        command: SpaceCommand,
    },
    /// Invoke the OpenAI-compatible Model Infra API.
    Model {
        #[command(subcommand)]
        command: ModelCommand,
    },
    /// Manage versioned evaluation resources and durable runs.
    Evaluate {
        #[command(subcommand)]
        command: EvaluateCommand,
    },
}

#[derive(Debug, Subcommand)]
pub enum EvaluateCommand {
    RegisterEnvironment(JsonInput),
    RegisterEvaluator(JsonInput),
    RegisterSuite(JsonInput),
    /// Create a durable task that a matching Runtime starts through POST /evaluate.
    #[command(alias = "run")]
    TaskCreate(JsonInput),
    Operation {
        operation_id: String,
    },
    Cases(JsonInput),
    Report {
        report_id: String,
    },
}

#[derive(Debug, Subcommand)]
pub enum ConfigCommand {
    /// Show the config file and effective Gateway selection.
    Show,
    /// Manage the persisted Gateway address.
    Gateway {
        #[command(subcommand)]
        command: ConfigGatewayCommand,
    },
}

#[derive(Debug, Subcommand)]
pub enum ConfigGatewayCommand {
    /// Persist a Gateway URL locally.
    Set { url: String },
    /// Show the persisted and effective Gateway URL.
    Get,
    /// Remove the persisted Gateway URL.
    Unset,
}

#[derive(Debug, Subcommand)]
pub enum AuthCommand {
    /// Probe explicit, environment, and local Sky credential sources.
    Status,
}

#[derive(Debug, Subcommand)]
pub enum GatewayCommand {
    Discovery,
    Live,
    Ready,
    /// Poll until the Gateway and its dependencies are ready.
    WaitReady {
        #[arg(long, default_value_t = 30, value_parser = clap::value_parser!(u64).range(1..=3600))]
        deadline: u64,
    },
    Dependencies,
    Routes,
    Metrics,
    Policy,
}

#[derive(Debug, Subcommand)]
pub enum TraceCommand {
    /// Query Langfuse metrics through Trace Infra.
    Metrics {
        #[command(subcommand)]
        command: TraceMetricsCommand,
    },
    /// Allocate and query Trace-owned Langfuse projects.
    LangfuseProject {
        #[command(subcommand)]
        command: LangfuseProjectCommand,
    },
}

#[derive(Debug, Subcommand)]
pub enum LangfuseProjectCommand {
    /// Create a project from a CreateLangfuseProjectRequest JSON document.
    Create {
        #[command(flatten)]
        input: JsonInput,
        #[arg(long)]
        idempotency_key: String,
    },
    Get {
        project_id: String,
    },
    List(LangfuseProjectListArgs),
}

#[derive(Debug, Args)]
pub struct LangfuseProjectListArgs {
    #[arg(long)]
    related_agent_id: Option<String>,
    #[arg(long)]
    related_runtime_id: Option<String>,
    #[arg(long)]
    related_user_id: Option<String>,
    #[arg(long)]
    cursor: Option<String>,
    #[arg(long, value_parser = clap::value_parser!(u32).range(1..=200))]
    limit: Option<u32>,
}

#[derive(Debug, Subcommand)]
pub enum TraceMetricsCommand {
    TokenUsage(TraceMetricsArgs),
    ModelBreakdown(TraceMetricsArgs),
    ProjectSummary(TraceMetricsArgs),
    Latency(TraceMetricsArgs),
    ErrorRate(TraceMetricsArgs),
    CacheHitRate(TraceMetricsArgs),
    CostBreakdown(TraceMetricsArgs),
    ModelTrend(TraceMetricsArgs),
    TokenDistribution(TraceMetricsArgs),
    Activity(TraceMetricsArgs),
    PricingTier(TraceMetricsArgs),
}

#[derive(Debug, Args)]
pub struct TraceMetricsArgs {
    /// Filter by one or more Langfuse project IDs.
    #[arg(long = "project-id")]
    project_ids: Vec<String>,
    /// Number of days to include in the query window.
    #[arg(long, default_value_t = 30, value_parser = clap::value_parser!(u32).range(1..=3650))]
    days: u32,
    /// Select the Langfuse v3/v4 ClickHouse data path.
    #[arg(long, value_enum, default_value_t = CliMetricsDataSource::Auto)]
    data_source: CliMetricsDataSource,
    /// v3/v4 cutover boundary used when --data-source is auto.
    #[arg(long, default_value = "2026-09-01 00:00:00")]
    v4_cutover_date: String,
}

impl TraceMetricsArgs {
    fn into_query(self) -> MetricsQuery {
        MetricsQuery {
            project_ids: (!self.project_ids.is_empty()).then_some(self.project_ids),
            days: self.days.min(MAX_METRICS_LOOKBACK_DAYS),
            data_source: self.data_source.into(),
            v4_cutover_date: self.v4_cutover_date,
        }
    }
}

#[derive(Clone, Copy, Debug, Default, ValueEnum)]
pub enum CliMetricsDataSource {
    V3,
    V4,
    #[default]
    Auto,
}

impl From<CliMetricsDataSource> for MetricsDataSource {
    fn from(value: CliMetricsDataSource) -> Self {
        match value {
            CliMetricsDataSource::V3 => Self::V3,
            CliMetricsDataSource::V4 => Self::V4,
            CliMetricsDataSource::Auto => Self::Auto,
        }
    }
}

#[derive(Debug, Subcommand)]
pub enum AgentCommand {
    /// Create an agent from a CreateAgentRequest JSON document.
    Create(JsonInput),
    Get {
        agent_id: String,
    },
    List(AgentListArgs),
    /// Update an agent from an UpdateAgentRequest JSON document.
    Update {
        agent_id: String,
        #[command(flatten)]
        input: JsonInput,
    },
}

