feat(cli): strix cloud — managed platform CLI (login, scans, billing, and the rest of the API)

[bearsyankees]

Summary

Adds strix cloud, a full CLI for the managed platform, so a coding agent can sign in, register assets, run scans, read findings, buy credits, and now run account setup — workspaces, plan checkout, integration installs — without a dashboard visit. The former top-level strix login moves under this namespace (nothing shipped, so no alias is kept).

Shape: strix cloud <resource> <verb> [args], one command per user-facing API operation. Every /api/v1 operation is reachable — the three cli/login protocol endpoints are composed by strix cloud login, and the per-provider integration routes are one command with a PROVIDER argument.

The transport is a declarative table plus a generic runner, so commands cannot drift from the API:

# spec.py
"scans": {
    "start": Cmd("POST", "/scans", "Start a scan.", body=_SCAN_START_BODY, wait_path="/scans/{id}"),
    "sarif": Cmd("GET", "/scans/{scanId}/sarif", "Download the findings as SARIF.", binary=True),
}
# runner.py: Cmd -> argparse parser -> request -> render -> exit code

Agent-facing behavior:

• JSON output when stdout is not a terminal, or with --json. No prompts when stdin is not a terminal.
• Exit codes: 0 success, 1 error, 2 usage, 4 authentication or plan/role limit, 5 payment required. Server messages for plan and role limits pass through unchanged — gating stays server-side.
• Every write command accepts --data as a JSON object, @file, or - for standard input, which covers request fields that have no flag.
• --wait polls until a scan, schedule run, or test-user verification reaches a final state.
• strix cloud billing topup --credits N handles the HTTP 402 machine-payment challenge: it pays with the wallet client, asks first in a terminal, and takes --yes for agents or --no-pay to print the challenge.

Workspace management and hosted onboarding handoffs:

• strix cloud workspaces list|create plus workspaces use <name|id> (workspaces.py), which mints a token for another workspace the user already belongs to and stores it — no second browser sign-in. Membership and role-based scope caps stay server-side.
• Cmd.link marks commands whose response carries a hosted URL a person must open: billing subscribe --plan <product>, billing portal, and integrations install <provider>. The runner prints the URL, opens the browser only in an interactive terminal, and takes --no-browser. The CLI never completes the payment, the OAuth consent, or the DNS change — those end at the user.

Cmd.wait_self marks operations whose start and status share one path (test-user verification), and P.flag renames a flag when a request field collides with a common option (--provider-token for the integration token field).

Docs updated for the new namespace and the onboarding handoffs: README, AGENTS.md, the managed-pentesting skill, and the coding-agents page.

Tests: tests/test_cloud_cli.py covers routing, placeholder substitution, request data from a file and standard input, binary downloads, wait polling, 402 handling for both top-ups and empty balances, checkout-link output, browser suppression in JSON mode, workspace switching, and that every table entry builds a parser.

Link to Devin session: https://app.devin.ai/sessions/40b55f0f14494290bf9fbc7c646debce
Requested by: @bearsyankees

[greptile-apps]

Greptile Summary

Adds the strix cloud managed-platform CLI, including device authentication, API-backed resource commands, workspace switching, polling, output rendering, hosted handoffs, and machine-payment handling.

• Defines the cloud API command table and generic HTTP runner.
• Adds login, logout, credential persistence, workspace switching, and billing flows.
• Updates documentation and tests for the new command surface.

Confidence Score: 3/5

The PR is not yet safe to merge because a failed credential replacement and cleanup can leave a newly issued personal API token in a temporary file.

The previously reported secret-cleanup failure remains: when replacement and subsequent unlink both fail, the login command reports the error but cannot remove platform-auth.json.tmp, leaving the token on disk.

Files Needing Attention: strix/utils/secret_files.py, strix/interface/platform_cli.py

Important Files Changed

Filename	Overview
strix/interface/cloud/runner.py	Implements generic command parsing, request execution, polling, rendering, binary downloads, hosted-link handoffs, and billing top-ups.
strix/interface/cloud/spec.py	Declares the managed-platform resource and operation mapping used to construct cloud commands.
strix/interface/platform_cli.py	Implements device authentication and controlled validation/error handling, but credential replacement can still leave an issued token in the temporary file when cleanup also fails.
strix/utils/secret_files.py	Adds protected atomic secret writes and reports cleanup failures, although an unlink failure necessarily leaves the temporary secret on disk.
strix/interface/cloud/workspaces.py	Adds workspace lookup, token minting, and storage for switching the active managed-platform workspace.
tests/test_cloud_cli.py	Covers command routing, transport behavior, polling, binary output, billing flows, links, and workspace switching.

_{Reviews (11): Last reviewed commit: "fix(cloud): preserve API auth during MPP..." | Re-trigger Greptile}

[devin-ai-integration]

@greptile

[devin-ai-integration]

@greptile

[devin-ai-integration]

Fixed in 04a77e5 — _require_api_token now rejects non-string and whitespace-only api_token values.

[devin-ai-integration]

@greptile

[devin-ai-integration]

@greptile

[devin-ai-integration]

@greptile

[devin-ai-integration]

@greptile

[devin-ai-integration]

@greptile

[devin-ai-integration]

@greptile

[devin-ai-integration]

@greptile

[bearsyankees]

@tryarcanist /review

[bearsyankees]

@greptile