v12.14.7

Update dependencies

.gitattributes

@@ -0,0 +1,12 @@
+# Set all files to use line feed endings (since we can't match only ones without an extension)
+* eol=lf
+# And then reset all the files with extensions back to default
+*.* -eol
+
+*.sh text eol=lf
+
+# lf for the docs as it's auto-generated and will otherwise trigger an uncommited error on windows
+doc/cli.markdown text eol=lf
+# crlf for the eol conversion test files
+tests/test-data/projects/docker-compose/basic/service2/file2-crlf.sh eol=crlf
+tests/test-data/projects/no-docker-compose/basic/src/windows-crlf.sh eol=crlf

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @balena-io/balena-cli

.github/ISSUE_TEMPLATE.md

@@ -1,2 +1,76 @@
-- **resin-cli version:**
-- **Operating system and architecture:**
+
+# About this issue tracker
+
+*The balena CLI (Command Line Interface) is a tool used to interact with the balena platform.
+This GitHub issue tracker is used for bug reports and feature requests regarding the CLI
+tool. General and troubleshooting questions (such as setting up your project to work with a
+balenalib base image) are encouraged to be posted to the [balena
+forums](https://forums.balena.io), which are monitored by balena's support team and where the
+community can both contribute and benefit from the answers.*
+
+*Please also check that this issue is not a duplicate. If there is another issue describing
+the same problem or feature please add comments to the existing issue.*
+
+*Thank you for your time and effort creating the issue report, and helping us improve the
+balena CLI!*
+
+---
+
+# Expected Behavior
+
+Please describe what you were expecting to happen. If applicable, please add links to
+documentation you were following, or to projects that you were trying to push/build.
+
+# Actual Behavior
+
+Please describe what actually happened instead:
+* Quoting logs and error message is useful. If possible, quote the **full** output of the
+  CLI, not just the error message.
+* Please quote the **full command line** too. Sometimes users report that they were
+  "pushing" or "building" a project, but there are several ways to do so and several
+  possible "targets" such as balenaCloud, openBalena, local balenaOS device, etc.
+  Examples:
+
+```
+balena push myApp
+balena push 192.168.0.12
+balena deploy myApp
+balena deploy myApp --build
+balena build . -a myApp
+balena build . -A armv7hf -d raspberrypi3
+```
+
+Each of the above command lines executes different code behind the scenes, so quoting the
+full command line is very helpful.
+
+Running the CLI in debug mode (`--debug` flag or `DEBUG=1` environment variable) may reveal
+additional information. The `--logs` option reveals additional information for the commands:
+
+```
+balena build . --logs
+balena deploy myApp --build --logs
+```
+
+# Steps to Reproduce the Problem
+
+This is the most important and helpful part of a bug report. If we cannot reproduce the
+problem, it is difficult to tell what the fix should be, or whether code changes have
+fixed it.
+
+1.
+1.
+1.
+
+# Specifications
+
+- **balena CLI version:** e.g. 1.2.3 (output of the `"balena version -a"` command)
+- **Cloud backend: openBalena or balenaCloud?** If unsure, it will be balenaCloud
+- **Operating system version:** e.g. Windows 10, Ubuntu 18.04, macOS 10.14.5
+- **32/64 bit OS and processor:** e.g. 32-bit Windows on 64-bit Intel processor
+- **Install method:** npm or zip package or executable installer
+- **If npm install, Node.js and npm version:** e.g. Node v8.16.0 and npm v6.4.1
+
+# Additional References
+
+If applicable, please add additional links to GitHub projects, forums.balena.io threads,
+gist.github.com, Google Drive attachments, etc.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+<!-- You can remove tags that do not apply. -->
+Resolves: # <!-- Refer an issue of this repository that this PR fixes -->  
+Change-type: major|minor|patch <!-- See https://semver.org/ -->  
+Depends-on: <url> <!-- This change depends on a PR to get merged/deployed first -->  
+See: <url> <!-- Refer to any external resource, like a PR, document or discussion -->  
+
+---
+Please check the CONTRIBUTING.md file for relevant information and some
+guidance. Keep in mind that the CLI is a cross-platform application that runs
+on Windows, macOS and Linux. Tests will be automatically run by balena CI on
+all three operating systems, but this will only help if you have added test
+code that exercises the modified or added feature code.
+
+Note that each commit message (currently only the first line) will be
+automatically copied to the CHANGELOG.md file, so try writing it in a way
+that describes the feature or fix for CLI users.
+
+If there isn't a linked issue or if the linked issue doesn't quite match the
+PR, please add a PR description to explain its purpose or the features that it
+implements. Adding PR comments to blocks of code that aren't self explanatory
+usually helps with the review process.
+
+If the PR introduces security considerations or affects the development, build
+or release process, please be sure to highlight this in the PR description.
+
+Thank you very much for your contribution!