#[derive(Debug, Subcommand)]
pub enum RuntimeCommand {
    /// Create a named runtime identity.
    Create(RuntimeCreateArgs),
    /// Get a runtime identity by ID.
    Get { runtime_id: String },
    /// Change a runtime identity name without changing its ID.
    Rename {
        runtime_id: String,
        name: String,
        #[arg(long)]
        expected_revision: u64,
        #[arg(long)]
        idempotency_key: Option<String>,
    },
    /// Activate a pending runtime identity using a TransitionIdentityRequest JSON document.
    Activate {
        runtime_id: String,
        #[command(flatten)]
        input: JsonInput,
    },
    /// Suspend an active runtime identity using a TransitionIdentityRequest JSON document.
    Suspend {
        runtime_id: String,
        #[command(flatten)]
        input: JsonInput,
    },
    /// Resume a suspended runtime identity using a TransitionIdentityRequest JSON document.
    Resume {
        runtime_id: String,
        #[command(flatten)]
        input: JsonInput,
    },
    /// Revoke a runtime identity using a TransitionIdentityRequest JSON document.
    Revoke {
        runtime_id: String,
        #[command(flatten)]
        input: JsonInput,
    },
    /// Replace the complete permission grant set from a JSON document.
    Permissions {
        runtime_id: String,
        #[command(flatten)]
        input: JsonInput,
    },
    /// Exchange a one-time bootstrap proof for the first workload credential.
    BootstrapCredential {
        #[command(flatten)]
        input: JsonInput,
    },
}

#[derive(Debug, Args)]
pub struct RuntimeCreateArgs {
    /// Mutable display name. Required unless --file supplies the full request.
    #[arg(long, required_unless_present = "file")]
    name: Option<String>,
    /// Runtime workload kind. Defaults to code for inline creation.
    #[arg(long, value_enum)]
    kind: Option<CliRuntimeKind>,
    /// Override the deterministic key derived from --name.
    #[arg(long)]
    idempotency_key: Option<String>,
    /// Read a complete CreateRuntimeIdentityRequest JSON document.
    #[arg(
        long,
        short = 'f',
        value_name = "PATH",
        conflicts_with_all = ["name", "kind", "idempotency_key"]
    )]
    file: Option<PathBuf>,
}

#[derive(Clone, Copy, Debug, ValueEnum)]
enum CliRuntimeKind {
    Code,
    Evaluate,
    Tool,
    Custom,
}

impl From<CliRuntimeKind> for RuntimeIdentityKind {
    fn from(value: CliRuntimeKind) -> Self {
        match value {
            CliRuntimeKind::Code => Self::Code,
            CliRuntimeKind::Evaluate => Self::Evaluate,
            CliRuntimeKind::Tool => Self::Tool,
            CliRuntimeKind::Custom => Self::Custom,
        }
    }
}

#[derive(Debug, Args)]
pub struct AgentListArgs {
    #[arg(long, value_enum)]
    status: Option<CliAgentStatus>,
    #[arg(long)]
    related_agent_id: Option<String>,
    #[arg(long)]
    related_runtime_id: Option<String>,
    #[arg(long)]
    related_user_id: Option<String>,
    #[arg(long)]
    cursor: Option<String>,
    #[arg(long, value_parser = clap::value_parser!(u32).range(1..=200))]
    limit: Option<u32>,
}

#[derive(Clone, Copy, Debug, ValueEnum)]
enum CliAgentStatus {
    Active,
    Archived,
}

impl From<CliAgentStatus> for AgentStatus {
    fn from(value: CliAgentStatus) -> Self {
        match value {
            CliAgentStatus::Active => Self::Active,
            CliAgentStatus::Archived => Self::Archived,
        }
    }
}

#[derive(Debug, Subcommand)]
pub enum ContextCommand {
    Recent {
        conversation_id: String,
        #[arg(long, value_parser = clap::value_parser!(u64).range(1..=1000))]
        limit: Option<u64>,
        #[arg(long, value_delimiter = ',')]
        role: Vec<String>,
    },
    Search {
        conversation_id: String,
        query: String,
        #[arg(long)]
        role: Option<String>,
        #[arg(long, value_parser = clap::value_parser!(u64).range(1..=1000))]
        limit: Option<u64>,
    },
    /// Append a JSON array of ConversationRecord objects.
    Append(JsonInput),
    Maintenance,
}

#[derive(Debug, Subcommand)]
pub enum ComputerCommand {
    /// Create a computer from JSON.
    Create {
        #[command(flatten)]
        input: JsonInput,
        #[arg(long)]
        idempotency_key: String,
    },
    Get {
        computer_id: String,
    },
    List {
        #[arg(long)]
        owner_kind: Option<String>,
        #[arg(long)]
        owner_id: Option<String>,
    },
    Delete {
        computer_id: String,
        #[arg(long)]
        idempotency_key: String,
    },
}

#[derive(Debug, Subcommand)]
pub enum SpaceCommand {
    /// Create a space from JSON.
    Create {
        #[command(flatten)]
        input: JsonInput,
        #[arg(long)]
        idempotency_key: String,
    },
    Get {
        space_id: String,
    },
    List {
        #[arg(long)]
        owner_kind: Option<String>,
        #[arg(long)]
        owner_id: Option<String>,
    },
    Delete {
        space_id: String,
        #[arg(long)]
        idempotency_key: String,
    },
}

#[derive(Debug, Subcommand)]
pub enum ModelCommand {
    Models,
    /// Invoke chat/completions with a JSON request document.
    Chat {
        #[command(flatten)]
        input: JsonInput,
        #[arg(long)]
        request_id: Option<String>,
    },
    /// Invoke responses with a JSON request document.
    Responses {
        #[command(flatten)]
        input: JsonInput,
        #[arg(long)]
        request_id: Option<String>,
    },
}

#[derive(Debug, Args)]
pub struct JsonInput {
    /// JSON file to read; use '-' (the default) for standard input.
    #[arg(long, short = 'f', default_value = "-")]
    file: PathBuf,
}

impl JsonInput {
    fn read<T: DeserializeOwned>(&self) -> Result<T> {
        let bytes = read_input(&self.file)?;
        serde_json::from_slice(&bytes)
            .with_context(|| format!("invalid JSON input from {}", display_source(&self.file)))
    }
}

