feat(cli): login progress spinner, auth status --check, client status --wait (#138)

[saadqbal]

Closes #138. Part of the installer first-run UX v2 spec (umbrella backend#992; interim copy fixes shipped in client#307). The installer shells out to the CLI for sign-in, session state, and connect verification — these three output/contract changes make the approved installer copy renderable and honest.

1. login — progress display

• Poll loop extracted into pollForToken, wrapped in a live ui.Spinner (braille frame + mm:ss elapsed + (Ctrl-C to cancel)).
• TTY-gated: piped / --plain / NO_COLOR output prints one static line — no \r, no ANSI. The spinner line clears on exit so the ✔ prints in its place.
• Sign-in fields relabelled open:/code: → Open/Enter (imperative ui.Action rows).
• "Token saved to ~/.tracebloc (0600)." demoted to a dim, verbose-only detail — the happy path is just ✔ Signed in as ….

2. auth status --check

Machine-readable session probe. Exit 0 only when a token is present and the backend accepts it (live WhoAmI); exit 1 when signed out or the token is rejected. Silent by default (exit-1 is a nil-inner exitError, so main prints nothing); --verbose narrates the verdict. The installer's session-probe step stops grepping prose.

3. client status [--wait] [--timeout]

Reports the backend's view of this machine's active client (online/offline/pending). --wait polls the same source client list renders until the backend reports it online (exit 0) or the timeout elapses (non-zero, with a plain-language last-state line). This is the honest 🟢 Online signal (RFC-0001 §8.5) — the installer's closing claim was inferred only from a local kubectl rollout check, which can't tell whether tracebloc can actually see the client.

Acceptance (all covered by tests)

• login on a TTY shows spinner + elapsed; --plain/piped stays static (no raw ANSI) — verified by a static-path test + a race-free direct draw test of the mm:ss format.
• auth status --check: 0 signed-in-valid / 1 signed-out or rejected; no output unless --verbose.
• client status --wait: 0 only on backend-reported online; non-zero on timeout with a last-state line.

New ui: Spinner (animate-vs-static contract) + Action rows. Polling reuses the existing pollAfter seam plus a new clientStatusPollInterval var so tests drive many iterations with no real delay.

Local: full go test ./... -race green; go vet, gofmt, errcheck, goimports clean. Built the binary and smoke-tested --check exit codes + help wiring.

Coordination notes

• Branches off the current develop (1de77d2, includes feat(cli): auto-discover the client's namespace, rewrite the first-touch surface, ship a tb alias #142). Sibling PR feat(cli): auto-name clients <firstname>-NN + make --location optional (#137) #144 (cli#137) also edits auth.go's runLogin (a one-line prof.FirstName add in the WhoAmI block); expect a trivial conflict there — whichever merges second keeps both the FirstName line and this PR's refactor.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches authentication probing (WhoAmI, env matching) and installer exit-code contracts; mistakes could skip login or mis-report session validity, though behavior is heavily tested.

Overview
Improves installer first-run UX with three CLI contract/output changes and shared terminal helpers.

tracebloc login pulls device-token polling into pollForToken, shown behind a ui.Spinner (animated on TTY, one static line when piped/--plain/NO_COLOR). Sign-in steps use bold Open / Enter Action rows instead of dim open:/code: fields. After approval, success is ✔ Signed in as …; “token saved…” moves to verbose-only Detailf. Login poll Ctrl-C exits 130 silently.

tracebloc auth status --check (optional --env) is a silent, exit-code probe: 0 only when signed in to the target environment and WhoAmI succeeds; 1 when signed out, env mismatch (no backend call), or invalid/unverifiable session. 426 shows upgrade text even without --verbose; verbose mode distinguishes rejected tokens (401/403) from outages.

tracebloc client status reports the active client’s backend state; --wait polls until online (or --timeout, default 120s) with a spinner, fail-fast on 426, 401/403, or missing active client, and timeout messages that include last state or list errors. --timeout without --wait is rejected.

internal/ui: new Action and Spinner (Windows uses static spinner to avoid raw ANSI redraw).