.gitignore

@@ -12,6 +12,7 @@ lib-cov
 
 # Coverage directory used by tools like istanbul
 coverage
+.nyc_output
 
 # node-waf configuration
 .lock-wscript
@@ -24,14 +25,23 @@ build/Release
 # https://www.npmjs.org/doc/misc/npm-faq.html#should-i-check-my-node_modules-folder-into-git-
 node_modules
 
-npm-shrinkwrap.json
 package-lock.json
 .resinconf
+.balenaconf
 resinrc.yml
+balenarc.yml
 
-.idea
-.vscode
 .DS_Store
+.idea
+.nvmrc
+.vscode
 
 /tmp
 build/
+build-bin/
+build-zip/
+dist/
+
+# Ignore fast-boot cache file
+**/.fast-boot.json
+/oclif.manifest.json

.hound.yml

@@ -1,5 +1,2 @@
-coffee_script:
-  config_file: coffeelint.json
-
 javascript:
   enabled: false

.prettierrc

@@ -0,0 +1,5 @@
+{
+  "singleQuote": true,
+  "trailingComma": "all",
+  "useTabs": true
+}

.resinci.yml

@@ -0,0 +1,20 @@
+---
+npm:
+  platforms:
+    - name: linux
+      os: ubuntu
+      architecture: x86_64
+      node_versions:
+        - "10"
+        - "12"
+        - "14"
+    - name: linux
+      os: alpine
+      architecture: x86_64
+      node_versions:
+        - "10"
+        - "12"
+        - "14"
+
+docker:
+  publish: false

.travis.yml

@@ -1,22 +1,25 @@
 language: node_js
+os:
+  - linux
+  - osx
+node_js:
+  - "10"
 matrix:
-  include:
-  - node_js:
-    - '6'
-    env:
-    - CAN_DEPLOY=true
-before_install:
-- npm -g install npm@4
-script: npm run ci
+  exclude:
+    node_js: "10"
+script:
+  - node --version
+  - npm --version
+  - npm run ci
+  # - npm run build:standalone
+  # - npm run build:installer
 notifications:
   email: false
 deploy:
-  provider: npm
-  email: accounts@resin.io
-  api_key:
-    secure: phet6Du13hc1bzStbmpwy2ODNL5BFwjAmnpJ5wMcbWfI7fl0OtQ61s2+vW5hJAvm9fiRLOfiGAEiqOOtoupShZ1X8BNkC708d8+V+iZMoFh3+j6wAEz+N1sVq471PywlOuLAscOcqQNp92giCVt+4VPx2WQYh06nLsunvysGmUM=
-  skip_cleanup: true
-  on:
-    tags: true
-    condition: "$CAN_DEPLOY = 'true' && $TRAVIS_TAG =~ ^v?[[:digit:]]+\\.[[:digit:]]+\\.[[:digit:]]+"
-    repo: resin-io/resin-cli
+  - provider: script
+    script: npm run release
+    skip_cleanup: true
+    on:
+      tags: true
+      condition: "$TRAVIS_TAG =~ ^v?[[:digit:]]+\\.[[:digit:]]+\\.[[:digit:]]+"
+      repo: balena-io/balena-cli

