feat(cli): add mohub CLI generated from the API manifest

[mscolnick]

• Adds a Rust mohub CLI in apps/cli whose commands are driven by a CLI manifest generated from the API route schemas (packages/api/src/cliManifest.ts).
• Wires release/CI: apps/cli GitHub Actions workflow, cargo-dist + maturin wheel builds, shell completions/man-page asset generation, and a version-drift check (scripts/check-cli-version.mjs).
• Adds CLI docs (docs/cli.md) and updates releasing docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
marimohub-docs	Ready	Preview	Aug 13, 2026 1:37pm

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[cubic-dev-ai]

2 issues found across 38 files

Not reviewed (too large): packages/client/src/schema.ts (~11,110 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/cli/src/lib.rs">

<violation number="1" location="apps/cli/src/lib.rs:28">
P2: Authentication failures can disclose credentials embedded in the server URL because `{base_url}` is rendered verbatim; omitting it or rendering a sanitized origin would keep passwords and URL tokens out of diagnostics.</violation>
</file>

<file name="apps/cli/Cargo.toml">

<violation number="1" location="apps/cli/Cargo.toml:22">
P2: The keyring `sync-secret-service` feature stores the login token via the DBus Secret Service, which requires a running secret-service daemon (gnome-keyring/KWallet) on Linux. On headless or containerized systems (common for a self-hosted marimohub) `set_password`/`get_password` in src/config.rs (Entry::new + get/set_password) will fail at runtime, so `login`/authenticated commands break with no plaintext fallback. Consider making the secret-service backend optional or falling back to a permission-restricted config file so the CLI works without a keyring daemon.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant APIGen as API Manifest Generator
    participant Manif as CLI Manifest (JSON)
    participant CLI as mohub CLI (Rust)
    participant Config as Local Config
    participant Keyring as OS Credential Store
    participant Server as marimohub API
    participant CI as CI/CD Pipeline

    Note over Dev,CI: CLI Manifest Generation (Build-time)
    Dev->>APIGen: Run pnpm schemas:generate
    APIGen->>APIGen: Generate OpenAPI document
    APIGen->>APIGen: Transform routes to CLI manifest
    APIGen->>Manif: Write cli-manifest.json
    Note over Manif: Contains operations,<br/>params, body schemas

    Note over Dev,CI: Release Preparation
    Dev->>CI: Push semver tag
    CI->>CI: Check version drift (package.json vs Cargo.toml)

    Note over CLI,Server: Runtime CLI Execution
    CLI->>CLI: Parse manifest & build clap command tree
    CLI->>Config: Load profiles (config.json)
    CLI->>Keyring: Retrieve stored token (keyring)
    Config-->>CLI: Profile + base URL
    Keyring-->>CLI: Token (if stored)

    alt Token supplied via flags/env
        CLI->>CLI: Use --token/--token-file/MARIMOHUB_TOKEN
    else No token available
        CLI->>CLI: Prompt for login
    end

    CLI->>Server: HTTP request (GET/POST/PATCH/DELETE)
    Note over CLI,Server: Auth: Bearer token<br/>Headers: If-Match, Idempotency-Key

    alt Request is retryable (GET or has Idempotency-Key)
        Server-->>CLI: 5xx error
        CLI->>CLI: Retry with backoff (max 3 attempts)
        CLI->>Server: Retry request
    end

    Server-->>CLI: JSON/raw response
    CLI->>CLI: Format output (json/jsonl/table/csv/raw)

    Note over CLI,Server: Pagination handling
    opt Operation is paginated and --all
        CLI->>Server: Follow next_cursor
        Server-->>CLI: Next page
    end

    Note over CLI,Config: Profile Management
    CLI->>Config: Save profile (atomic write)
    CLI->>Keyring: Store/update token

    Note over CLI,Server: Authentication Flow
    CLI->>Server: GET /me (validate token)
    alt Valid token
        Server-->>CLI: User info
        CLI->>Keyring: Store token
    else Invalid token
        Server-->>CLI: 401 Unauthorized
        CLI-->>CLI: Error with help message
    end

    Note over DEV,CI: Distribution
    CI->>CI: Build native binaries (cargo-dist)
    CI->>CI: Build Python wheels (maturin)
    CI->>CI: Generate completions/man pages
    CI->>CI: Create checksums & SBOM
    CI->>CI: Attach artifacts to GitHub release

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Authentication failures can disclose credentials embedded in the server URL because {base_url} is rendered verbatim; omitting it or rendering a sanitized origin would keep passwords and URL tokens out of diagnostics.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/cli/src/lib.rs, line 28:

<comment>Authentication failures can disclose credentials embedded in the server URL because `{base_url}` is rendered verbatim; omitting it or rendering a sanitized origin would keep passwords and URL tokens out of diagnostics.</comment>

<file context>
@@ -0,0 +1,57 @@
+    #[error("{0}")]
+    #[diagnostic(code(mohub::http))]
+    Http(String),
+    #[error("authentication failed for {base_url}: {reason}")]
+    #[diagnostic(
+        code(mohub::authentication),
</file context>

Suggested change

	#[error("authentication failed for {base_url}: {reason}")]
	#[error("authentication failed: {reason}")]

[cubic-dev-ai]

All reported issues were addressed across 12 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 7 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>