#[derive(Debug)]
pub enum CommandOutput {
    Json(Value),
    Text(String),
}

impl CommandOutput {
    fn json(value: impl Serialize) -> Result<Self> {
        Ok(Self::Json(serde_json::to_value(value)?))
    }

    pub fn render(&self, format: OutputFormat) -> Result<String> {
        match self {
            Self::Text(value) => Ok(value.clone()),
            Self::Json(value) => match format {
                OutputFormat::Pretty => Ok(serde_json::to_string_pretty(value)?),
                OutputFormat::Json => Ok(serde_json::to_string(value)?),
            },
        }
    }
}

impl Cli {
    pub async fn execute(self) -> Result<CommandOutput> {
        if let Command::Config { command } = &self.command {
            return execute_config(&self, command);
        }
        if let Command::Auth { command } = &self.command {
            return execute_auth(&self, command);
        }
        let client = self.build_client()?;
        match self.command {
            Command::Config { .. } | Command::Auth { .. } => {
                unreachable!("local commands returned before building the client")
            }
            Command::Gateway { command } => execute_gateway(&client, command).await,
            Command::Trace { command } => execute_trace(&client, command).await,
            Command::Agent { command } => execute_agent(&client, command).await,
            Command::Runtime { command } => execute_runtime(&client, command).await,
            Command::Context { command } => execute_context(&client, command).await,
            Command::Computer { command } => execute_computer(&client, command).await,
            Command::Space { command } => execute_space(&client, command).await,
            Command::Model { command } => execute_model(&client, command).await,
            Command::Evaluate { command } => execute_evaluate(&client, command).await,
        }
    }

    fn build_client(&self) -> Result<InfraClient> {
        let store = ConfigStore::discover(self.config.as_deref())?;
        let gateway = store.resolve_gateway(self.gateway.as_deref())?;
        let (token, _) = resolve_credential(self.token.as_deref(), self.sky_home.as_deref())?;
        let mut builder = InfraClient::builder(gateway.value)
            .request_timeout(Duration::from_secs(self.timeout))
            .trusted_mesh_http(self.trusted_mesh_http)
            .user_agent(concat!("agent-infra-cli/", env!("CARGO_PKG_VERSION")));
        if let Some(token) = token {
            builder = builder.credentials(Arc::new(StaticCredentials::new(token)?));
        }
        builder.build().map_err(Into::into)
    }
}

fn execute_config(cli: &Cli, command: &ConfigCommand) -> Result<CommandOutput> {
    let store = ConfigStore::discover(cli.config.as_deref())?;
    match command {
        ConfigCommand::Show
        | ConfigCommand::Gateway {
            command: ConfigGatewayCommand::Get,
        } => {
            let config = store.load()?;
            let effective = store.resolve_gateway(cli.gateway.as_deref())?;
            CommandOutput::json(serde_json::json!({
                "path": store.path(),
                "gateway": config.gateway,
                "effectiveGateway": effective.value,
                "source": effective.source,
            }))
        }
        ConfigCommand::Gateway {
            command: ConfigGatewayCommand::Set { url },
        } => {
            let config = store.set_gateway(url)?;
            CommandOutput::json(serde_json::json!({
                "ok": true,
                "path": store.path(),
                "gateway": config.gateway,
            }))
        }
        ConfigCommand::Gateway {
            command: ConfigGatewayCommand::Unset,
        } => {
            store.unset_gateway()?;
            CommandOutput::json(serde_json::json!({
                "ok": true,
                "path": store.path(),
                "gateway": null,
            }))
        }
    }
}

fn execute_auth(cli: &Cli, command: &AuthCommand) -> Result<CommandOutput> {
    match command {
        AuthCommand::Status => {
            let store = ConfigStore::discover(cli.config.as_deref())?;
            let gateway = store.resolve_gateway(cli.gateway.as_deref())?;
            let (_, credential) =
                resolve_credential(cli.token.as_deref(), cli.sky_home.as_deref())?;
            CommandOutput::json(serde_json::json!({
                "gateway": gateway.value,
                "gatewaySource": gateway.source,
                "credential": credential,
            }))
        }
    }
}

async fn execute_gateway(client: &InfraClient, command: GatewayCommand) -> Result<CommandOutput> {
    match command {
        GatewayCommand::Discovery => CommandOutput::json(client.gateway().discovery().await?),
        GatewayCommand::Live => CommandOutput::json(client.gateway().live().await?),
        GatewayCommand::Ready => CommandOutput::json(client.gateway().ready().await?),
        GatewayCommand::WaitReady { deadline } => CommandOutput::json(
            client
                .gateway()
                .wait_until_ready(Duration::from_secs(deadline))
                .await?,
        ),
        GatewayCommand::Dependencies => CommandOutput::json(client.gateway().dependencies().await?),
        GatewayCommand::Routes => CommandOutput::json(client.gateway().routes().await?),
        GatewayCommand::Metrics => CommandOutput::json(client.gateway().metrics().await?),
        GatewayCommand::Policy => CommandOutput::json(client.gateway().effective_policy().await?),
    }
}

async fn execute_trace(client: &InfraClient, command: TraceCommand) -> Result<CommandOutput> {
    match command {
        TraceCommand::Metrics { command } => execute_trace_metrics(client, command).await,
        TraceCommand::LangfuseProject { command } => match command {
            LangfuseProjectCommand::Create {
                input,
                idempotency_key,
            } => {
                let request: CreateLangfuseProjectRequest = input.read()?;
                CommandOutput::json(
                    client
                        .admin()
                        .create_langfuse_project(&request, &idempotency_key)
                        .await?,
                )
            }
            LangfuseProjectCommand::Get { project_id } => {
                CommandOutput::json(client.admin().langfuse_project(&project_id).await?)
            }
            LangfuseProjectCommand::List(args) => CommandOutput::json(
                client
                    .admin()
                    .list_langfuse_projects(&ListLangfuseProjectsRequest {
                        related_agent_id: args
                            .related_agent_id
                            .as_deref()
                            .map(parse_agent_id)
                            .transpose()?,
                        related_runtime_id: args.related_runtime_id,
                        related_user_id: args.related_user_id,
                        cursor: args.cursor,
                        limit: args.limit,
                    })
                    .await?,
            ),
        },
    }
}