CONTRIBUTING.md

@@ -0,0 +1,217 @@
+# Contributing
+
+The balena CLI is an open source project and your contribution is welcome!
+
+* Install the dependencies listed in the [NPM Installation](./INSTALL.md#npm-installation)
+  section of the `INSTALL.md` file. Check the section [Additional
+  Dependencies](./INSTALL.md#additional-dependencies) too.
+* Clone the `balena-cli` repository, `cd` to it and run `npm install`.
+* Build the CLI with `npm run build` or `npm test`, and execute it with `./bin/balena`
+  (on a Windows command prompt, you may need to run `node .\bin\balena`).
+
+In order to ease development:
+
+* `npm run build:fast` skips some of the build steps for interactive testing, or
+* `npm run test:source` skips testing the standalone zip packages (which is rather slow)
+* `./bin/balena-dev` uses `ts-node/register` to transpile on the fly.
+
+Before opening a PR, test your changes with `npm test`. Keep compatibility in mind, as the CLI is
+meant to run on Linux, macOS and Windows. balena CI will run test code on all three platforms, but
+this will only help if you add some test cases for your new code!
+
+## ./bin/balena-dev and oclif
+
+When using `./bin/balena-dev` with oclif-converted commands, it is currently necessary to manually
+edit the `oclif` section of `package.json` to replace `./build` with `./lib` as follows:
+
+Change from:
+```
+  "oclif": {
+    "commands": "./build/actions-oclif",
+    "hooks": {
+      "prerun": "./build/hooks/prerun/track"
+```
+
+To:
+```
+  "oclif": {
+    "commands": "./lib/actions-oclif",
+    "hooks": {
+      "prerun": "./lib/hooks/prerun/track"
+```
+
+And then remember to change it back before pushing the pull request. This is obviously error prone
+and inconvenient, and improvement suggestions are welcome: is there a better solution than
+automatically editing `package.json`? It is doable, if it is what needs to be done.
+
+## Semantic versioning and commit messages
+
+The CLI version numbering adheres to [Semantic Versioning](http://semver.org/). The following
+header/row is required in the body of a commit message, and will cause the CI build to fail if absent:
+
+```
+Change-type: patch|minor|major
+```
+
+Version numbers and commit messages are automatically added to the `CHANGELOG.md` file by the CI
+build flow, after a pull request is merged. It should not be manually edited.
+
+## Editing documentation files (CHANGELOG, README, website...)
+
+The `doc/cli.markdown` file is automatically generated by running `npm run build:doc` (which also
+runs as part of `npm run build`). That file is then pulled by scripts in the
+[balena-io/docs](https://github.com/balena-io/docs/) GitHub repo for publishing at the [CLI
+Documentation page](https://www.balena.io/docs/reference/cli/).
+
+The content sources for the auto generation of `doc/cli.markdown` are:
+
+* Selected sections of the README file.
+* The CLI's command documentation in source code (both Capitano and oclif commands), for example:
+  * `lib/actions/build.coffee`
+  * `lib/actions-oclif/env/add.ts`
+
+The README file is manually edited, but subsections are automatically extracted for inclusion in
+`doc/cli.markdown` by the `getCapitanoDoc()` function in
+[`automation/capitanodoc/capitanodoc.ts`](https://github.com/balena-io/balena-cli/blob/master/automation/capitanodoc/capitanodoc.ts).
+
+The `INSTALL.md` and `TROUBLESHOOTING.md` files are also manually edited.
+
+## Windows
+
+Please note that `npm run build:installer` (which generates the `.exe` executable installer on
+Windows) specifically requires [MSYS2](https://www.msys2.org/) to be installed. Other than that,
+the standard Command Prompt or PowerShell can be used (though MSYS2 is still handy, as it provides
+'git' and a number of common unix utilities). If you make changes to `package.json` scripts, check
+they also run on a standard Windows Command Prompt.
+
+## Updating the 'npm-shrinkwrap.json' file
+
+The `npm-shrinkwrap.json` file is used to control package dependencies, as documented at
+https://docs.npmjs.com/files/shrinkwrap.json.
+
+While developing, the `package.json` file is often modified by, or before, running `npm install`
+in order to add, remove or modify dependencies. When `npm install` is executed, it automatically
+updates the `npm-shrinkwrap.json` file as well, **taking into account not only the `package.json`
+file but also the current state of the `node_modules` folder in your computer.**
+
+Meanwhile, as a text (JSON) file, `git` is capable of merging the `npm-shrinkwrap.json` file during
+operations like `rebase`, `cherry-pick` and `pull`. But git's automated merge is not the
+recommended way of updating the `npm-shrinkwrap.json` file, because it does not take into account
+duplicates or conflicts in the dependency tree, or indeed the state of the `package.json` file
+(which may have just been merged). You can improve this by installing the npm merge driver with:
+```
+npx npm-merge-driver install -g
+```
+
+Whether or not there is a merge error, the following commands are the recommended way of updating
+and committing the `npm-shrinkwrap.json` file:
+
+```bash
+$ npm install  # fetch the latest modules update the npm-shrinkwrap.json file
+$ npm dedupe  # deduplicate dependencies from the npm-shrinkwrap.json file
+$ npm install  # re-add optional dependencies for other platforms that may have been removed by dedupe
+$ git add npm-shrinkwrap.json  # add it for committing (solve merge errors)
+```
+
+## TypeScript and oclif
+
+The CLI currently contains a mix of plain JavaScript and
+[TypeScript](https://www.typescriptlang.org/) code. The goal is to have all code written in
+Typescript, in order to take advantage of static typing and formal programming interfaces.
+The migration towards Typescript is taking place gradually, as part of maintenance work or