Broad test coverage for --check, --wait, spinner/static paths, and edge cases from review/Bugbot.

^{Reviewed by Cursor Bugbot for commit f70e13c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 35 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#156 — feat(strategies): FedMedian Byzantine-robust aggregation (CLI: a mistyped subcommand (e.g. dataset pus) prints help and exits 0 instead of erroring #75) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#157 — feat(strategies): FedTrimmedAvg Byzantine-robust aggregation (CLI: a mistyped subcommand (e.g. dataset pus) prints help and exits 0 instead of erroring #75) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#158 — feat(strategies): Krum / MultiKrum Byzantine-robust selection (CLI: a mistyped subcommand (e.g. dataset pus) prints help and exits 0 instead of erroring #75) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#159 — feat(strategies): FedProx aggregation strategy (dataset push: --category help lists 5 of 9 categories, and unknown-vs-empty category errors give two different lists (one leaks unsupported segmentation) #74) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#160 — feat(strategies): FedOpt family — FedAdam / FedYogi / FedAdagrad (dataset push: --category help lists 5 of 9 categories, and unknown-vs-empty category errors give two different lists (one leaks unsupported segmentation) #74) · author: @shujaatTracebloc · reviewer: @divyasinghds
• backend#927 — feat(validators): schema check for tabular/text/token classification (#924 G2) · author: @divyasinghds · no reviewer assigned
• backend#931 — feat(validators): generic all-category checks + validation matrix (#924 Phase 0/G12) · author: @divyasinghds · reviewer: @saqlainsyed007
• backend#934 — feat(validators): column-level tabular/text schema diagnostics (#924 G3/G4) · author: @divyasinghds · no reviewer assigned
• backend#935 — feat(validators): time-series & survival temporal checks (#924 G8/G9) · author: @divyasinghds · reviewer: @saqlainsyed007
• backend#936 — feat(validators): text/NLP language + alignable-text checks (#924 G10) · author: @divyasinghds · reviewer: @saqlainsyed007

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

Deep review (multi-agent: 8 finder angles → independent verification per finding; the top two confirmed empirically with throwaway tests against this branch). Overall: solid craftsmanship — the spinner's animate-vs-static contract is explicit and race-free by design, --check's silence reuses the nil-inner exitError pattern, --wait polls the same source client list renders. But the probe has an environment-scoping hole that defeats its purpose in its primary consumer, and the --wait loop has no terminal state other than success.

Findings, most severe first

1. internal/cli/auth.go:285 — --check answers for the wrong environment, silently skipping the sign-in that would have fixed it.
The probe validates the stored CurrentEnv session (sessionEnv(cfg)), while login resolves its target from --env/$CLIENT_ENV (api.ResolveEnv). Reproduced empirically: prod session on the machine + installer running CLIENT_ENV=dev → --check WhoAmIs prod, exits 0, prints nothing → the installer skips tracebloc login (the exact step that would have switched CurrentEnv to dev) → client create provisions into the prod account while the chart installs pointed at dev, and client status --wait polls a backend that will never see the client. There is no --env flag on auth status to correct it. Suggest: give --check login's env resolution (an --env flag defaulting to ResolveEnv("")), or exit 1 whenever ResolveEnv(target) != cfg.CurrentEnv.

2. client.go:665–687 — the --wait loop treats every failure as transient; terminal states burn the full timeout, then misdiagnose.
Two confirmed facets, one fix site:

• Revoked/expired token → every poll 401s (measured: 6,254 polls against a hard-401 backend), full 120s stall, then "last state: unreachable… Check the client is running, then retry." — the client may be perfectly online; the credential is dead, and a 426's actionable "upgrade your CLI" message is swallowed.
• Deleted active client → found=false forever, same full timeout, same wrong "unreachable" label — while the one-shot path fast-fails this exact state with the correct message (line 652).
  Suggest: inside the loop, treat *api.APIError 401/403, *api.UpgradeRequiredError, and persistent found=false as terminal.