async fn execute_trace_metrics(
    client: &InfraClient,
    command: TraceMetricsCommand,
) -> Result<CommandOutput> {
    match command {
        TraceMetricsCommand::TokenUsage(args) => {
            CommandOutput::json(client.trace().token_usage(&args.into_query()).await?)
        }
        TraceMetricsCommand::ModelBreakdown(args) => {
            CommandOutput::json(client.trace().model_breakdown(&args.into_query()).await?)
        }
        TraceMetricsCommand::ProjectSummary(args) => {
            CommandOutput::json(client.trace().project_summary(&args.into_query()).await?)
        }
        TraceMetricsCommand::Latency(args) => {
            CommandOutput::json(client.trace().latency(&args.into_query()).await?)
        }
        TraceMetricsCommand::ErrorRate(args) => {
            CommandOutput::json(client.trace().error_rate(&args.into_query()).await?)
        }
        TraceMetricsCommand::CacheHitRate(args) => {
            CommandOutput::json(client.trace().cache_hit_rate(&args.into_query()).await?)
        }
        TraceMetricsCommand::CostBreakdown(args) => {
            CommandOutput::json(client.trace().cost_breakdown(&args.into_query()).await?)
        }
        TraceMetricsCommand::ModelTrend(args) => {
            CommandOutput::json(client.trace().model_trend(&args.into_query()).await?)
        }
        TraceMetricsCommand::TokenDistribution(args) => CommandOutput::json(
            client
                .trace()
                .token_distribution(&args.into_query())
                .await?,
        ),
        TraceMetricsCommand::Activity(args) => {
            CommandOutput::json(client.trace().activity(&args.into_query()).await?)
        }
        TraceMetricsCommand::PricingTier(args) => {
            CommandOutput::json(client.trace().pricing_tier(&args.into_query()).await?)
        }
    }
}

async fn execute_agent(client: &InfraClient, command: AgentCommand) -> Result<CommandOutput> {
    match command {
        AgentCommand::Create(input) => {
            let request: CreateAgentRequest = input.read()?;
            CommandOutput::json(client.agents().create(&request).await?)
        }
        AgentCommand::Get { agent_id } => {
            let agent_id = parse_agent_id(&agent_id)?;
            CommandOutput::json(client.agents().get(&agent_id).await?)
        }
        AgentCommand::List(args) => {
            let request = ListAgentsRequest {
                status: args.status.map(Into::into),
                related_agent_id: args
                    .related_agent_id
                    .as_deref()
                    .map(parse_agent_id)
                    .transpose()?,
                related_runtime_id: args.related_runtime_id,
                related_user_id: args.related_user_id,
                cursor: args.cursor,
                limit: args.limit,
            };
            CommandOutput::json(client.agents().list(&request).await?)
        }
        AgentCommand::Update { agent_id, input } => {
            let agent_id = parse_agent_id(&agent_id)?;
            let request: UpdateAgentRequest = input.read()?;
            CommandOutput::json(client.agents().update(&agent_id, &request).await?)
        }
    }
}

async fn execute_runtime(client: &InfraClient, command: RuntimeCommand) -> Result<CommandOutput> {
    match command {
        RuntimeCommand::Create(args) => {
            let request = match args.file {
                Some(file) => JsonInput { file }.read::<CreateRuntimeIdentityRequest>()?,
                None => CreateRuntimeIdentityRequest {
                    id: None,
                    name: args
                        .name
                        .ok_or_else(|| anyhow!("--name is required for inline runtime creation"))?,
                    kind: args.kind.unwrap_or(CliRuntimeKind::Code).into(),
                    agent_id: None,
                    relations: Default::default(),
                    metadata: Default::default(),
                    idempotency_key: args.idempotency_key.unwrap_or_default(),
                },
            };
            CommandOutput::json(client.runtime_identity().create(&request).await?)
        }
        RuntimeCommand::Get { runtime_id } => {
            let runtime_id = parse_runtime_id(&runtime_id)?;
            CommandOutput::json(client.runtime_identity().get(&runtime_id).await?)
        }
        RuntimeCommand::Rename {
            runtime_id,
            name,
            expected_revision,
            idempotency_key,
        } => {
            let runtime_id = parse_runtime_id(&runtime_id)?;
            let request = UpdateRuntimeIdentityRequest {
                expected_revision,
                name,
                idempotency_key: idempotency_key.unwrap_or_default(),
            };
            CommandOutput::json(
                client
                    .runtime_identity()
                    .update(&runtime_id, &request)
                    .await?,
            )
        }
        RuntimeCommand::Activate { runtime_id, input } => {
            execute_runtime_transition(client, runtime_id, "activate", input).await
        }
        RuntimeCommand::Suspend { runtime_id, input } => {
            execute_runtime_transition(client, runtime_id, "suspend", input).await
        }
        RuntimeCommand::Resume { runtime_id, input } => {
            execute_runtime_transition(client, runtime_id, "resume", input).await
        }
        RuntimeCommand::Revoke { runtime_id, input } => {
            execute_runtime_transition(client, runtime_id, "revoke", input).await
        }
        RuntimeCommand::Permissions { runtime_id, input } => {
            let runtime_id = parse_runtime_id(&runtime_id)?;
            let request: ReplacePermissionsRequest = input.read()?;
            CommandOutput::json(
                client
                    .runtime_identity()
                    .replace_permissions(&runtime_id, &request)
                    .await?,
            )
        }
        RuntimeCommand::BootstrapCredential { input } => {
            let request: IssueRuntimeCredentialRequest = input.read()?;
            CommandOutput::json(
                client
                    .gateway()
                    .bootstrap_runtime_credential(&request)
                    .await?,
            )
        }
    }
}