+the implementation of new features. Historically, the CLI was originally written in
+[CoffeeScript](https://coffeescript.org), but all CoffeeScript code was migrated to either
+Javascript or Typescript.
+
+Similarly, [Capitano](https://github.com/balena-io/capitano) was originally adopted as the CLI's
+framework, but later we decided to take advantage of [oclif](https://oclif.io/)'s features such
+as native installers for Windows, macOS and Linux, and support for custom flag parsing (for
+example, we're still battling with Capitano's behavior of dropping leading zeros of arguments that
+look like integers, such as some abbreviated UUIDs). Again, the migration is taking place
+gradually, with some CLI commands parsed by oclif and others by Capitano. A simple command line
+pre-parsing takes place in `preparser.ts`, to decide whether to route full parsing to Capitano or
+to oclif.
+
+## Programming style
+
+`npm run build` also runs [balena-lint](https://www.npmjs.com/package/@balena/lint), which automatically
+reformats the code. Beyond that, we have a preference for Javascript promises over callbacks, and for
+`async/await` over `.then()`.
+
+## Updating upstream dependencies
+
+In order to get proper nested changelogs, when updating upstream modules that are in the repo.yml
+(like the balena-sdk), the commit body has to contain a line with the following format:
+```
+Update balena-sdk from 12.0.0 to 12.1.0
+```
+
+Since this is error prone, it's suggested to use the following npm script:
+```
+npm run update balena-sdk ^12.1.0
+```
+
+This will create a new branch (only if you are currently on master), run `npm update` with the
+version you provided as a target and commit the package.json & npm-shrinkwrap.json. The script by
+default will set the `Change-type` to `patch` or `minor`, depending on the semver change of the
+updated dependency, but if you need to use a different one (eg `major`) you can specify it as an
+extra argument:
+```
+npm run update balena-sdk ^12.14.0 patch
+npm run update balena-sdk ^13.0.0 major
+```
+
+## Common gotchas
+
+One thing that most CLI bugs have in common is the absence of test cases exercising the broken
+code, so writing some test code is a great idea. Having said that, there are also some common
+gotchas to bear in mind:
+
+* Forward slashes ('/') _vs._ backslashes ('\') in file paths. The Node.js
+  [path.sep](https://nodejs.org/docs/latest-v12.x/api/path.html#path_path_sep) variable stores a
+  platform-specific path separator character: the backslash on Windows and the forward slash on
+  Linux and macOS. The
+  [path.join](https://nodejs.org/docs/latest-v12.x/api/path.html#path_path_join_paths) function
+  builds paths using such platform-specific path separator. However:
+  * Note that Windows (kernel, cmd.exe, PowerShell, many applications) accepts ***both*** forward
+    slashes and backslashes as path separators (including mixing them in a path string), so code
+    like `mypath.split(path.sep)` may fail on Windows if `mypath` contains forward slashes. The
+    [path.parse](https://nodejs.org/docs/latest-v12.x/api/path.html#path_path_parse_path) function
+    understands both forward slashes and backslashes on Windows, and the
+    [path.normalize](https://nodejs.org/docs/latest-v12.x/api/path.html#path_path_normalize_path)
+    function will _replace_ forward slashes with backslashes.
+  * In [tar](https://en.wikipedia.org/wiki/Tar_(computing)#File_format) streams sent to the Docker
+    daemon and to balenaCloud, the forward slash is the only acceptable path separator, regardless
+    of the OS where the CLI is running. Therefore, `path.sep` and `path.join` should never be used
+    when handling paths in tar streams! `path.posix.join` may be used instead of `path.join`.
+
+* Avoid using the system shell to execute external commands, for example:  
+  `child_process.exec('ssh "arg1" "arg2"');`  
+  `child_process.spawn('ssh "arg1" "arg2"', { shell: true });`  
+  Besides the usual security concerns of unsanitized strings, another problem is to get argument
+  escaping right because of the differences between the Windows 'cmd.exe' shell and the Unix
+  '/bin/sh'. For example, 'cmd.exe' doesn't recognize single quotes like '/bin/sh', and uses the
+  caret (^) instead of the backslash as the escape character. Bug territory! Most of the time,
+  it is possible to avoid relying on the shell altogether by providing a Javascript array of
+  arguments:  
+  `spawn('ssh', ['arg1', 'arg2'], { shell: false});`  
+  To allow for logging and debugging, the [which](https://www.npmjs.com/package/which) package may
+  be used to get the full path of a command before executing it, without relying on any shell:  
+  `const fullPath = await which('ssh');`  
+  `console.log(fullPath);  # 'C:\WINDOWS\System32\OpenSSH\ssh.EXE'`  
+  `spawn(fullPath, ['arg1', 'arg2'], { shell: false });`
+
+* Avoid the `instanceof` operator when testing against classes/types from external packages
+  (including base classes), because `npm install` may result in multiple versions of the same
+  package being installed (to satisfy declared dependencies) and a false negative may result when
+  comparing an object instance from one package version with a class of another package version
+  (even if the implementations are identical in both packages). For example, once we fixed a bug
+  where the test:  
+  `error instanceof BalenaApplicationNotFound`  
+  changed from true to false because `npm install` added an additional copy of the `balena-errors`
+  package to satisfy a minor `balena-sdk` version update:  
+  `$ find node_modules -name balena-errors`  
+  `node_modules/balena-errors`  
+  `node_modules/balena-sdk/node_modules/balena-errors`  
+  In the case of subclasses of `TypedError`, a string comparison may be used instead:  
+  `error.name === 'BalenaApplicationNotFound'`