3. internal/ui/ui.go:289 — the animated spinner writes raw \r\033[K + SGR straight to the writer; legacy Windows consoles render escape garbage every 120 ms.
fatih/color's own output path enables VT processing on Windows; Spinner.draw's direct Fprintf bypasses it, and install.ps1 makes the Windows path real. Suggest: route the redraw through the color-aware writer, or fall back to the static line on Windows without VT.

4. Design split — the same display-vs-probe problem is solved two different ways in one PR.
auth status grows a --check flag that flips a human display (always exit 0) into an exit-code contract — one forgotten flag from a script silently passing (auth.go:236). client status has no probe mode at all: one-shot exits 0 even for offline, and --timeout without --wait is accepted as a silent no-op (client.go:645). Suggest one consistent shape: --check semantics on both, and reject --timeout without --wait.

5. client.go:617 — --help leaks internal references.
The client status Long text ships "(RFC-0001 §8.5)" plus installer-implementation narration ("which today is inferred only from a local rollout check") to end users — the same class swept out of the rest of the CLI surface recently.

6. Failure copy names no tracebloc fix.
client.go:652: "…isn't in your account list — it may have been deleted" — reason + speculation, no next step. client.go:679: "Check the client is running, then retry." — the only obvious way a user "checks the client is running" is kubectl, which our copy must never steer toward. Point both at concrete verbs: tracebloc client list, tracebloc cluster doctor, or re-running the installer.

7. auth.go:278 — runAuthCheck re-implements authedClient() byte-for-byte (config.Load + SignedIn() + newAPIClient(sessionEnv(cfg)) + token assignment), duplicated only to discard the error message. Call the helper and drop its error.

8. client.go:700 — third hand-rolled copy of the active-client match rule (strconv.Itoa(c.ID) == active, after runClientList's marker loop and runClientUse's find loop) — worth a findClientByID helper. Rider: clientStatusPollInterval (line 631) is a dead second test seam — no test overrides it, and the stubbed pollAfter is already the injection point.

Coordination note (not a finding): this branch and open #142 touch adjacent lines of client.go (the AddCommand list vs the command Short two lines above) — whichever merges second will need a trivial conflict resolution.

Finding 1 is the blocker-grade one: it produces exactly the cross-env pollution RFC-0001's design works to prevent, and it fires the moment the installer adopts --check. Findings 2–3 are cheap; 4–8 are polish.

🤖 Review generated with Claude Code

[saadqbal]

Great review — #1 is a real cross-env trap, thanks for catching it. Pushed c4a7459 addressing all but 4a:

• 1 / 7: --check now resolves its target env like login (added an --env flag; default $CLIENT_ENV → prod) and requires it to match the signed-in CurrentEnv — else exit 1 so the installer runs the login that switches env. Probe now reuses authedClient() instead of re-implementing it.
• 2: --wait treats 401/403 as terminal (fail fast → sign in). 426 and missing-client were already terminal from the Bugbot round; the timeout message already surfaces the real error rather than "unreachable".
• 3: animated spinner falls back to the static line on Windows (the raw \r\033[K+SGR redraw bypasses fatih/color's VT-enable path).
• 4b: reject --timeout without --wait instead of silently ignoring it.
• 5: dropped "(RFC-0001 §8.5)" + the installer-impl narration from --help.
• 6: failure copy points at tracebloc client list / cluster doctor / re-run installer — no implicit kubectl.
• 8: findClientByID helper replaces the hand-rolled match in the two find-loops; clientStatusPollInterval is now a const (tests inject via pollAfter).

Deferred 4a (adding --check to client status): the probe already exists via --wait --timeout, so I didn't want to expand the surface without your call — happy to if you'd prefer the symmetry.

Regression tests for the env mismatch, 401 fast-fail, and the --timeout guard. Full suite green under -race.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 96a28f3. Configure here.}