async fn execute_runtime_transition(
    client: &InfraClient,
    runtime_id: String,
    action: &str,
    input: JsonInput,
) -> Result<CommandOutput> {
    let runtime_id = parse_runtime_id(&runtime_id)?;
    let request: TransitionIdentityRequest = input.read()?;
    CommandOutput::json(
        client
            .runtime_identity()
            .transition(&runtime_id, action, &request)
            .await?,
    )
}

async fn execute_context(client: &InfraClient, command: ContextCommand) -> Result<CommandOutput> {
    match command {
        ContextCommand::Recent {
            conversation_id,
            limit,
            role,
        } => {
            let roles = role.iter().map(String::as_str).collect::<Vec<_>>();
            CommandOutput::json(
                client
                    .context()
                    .recent_messages(&conversation_id, limit.map(|value| value as usize), &roles)
                    .await?,
            )
        }
        ContextCommand::Search {
            conversation_id,
            query,
            role,
            limit,
        } => CommandOutput::json(
            client
                .context()
                .search_messages(
                    &conversation_id,
                    &query,
                    role.as_deref(),
                    limit.map(|value| value as usize),
                )
                .await?,
        ),
        ContextCommand::Append(input) => {
            let messages: Vec<ConversationRecord> = input.read()?;
            if messages.is_empty() {
                bail!("append input must contain at least one message");
            }
            CommandOutput::json(client.context().append_messages(messages).await?)
        }
        ContextCommand::Maintenance => {
            CommandOutput::json(client.context().maintenance_status().await?)
        }
    }
}

async fn execute_computer(client: &InfraClient, command: ComputerCommand) -> Result<CommandOutput> {
    let environment = client.environment();
    match command {
        ComputerCommand::Create {
            input,
            idempotency_key,
        } => {
            let request: CreateComputerRequest = input.read()?;
            CommandOutput::json(
                environment
                    .create_computer(&request, &idempotency_key)
                    .await?,
            )
        }
        ComputerCommand::Get { computer_id } => {
            CommandOutput::json(environment.computer(&computer_id).await?)
        }
        ComputerCommand::List {
            owner_kind,
            owner_id,
        } => CommandOutput::json(
            environment
                .computers(Some(&list_environment_query(owner_kind, owner_id)?))
                .await?,
        ),
        ComputerCommand::Delete {
            computer_id,
            idempotency_key,
        } => CommandOutput::json(
            environment
                .delete_computer(&computer_id, &idempotency_key)
                .await?,
        ),
    }
}

async fn execute_space(client: &InfraClient, command: SpaceCommand) -> Result<CommandOutput> {
    let environment = client.environment();
    match command {
        SpaceCommand::Create {
            input,
            idempotency_key,
        } => {
            let request: CreateSpaceRequest = input.read()?;
            CommandOutput::json(environment.create_space(&request, &idempotency_key).await?)
        }
        SpaceCommand::Get { space_id } => CommandOutput::json(environment.space(&space_id).await?),
        SpaceCommand::List {
            owner_kind,
            owner_id,
        } => CommandOutput::json(
            environment
                .spaces(Some(&list_environment_query(owner_kind, owner_id)?))
                .await?,
        ),
        SpaceCommand::Delete {
            space_id,
            idempotency_key,
        } => CommandOutput::json(
            environment
                .delete_space(&space_id, &idempotency_key)
                .await?,
        ),
    }
}

fn list_environment_query(
    owner_kind: Option<String>,
    owner_id: Option<String>,
) -> Result<ListEnvironmentResourcesQuery> {
    let owner_kind = match owner_kind {
        Some(value) => Some(parse_owner_kind(&value)?),
        None => None,
    };
    if owner_kind.is_some() != owner_id.is_some() {
        bail!("--owner-kind and --owner-id must be provided together");
    }
    Ok(ListEnvironmentResourcesQuery {
        owner_kind,
        owner_id,
        contains_all: vec![],
    })
}

fn parse_owner_kind(value: &str) -> Result<OwnerKind> {
    match value.to_ascii_lowercase().as_str() {
        "user" => Ok(OwnerKind::User),
        "agent" => Ok(OwnerKind::Agent),
        "runtime" => Ok(OwnerKind::Runtime),
        other => bail!("unsupported owner kind {other:?}; expected user, agent, or runtime"),
    }
}

async fn execute_model(client: &InfraClient, command: ModelCommand) -> Result<CommandOutput> {
    match command {
        ModelCommand::Models => CommandOutput::json(client.model().models().await?),
        ModelCommand::Chat { input, request_id } => {
            let request: Value = input.read()?;
            ensure_json_object(&request)?;
            CommandOutput::json(
                client
                    .model()
                    .chat_completions(&request, call_options(request_id))
                    .await?,
            )
        }
        ModelCommand::Responses { input, request_id } => {
            let request: Value = input.read()?;
            ensure_json_object(&request)?;
            CommandOutput::json(
                client
                    .model()
                    .responses(&request, call_options(request_id))
                    .await?,
            )
        }
    }
}

async fn execute_evaluate(client: &InfraClient, command: EvaluateCommand) -> Result<CommandOutput> {
    let evaluate = client.evaluate();
    match command {
        EvaluateCommand::RegisterEnvironment(input) => {
            let request: RegisterEnvironmentProfileRequest = input.read()?;
            CommandOutput::json(evaluate.register_environment_profile(&request).await?)
        }
        EvaluateCommand::RegisterEvaluator(input) => {
            let request: RegisterEvaluatorVersionRequest = input.read()?;
            CommandOutput::json(evaluate.register_evaluator_version(&request).await?)
        }
        EvaluateCommand::RegisterSuite(input) => {
            let request: RegisterSuiteRequest = input.read()?;
            CommandOutput::json(evaluate.register_suite(&request).await?)
        }
        EvaluateCommand::TaskCreate(input) => {
            let request: CreateEvalRunRequest = input.read()?;
            let handle = evaluate.create_task(&request).await?;
            let operation = handle.refresh().await?;
            CommandOutput::json(serde_json::json!({
                "evaluateTaskId": operation.id,
                "operation": operation,
            }))
        }
        EvaluateCommand::Operation { operation_id } => {
            let request = GetOperationRequest { operation_id };
            let handle = evaluate.operation(request.operation_id).await?;
            CommandOutput::json(handle.refresh().await?)
        }
        EvaluateCommand::Cases(input) => {
            let request: ListCaseRunsRequest = input.read()?;
            CommandOutput::json(evaluate.list_case_runs(&request).await?)
        }
        EvaluateCommand::Report { report_id } => {
            let request = GetReportRequest { report_id };
            CommandOutput::json(evaluate.report(&request.report_id).await?)
        }
    }
}