INSTALL.md

@@ -0,0 +1,231 @@
+# balena CLI Installation Instructions
+
+There are 3 options to choose from to install balena's CLI:
+
+* [Executable Installer](#executable-installer): the easiest method on Windows and macOS, using the
+  traditional graphical desktop application installers.
+* [Standalone Zip Package](#standalone-zip-package): these are plain zip files with the balena CLI
+  executable in them: extract and run. Available for all platforms: Linux, Windows, macOS.
+  Recommended also for scripted installation in CI (continuous integration) environments.
+* [NPM Installation](#npm-installation): recommended for Node.js developers who may be interested
+  in integrating the balena CLI in their existing projects or workflow.
+
+Some specific CLI commands have a few extra installation steps: see section [Additional
+Dependencies](#additional-dependencies).
+
+> **Windows users:**
+> * There is a [YouTube video tutorial](https://www.youtube.com/watch?v=2LApclXFqsg) for installing
+>   and getting started with the balena CLI on Windows. (The video uses the standalone zip package
+>   option.)
+> * If you are using Microsoft's [Windows Subsystem for
+>   Linux](https://docs.microsoft.com/en-us/windows/wsl/about) (WSL), install a balena CLI release
+>   for Linux rather than for Windows, like the standalone zip package for Linux. An installation
+>   with the graphical executable installer for Windows will **not** work with WSL.
+
+## Executable Installer
+
+Recommended for Windows (but not Windows Subsystem for Linux) and macOS:
+
+1. Download the latest installer from the [releases page](https://github.com/balena-io/balena-cli/releases).
+   Look for a file name that ends with "-installer", for example:  
+   `balena-cli-vX.Y.Z-windows-x64-installer.exe`  
+   `balena-cli-vX.Y.Z-macOS-x64-installer.pkg`
+
+2. Double click the downloaded file to run the installer.  
+   _If you are using macOS Catalina (10.15), [check this known issue and
+   workaround](https://github.com/balena-io/balena-cli/issues/1479)._
+
+3. After the installation completes, close and re-open any open [command
+   terminal](https://www.balena.io/docs/reference/cli/#choosing-a-shell-command-promptterminal)
+   windows so that the changes made by the installer to the PATH environment variable can take
+   effect. Check that the installation was successful by running the following commands on a
+   command terminal:
+
+* `balena version` - should print the installed CLI version
+* `balena help` - should print the balena CLI help
+
+> Note: If you had previously installed the CLI using a standalone zip package, it may be a good
+> idea to check your system's `PATH` environment variable for duplicate entries, as the terminal
+> will use the entry that comes first. Check the [Standalone Zip Package](#standalone-zip-package)
+> instructions for how to modify the PATH variable.
+
+By default, the CLI is installed to the following folders:
+
+OS  | Folders
+--- | ---
+Windows: | `C:\Program Files\balena-cli\`
+macOS:   | `/usr/local/lib/balena-cli/` <br> `/usr/local/bin/balena`
+
+## Standalone Zip Package
+
+1. Download the latest zip file from the [releases page](https://github.com/balena-io/balena-cli/releases).
+   Look for a file name that ends with the word "standalone", for example:  
+   `balena-cli-vX.Y.Z-linux-x64-standalone.zip`  ← _also for the Windows Subsystem for Linux_  
+   `balena-cli-vX.Y.Z-macOS-x64-standalone.zip`  
+   `balena-cli-vX.Y.Z-windows-x64-standalone.zip`
+
+2. Extract the zip file contents to any folder you choose. The extracted contents will include a
+   `balena-cli` folder.
+
+3. Add the `balena-cli` folder to the system's `PATH` environment variable.  
+   See instructions for:
+   [Linux](https://stackoverflow.com/questions/14637979/how-to-permanently-set-path-on-linux-unix) |
+   [macOS](https://www.architectryan.com/2012/10/02/add-to-the-path-on-mac-os-x-mountain-lion/#.Uydjga1dXDg) |
+   [Windows](https://www.computerhope.com/issues/ch000549.htm)
+
+> * If you are using macOS Catalina (10.15), [check this known issue and
+>   workaround](https://github.com/balena-io/balena-cli/issues/1479).
+> * **Linux Alpine** and **Busybox:** the standalone zip package is not currently compatible with
+>   these "compact" Linux distributions, because of the alternative C libraries they ship with.
+>   It should however work with all "desktop" or "server" distributions, e.g. Ubuntu, Debian, Suse,
+>   Fedora, Arch Linux and many more.
+> * Note that moving the `balena` executable out of the extracted `balena-cli` folder on its own
+>   (e.g. moving it to `/usr/local/bin/balena`) will **not** work, as it depends on the other
+>   folders and files also present in the `balena-cli` folder.
+
+To update the CLI to a new version, download a new release zip file and replace the previous
+installation folder. To uninstall, simply delete the folder and edit the PATH environment variable
+as described above.
+
+## NPM Installation
+
+If you are a Node.js developer, you may wish to install the balena CLI via [npm](https://www.npmjs.com).
+The npm installation involves building native (platform-specific) binary modules, which require
+some additional development tools to be installed first:
+
+* [Node.js](https://nodejs.org/) version 10 (min **10.20.0**) or 12 (version 14 is not yet fully supported)
+  * **Linux, macOS** and **Windows Subsystem for Linux (WSL):**  
+    Installing Node via [nvm](https://github.com/nvm-sh/nvm/blob/master/README.md) is recommended.
+    When the "system" or "default" Node.js and npm packages are installed with "apt-get" in Linux
+    distributions like Ubuntu, users often report permission or compilation errors when running
+    "npm install". This [sample
+    Dockerfile](https://gist.github.com/pdcastro/5d4d96652181e7da685a32caf629dd44) shows the CLI
+    installation steps on an Ubuntu 18.04 base image.
+* [Python 2.7](https://www.python.org/), [git](https://git-scm.com/), [make](https://www.gnu.org/software/make/), [g++](https://gcc.gnu.org/)
+  * **Linux** and **Windows Subsystem for Linux (WSL):**  
+    `sudo apt-get install -y python git make g++`
+  * **macOS:** install Apple's Command Line Tools by running on a Terminal window:  
+    `xcode-select --install`
+
+On **Windows (not WSL),** the dependencies above and additional ones can be met by installing:
+
+* Node.js from the [Nodejs.org download page](https://nodejs.org/en/download/).
+* The [MSYS2 shell](https://www.msys2.org/), which provides `git`, `make`, `g++`, `ssh`, `rsync`
+  and more:
+  * `pacman -S git openssh rsync gcc make`
+  * [Set a Windows environment variable](https://www.onmsft.com/how-to/how-to-set-an-environment-variable-in-windows-10): `MSYS2_PATH_TYPE=inherit`
+  * Note that a bug in the MSYS2 launch script (`msys2_shell.cmd`) makes text-based
+    interactive CLI menus to misbehave. [Check this Github issue for a
+    workaround](https://github.com/msys2/MINGW-packages/issues/1633#issuecomment-240583890).
+* The Windows Driver Kit (WDK), which is needed to compile some native Node modules. It is **not**
+  necessary to install Visual Studio, only the WDK, which is "step 2" in the following guides:
+  * [WDK for Windows 10](https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk#download-icon-step-2-install-wdk-for-windows-10-version-1903)
+  * [WDK for earlier versions of Windows](https://docs.microsoft.com/en-us/windows-hardware/drivers/other-wdk-downloads#step-2-install-the-wdk)
+* The [windows-build-tools](https://www.npmjs.com/package/windows-build-tools) npm package (which
+  provides Python 2.7 and more), by running the following command on an [administrator
+  console](https://www.howtogeek.com/194041/how-to-open-the-command-prompt-as-administrator-in-windows-8.1/):
+  
+  `npm install -g --production windows-build-tools`
+
+With these dependencies in place, the balena CLI installation command is:
+
+```sh
+$ npm install balena-cli -g --production --unsafe-perm
+```
+
+`--unsafe-perm` is required when `npm install` is executed as the root user, or on systems where
+the global install directory is not user-writable. It allows npm install steps to download and save
+prebuilt native binaries, and also allows the execution of npm scripts like `postinstall` that are
+used to patch dependencies. It is usually possible to omit `--unsafe-perm` if installing under a
+regular (non-root) user account, especially if using a user-managed node installation such as
+[nvm](https://github.com/creationix/nvm).
+
+
+## Additional Dependencies
+
+* The `balena ssh` command requires a recent version of the `ssh` command-line tool to be available:
+  * macOS and Linux usually already have it installed. Otherwise, search for the available packages
+    on your specific Linux distribution, or for the Mac consider the [Xcode command-line
+    tools](https://developer.apple.com/xcode/features/) or [homebrew](https://brew.sh/).
+
+  * Microsoft started distributing an SSH client with Windows 10, which we understand is
+    automatically installed through Windows Update, but can be manually installed too
+    ([more information](https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse)).
+    For other versions of Windows, there are several ssh/OpenSSH clients provided by 3rd parties.
+
+  * The [`proxytunnel`](http://proxytunnel.sourceforge.net/) package (command-line tool) is needed
+    for the `balena ssh` command to work behind a proxy. It is available for Linux distributions
+    like Ubuntu/Debian (`apt install proxytunnel`), and for macOS through
+    [Homebrew](https://brew.sh/). Windows support is limited to the Windows Subsystem for Linux