fn call_options(request_id: Option<String>) -> CallOptions {
    request_id.map_or_else(CallOptions::default, |value| {
        CallOptions::default().request_id(value)
    })
}

fn ensure_json_object(value: &Value) -> Result<()> {
    if !value.is_object() {
        bail!("model request must be a JSON object");
    }
    Ok(())
}

fn parse_agent_id(value: &str) -> Result<AgentId> {
    AgentId::new(value).map_err(|message| anyhow!(message))
}

fn parse_runtime_id(value: &str) -> Result<RuntimeIdentityId> {
    RuntimeIdentityId::new(value).map_err(|message| anyhow!(message))
}

fn read_input(path: &Path) -> Result<Vec<u8>> {
    if path == Path::new("-") {
        let mut bytes = Vec::new();
        io::stdin()
            .read_to_end(&mut bytes)
            .context("failed to read standard input")?;
        Ok(bytes)
    } else {
        fs::read(path).with_context(|| format!("failed to read {}", path.display()))
    }
}

fn display_source(path: &Path) -> String {
    if path == Path::new("-") {
        "standard input".into()
    } else {
        path.display().to_string()
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use clap::CommandFactory;
    use wiremock::{
        Mock, MockServer, ResponseTemplate,
        matchers::{body_json, header, method, path},
    };

    #[test]
    fn clap_definition_is_valid() {
        Cli::command().debug_assert();
    }

    #[test]
    fn parses_global_options_after_subcommands() {
        let cli = Cli::try_parse_from([
            "infra",
            "gateway",
            "wait-ready",
            "--deadline",
            "42",
            "--gateway",
            "https://infra.example.com",
            "--output",
            "json",
        ])
        .unwrap();
        assert_eq!(cli.gateway.as_deref(), Some("https://infra.example.com"));
        assert_eq!(cli.output, OutputFormat::Json);
        assert!(matches!(
            cli.command,
            Command::Gateway {
                command: GatewayCommand::WaitReady { deadline: 42 }
            }
        ));
    }

    #[test]
    fn rejects_removed_workspace_subcommand() {
        let result = Cli::try_parse_from(["infra", "workspace", "write", "README.md"]);
        assert!(result.is_err());
    }

    #[test]
    fn parses_trace_metrics_query_options() {
        let cli = Cli::try_parse_from([
            "infra",
            "trace",
            "metrics",
            "token-usage",
            "--project-id",
            "project-a",
            "--project-id",
            "project-b",
            "--days",
            "7",
            "--data-source",
            "v4",
        ])
        .unwrap();
        let Command::Trace {
            command:
                TraceCommand::Metrics {
                    command: TraceMetricsCommand::TokenUsage(args),
                },
        } = cli.command
        else {
            panic!("expected trace token-usage command");
        };
        let query = args.into_query();
        assert_eq!(query.project_ids.unwrap(), ["project-a", "project-b"]);
        assert_eq!(query.days, 7);
        assert_eq!(query.data_source, MetricsDataSource::V4);
    }

    #[test]
    fn parses_langfuse_project_relationship_query() {
        let cli = Cli::try_parse_from([
            "infra",
            "trace",
            "langfuse-project",
            "list",
            "--related-agent-id",
            "agt_weather",
            "--limit",
            "20",
        ])
        .unwrap();
        assert!(matches!(
            cli.command,
            Command::Trace {
                command: TraceCommand::LangfuseProject {
                    command: LangfuseProjectCommand::List(LangfuseProjectListArgs {
                        related_agent_id: Some(ref agent_id),
                        limit: Some(20),
                        ..
                    })
                }
            } if agent_id == "agt_weather"
        ));
    }

    #[test]
    fn parses_evaluate_resource_and_task_commands() {
        let register = Cli::try_parse_from([
            "infra",
            "evaluate",
            "register-evaluator",
            "--file",
            "evaluator.json",
        ])
        .unwrap();
        assert!(matches!(
            register.command,
            Command::Evaluate {
                command: EvaluateCommand::RegisterEvaluator(_)
            }
        ));
        let task = Cli::try_parse_from(["infra", "evaluate", "task-create", "--file", "run.json"])
            .unwrap();
        assert!(matches!(
            task.command,
            Command::Evaluate {
                command: EvaluateCommand::TaskCreate(_)
            }
        ));
        let alias =
            Cli::try_parse_from(["infra", "evaluate", "run", "--file", "run.json"]).unwrap();
        assert!(matches!(
            alias.command,
            Command::Evaluate {
                command: EvaluateCommand::TaskCreate(_)
            }
        ));
    }

    #[test]
    fn reads_json_request_from_file() {
        let directory = tempfile::tempdir().unwrap();
        let path = directory.path().join("request.json");
        fs::write(&path, br#"{"model":"test"}"#).unwrap();
        let input = JsonInput { file: path };
        let value: Value = input.read().unwrap();
        assert_eq!(value["model"], "test");
    }

    #[tokio::test]
    async fn persists_and_resolves_gateway_without_network_access() {
        let directory = tempfile::tempdir().unwrap();
        let config = directory.path().join("infra.json");
        let cli = Cli::try_parse_from([
            "infra",
            "config",
            "gateway",
            "set",
            "https://infra.example.com/",
            "--config",
            config.to_str().unwrap(),
        ])
        .unwrap();
        let output = cli.execute().await.unwrap();
        let CommandOutput::Json(value) = output else {
            panic!("config set must produce JSON");
        };
        assert_eq!(value["gateway"], "https://infra.example.com");

        let store = ConfigStore::discover(Some(&config)).unwrap();
        assert_eq!(
            store.load().unwrap().gateway.as_deref(),
            Some("https://infra.example.com")
        );
    }