+    (e.g., by installing Ubuntu through the Microsoft App Store). Check the
+    [README](https://github.com/balena-io/balena-cli/blob/master/README.md) file for proxy
+    configuration instructions.
+
+* The `balena preload`, `balena build` and `balena deploy --build` commands require
+  [Docker](https://docs.docker.com/install/overview/) or [balenaEngine](https://www.balena.io/engine/)
+  to be available:
+  * The `balena preload` command requires the Docker Engine to support the [AUFS storage
+    driver](https://docs.docker.com/storage/storagedriver/aufs-driver/). Docker Desktop for Mac and
+    Windows dropped support for the AUFS filesystem in Docker CE versions greater than 18.06.1, so
+    the workaround is to downgrade to version 18.06.1 (links: [Docker CE for
+    Windows](https://docs.docker.com/docker-for-windows/release-notes/#docker-community-edition-18061-ce-win73-2018-08-29)
+    and [Docker CE for
+    Mac](https://docs.docker.com/docker-for-mac/release-notes/#docker-community-edition-18061-ce-mac73-2018-08-29)).
+    See more details in [CLI issue 1099](https://github.com/balena-io/balena-cli/issues/1099).
+  * Commonly, Docker is installed on the same machine where the CLI is being used, but the
+    `balena build` and `balena deploy` commands can also use a remote Docker Engine (daemon)
+    or balenaEngine (which could be a remote device running a [balenaOS development
+    image](https://www.balena.io/docs/reference/OS/overview/2.x/#dev-vs-prod-images)) by specifying
+    its IP address and port number as command-line options. Check the documentation for each
+    command, e.g. `balena help build`, or the [online
+    reference](https://www.balena.io/docs/reference/cli/#cli-command-reference).
+  * If you are using Microsoft's [Windows Subsystem for
+    Linux](https://docs.microsoft.com/en-us/windows/wsl/about) (WSL) and Docker Desktop for
+    Windows, check the [FAQ item "Docker seems to be
+    unavailable"](https://github.com/balena-io/balena-cli/blob/master/TROUBLESHOOTING.md#docker-seems-to-be-unavailable-error-when-using-windows-subsystem-for-linux-wsl).
+
+* The `balena scan` command requires a multicast DNS (mDNS) service like Bonjour or Avahi:
+  * On Windows, check if 'Bonjour' is installed (Control Panel > Programs and Features).
+    If not, you can download Bonjour for Windows from https://support.apple.com/kb/DL999
+  * Most 'desktop' Linux distributions ship with [Avahi](https://en.wikipedia.org/wiki/Avahi_(software)).
+    Search for the installation command for your distribution. E.g. for Ubuntu:
+    `sudo apt-get install avahi-daemon`
+  * macOS comes with [Bonjour](https://en.wikipedia.org/wiki/Bonjour_(software)) built-in.
+  
+* The `balena os configure` command is currently not supported on Windows natively. Windows users are advised 
+  to install the [Windows Subsystem for Linux](https://docs.microsoft.com/en-us/windows/wsl/about) (WSL) 
+  with Ubuntu, and use the Linux release of the balena CLI.
+  
+
+## Configuring SSH keys
+
+The `balena ssh` command requires an SSH key to be added to your balena account. If you had
+already added a SSH key in order to [deploy with 'git push'](https://www.balena.io/docs/learn/getting-started/raspberrypi3/nodejs/#adding-an-ssh-key),
+then you are probably done and may skip this section. You can check whether you already have
+an SSH key in your balena account with the `balena keys` command, or by visiting the
+[balena web dashboard](https://dashboard.balena-cloud.com/), clicking on your name -> Preferences
+-> SSH Keys.
+
+> Note: An "SSH key" actually consists of a public/private key pair. A typical name for the private
+> key file is "id_rsa", and a typical name for the public key file is "id_rsa.pub". Both key files
+> are saved to your computer (with the private key optionally protected by a password), but only
+> the public key is saved to your balena account. This means that if you change computers or
+> otherwise lose the private key, _you cannot recover the private key through your balena account._
+> You can however add new keys, and delete the old ones.
+
+If you don't have an SSH key in your balena account:
+
+* If you have an existing SSH key in your computer that you would like to use, you can add it
+  to your balena account through the balena web dashboard (Preferences -> SSH Keys), or through
+  the CLI itself:
+
+```bash
+# Windows 10 (cmd.exe prompt) example:
+$ balena key add MyKey %userprofile%\.ssh\id_rsa.pub
+# Linux / macOS example:
+$ balena key add MyKey ~/.ssh/id_rsa.pub
+```
+
+* To generate a new key, you can follow [GitHub's documentation](https://help.github.com/en/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent),
+  skipping the step about adding the key to your GitHub account, and instead adding the key to
+  your balena account as described above.