    #[tokio::test]
    async fn trace_metrics_command_calls_typed_sdk() {
        let server = MockServer::start().await;
        Mock::given(method("POST"))
            .and(path(
                agent_infra_sdk::trace_contract::METRICS_PROJECT_SUMMARY_PATH,
            ))
            .and(body_json(serde_json::json!({
                "projectIds": ["project-a"],
                "days": 14,
                "dataSource": "auto",
                "v4CutoverDate": "2026-09-01 00:00:00"
            })))
            .respond_with(
                ResponseTemplate::new(200).set_body_json(serde_json::json!([{
                    "projectId": "project-a",
                    "totalTokens": 15,
                    "totalInputTokens": 10,
                    "totalOutputTokens": 5,
                    "observationCount": 2,
                    "generationCount": 1,
                    "totalCost": 0.01,
                    "uniqueModels": 1,
                    "uniqueTraces": 1
                }])),
            )
            .expect(1)
            .mount(&server)
            .await;

        let server_uri = server.uri();
        let cli = Cli::try_parse_from([
            "infra",
            "--gateway",
            server_uri.as_str(),
            "trace",
            "metrics",
            "project-summary",
            "--project-id",
            "project-a",
            "--days",
            "14",
        ])
        .unwrap();
        let CommandOutput::Json(output) = cli.execute().await.unwrap() else {
            panic!("trace metrics must produce JSON");
        };
        assert_eq!(output[0]["totalTokens"], 15);
    }

    #[tokio::test]
    async fn auth_status_detects_encrypted_sky_login_without_exposing_it() {
        let directory = tempfile::tempdir().unwrap();
        let sky_home = directory.path().join("sky");
        fs::create_dir_all(&sky_home).unwrap();
        fs::write(sky_home.join("credentials"), "ENCv1:secret-ciphertext").unwrap();
        let config = directory.path().join("infra.json");
        let cli = Cli::try_parse_from([
            "infra",
            "auth",
            "status",
            "--config",
            config.to_str().unwrap(),
            "--sky-home",
            sky_home.to_str().unwrap(),
        ])
        .unwrap();

        let output = cli.execute().await.unwrap();
        let rendered = output.render(OutputFormat::Json).unwrap();
        assert!(rendered.contains("sky_login_encrypted"));
        assert!(!rendered.contains("secret-ciphertext"));
    }

    #[test]
    fn renders_compact_and_pretty_json() {
        let output = CommandOutput::Json(serde_json::json!({ "ok": true }));
        assert_eq!(output.render(OutputFormat::Json).unwrap(), r#"{"ok":true}"#);
        assert!(output.render(OutputFormat::Pretty).unwrap().contains('\n'));
    }

    #[tokio::test]
    async fn model_command_uses_sdk_route_and_bearer_credential() {
        let server = MockServer::start().await;
        Mock::given(method("GET"))
            .and(path("/v1/model/models"))
            .and(header("authorization", "Bearer test-token"))
            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
                "object": "list",
                "data": [{ "id": "test-model" }]
            })))
            .expect(1)
            .mount(&server)
            .await;

        let cli = Cli::try_parse_from([
            "infra",
            "model",
            "models",
            "--gateway",
            &server.uri(),
            "--token",
            "test-token",
        ])
        .unwrap();
        let output = cli.execute().await.unwrap();
        let CommandOutput::Json(value) = output else {
            panic!("model list must produce JSON");
        };
        assert_eq!(value["data"][0]["id"], "test-model");
    }

    #[tokio::test]
    async fn runtime_commands_create_rename_and_revoke_through_the_typed_sdk() {
        let server = MockServer::start().await;
        let directory = tempfile::tempdir().unwrap();
        let transition_request = directory.path().join("transition-runtime.json");
        fs::write(
            &transition_request,
            br#"{"expectedRevision":2,"idempotencyKey":"revoke-runtime-test","reason":"test cleanup"}"#,
        )
        .unwrap();

        Mock::given(method("POST"))
            .and(path("/internal/v1/runtime-identities"))
            .and(header("authorization", "Bearer test-token"))
            .and(body_json(serde_json::json!({
                "name": "code-dev",
                "kind": "code",
                "relations": {},
                "metadata": {},
                "idempotencyKey": ""
            })))
            .respond_with(ResponseTemplate::new(201).set_body_json(serde_json::json!({
                "identity": runtime_identity_json("code-dev", "pending", 1),
                "bootstrapToken": "rti_boot_secret"
            })))
            .expect(1)
            .mount(&server)
            .await;
        Mock::given(method("PATCH"))
            .and(path("/internal/v1/runtime-identities/rti_test"))
            .and(header("authorization", "Bearer test-token"))
            .and(body_json(serde_json::json!({
                "expectedRevision": 1,
                "name": "code-dev-renamed",
                "idempotencyKey": ""
            })))
            .respond_with(
                ResponseTemplate::new(200).set_body_json(runtime_identity_json(
                    "code-dev-renamed",
                    "pending",
                    2,
                )),
            )
            .expect(1)
            .mount(&server)
            .await;
        Mock::given(method("POST"))
            .and(path("/internal/v1/runtime-identities/rti_test:revoke"))
            .and(header("authorization", "Bearer test-token"))
            .and(body_json(serde_json::json!({
                "expectedRevision": 2,
                "idempotencyKey": "revoke-runtime-test",
                "reason": "test cleanup"
            })))
            .respond_with(
                ResponseTemplate::new(200).set_body_json(runtime_identity_json(
                    "code-dev-renamed",
                    "revoked",
                    3,
                )),
            )
            .expect(1)
            .mount(&server)
            .await;

        let create = Cli::try_parse_from([
            "infra",
            "runtime",
            "create",
            "--name",
            "code-dev",
            "--gateway",
            &server.uri(),
            "--token",
            "test-token",
        ])
        .unwrap()
        .execute()
        .await
        .unwrap();
        let CommandOutput::Json(created) = create else {
            panic!("runtime create must produce JSON");
        };
        assert_eq!(created["identity"]["id"], "rti_test");
        assert_eq!(created["identity"]["name"], "code-dev");
        assert_eq!(created["bootstrapToken"], "rti_boot_secret");

        let rename = Cli::try_parse_from([
            "infra",
            "runtime",
            "rename",
            "rti_test",
            "code-dev-renamed",
            "--expected-revision",
            "1",
            "--gateway",
            &server.uri(),
            "--token",
            "test-token",
        ])
        .unwrap()
        .execute()
        .await
        .unwrap();
        let CommandOutput::Json(renamed) = rename else {
            panic!("runtime rename must produce JSON");
        };
        assert_eq!(renamed["id"], "rti_test");
        assert_eq!(renamed["name"], "code-dev-renamed");
        assert_eq!(renamed["revision"], 2);

        let revoke = Cli::try_parse_from([
            "infra",
            "runtime",
            "revoke",
            "rti_test",
            "--file",
            transition_request.to_str().unwrap(),
            "--gateway",
            &server.uri(),
            "--token",
            "test-token",
        ])
        .unwrap()
        .execute()
        .await
        .unwrap();
        let CommandOutput::Json(revoked) = revoke else {
            panic!("runtime revoke must produce JSON");
        };
        assert_eq!(revoked["status"], "revoked");
        assert_eq!(revoked["revision"], 3);
    }

    #[tokio::test]
    async fn runtime_commands_replace_permissions_and_bootstrap_credential() {
        let server = MockServer::start().await;
        let directory = tempfile::tempdir().unwrap();
        let permissions_request = directory.path().join("permissions.json");
        fs::write(
            &permissions_request,
            br#"{"expectedRevision":0,"idempotencyKey":"grant-runtime-test","grants":[{"audience":"agent-infra","capabilities":["gateway:delegation:manage"]}]}"#,
        )
        .unwrap();
        let credential_request = directory.path().join("credential.json");
        fs::write(
            &credential_request,
            br#"{"workloadProof":"bootstrap-proof","audience":"agent-infra","capabilities":["gateway:delegation:manage"]}"#,
        )
        .unwrap();

        Mock::given(method("PUT"))
            .and(path("/internal/v1/runtime-identities/rti_test/permissions"))
            .and(header("authorization", "Bearer test-token"))
            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
                "identityId": "rti_test",
                "revision": 1,
                "grants": [{
                    "id": "grt_test",
                    "identityId": "rti_test",
                    "audience": "agent-infra",
                    "capabilities": ["gateway:delegation:manage"],
                    "createdAt": "2026-08-13T00:00:00Z"
                }]
            })))
            .expect(1)
            .mount(&server)
            .await;
        Mock::given(method("POST"))
            .and(path(
                agent_infra_sdk::gateway_contract::RUNTIME_CREDENTIAL_BOOTSTRAP_PATH,
            ))
            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
                "accessToken": "runtime-token",
                "tokenType": "Bearer",
                "expiresInSeconds": 120,
                "keyId": "runtime-key"
            })))
            .expect(1)
            .mount(&server)
            .await;

        let permissions = Cli::try_parse_from([
            "infra",
            "runtime",
            "permissions",
            "rti_test",
            "--file",
            permissions_request.to_str().unwrap(),
            "--gateway",
            &server.uri(),
            "--token",
            "test-token",
        ])
        .unwrap()
        .execute()
        .await
        .unwrap();
        let CommandOutput::Json(permissions) = permissions else {
            panic!("runtime permissions must produce JSON");
        };
        assert_eq!(permissions["revision"], 1);

        let credential = Cli::try_parse_from([
            "infra",
            "runtime",
            "bootstrap-credential",
            "--file",
            credential_request.to_str().unwrap(),
            "--gateway",
            &server.uri(),
            "--token",
            "test-token",
        ])
        .unwrap()
        .execute()
        .await
        .unwrap();
        let CommandOutput::Json(credential) = credential else {
            panic!("runtime bootstrap credential must produce JSON");
        };
        assert_eq!(credential["accessToken"], "runtime-token");
        let requests = server.received_requests().await.unwrap();
        let bootstrap = requests
            .iter()
            .find(|request| {
                request.url.path()
                    == agent_infra_sdk::gateway_contract::RUNTIME_CREDENTIAL_BOOTSTRAP_PATH
            })
            .unwrap();
        assert!(!bootstrap.headers.contains_key("authorization"));
    }

    fn runtime_identity_json(name: &str, status: &str, revision: u64) -> Value {
        serde_json::json!({
            "id": "rti_test",
            "name": name,
            "scope": { "tenantId": "tenant-test", "projectId": "project-test" },
            "kind": "code",
            "relations": {
                "runtimeIds": ["rti_test"],
                "userIds": ["user-test"]
            },
            "status": status,
            "revision": revision,
            "grantRevision": 0,
            "credentialGeneration": if status == "revoked" { 2 } else { 1 },
            "metadata": { "source": "cli-test" },
            "createdAt": "2026-08-13T00:00:00Z",
            "updatedAt": "2026-08-13T00:00:00Z"
        })
    }

    #[tokio::test]
    async fn computer_list_uses_environment_api() {
        let server = MockServer::start().await;
        Mock::given(method("GET"))
            .and(path("/internal/v1/computers"))
            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!([])))
            .expect(1)
            .mount(&server)
            .await;
        let cli =
            Cli::try_parse_from(["infra", "computer", "list", "--gateway", &server.uri()]).unwrap();

        let output = cli.execute().await.unwrap();
        let CommandOutput::Json(value) = output else {
            panic!("computer list must produce JSON");
        };
        assert_eq!(value, serde_json::json!([]));
    }
}