README.md

@@ -1,98 +1,168 @@
-Resin CLI
-=========
+# balena CLI
 
-> The official resin.io CLI tool.
+The official balena CLI tool.
 
-[![npm version](https://badge.fury.io/js/resin-cli.svg)](http://badge.fury.io/js/resin-cli)
-[![dependencies](https://david-dm.org/resin-io/resin-cli.svg)](https://david-dm.org/resin-io/resin-cli)
-[![Gitter](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/resin-io/chat)
+[![npm version](https://badge.fury.io/js/balena-cli.svg)](http://badge.fury.io/js/balena-cli)
+[![dependencies](https://david-dm.org/balena-io/balena-cli.svg)](https://david-dm.org/balena-io/balena-cli)
 
-Requisites
-----------
+## About
 
-- [NodeJS](https://nodejs.org) (>= v4)
-- [Git](https://git-scm.com)
-- The following executables should be correctly installed in your shell environment:
-  - `ssh`: Any recent version of the OpenSSH ssh client (required by `resin sync` and `resin ssh`)
-	- if you need `ssh` to work behind the proxy you also need [`proxytunnel`](http://proxytunnel.sourceforge.net/) installed (available as `proxytunnel` package for Ubuntu, for example)
-  - `rsync`: >= 2.6.9 (required by `resin sync`)
+The balena CLI (Command-Line Interface) allows you to interact with the balenaCloud and the
+[balena API](https://www.balena.io/docs/reference/api/overview/) through a terminal window
+on Linux, macOS or Windows. You can also write shell scripts around it, or import its Node.js
+modules to use it programmatically.
+As an [open-source project on GitHub](https://github.com/balena-io/balena-cli/), your contribution
+is also welcome!
 
-##### Windows Support
+## Installation
 
-Before installing resin-cli, you'll need a working node-gyp environment. If you don't already have one you'll see native module build errors during installation. To fix this, run `npm install -g --production windows-build-tools` in an administrator console (available as 'Command Prompt (Admin)' when pressing windows+x in Windows 7+).
+Check the [balena CLI installation instructions on GitHub](https://github.com/balena-io/balena-cli/blob/master/INSTALL.md).
 
-`resin sync` and `resin ssh` have not been thoroughly tested on the standard Windows cmd.exe shell. We recommend using bash (or a similar) shell, like Bash for Windows 10 or [Git for Windows](https://git-for-windows.github.io/).
+## Getting Started
 
-If you still want to use `cmd.exe` you will have to use a package manager like MinGW or chocolatey. For MinGW the steps are:
+### Choosing a shell (command prompt/terminal)
 
-1. Install [MinGW](http://www.mingw.org).
-2. Install the `msys-rsync` and `msys-openssh` packages.
-3. Add MinGW to the `%PATH%` if this hasn't been done by the installer already. The location where the binaries are places is usually `C:\MinGW\msys\1.0\bin`, but it can vary if you selected a different location in the installer.
-4. Copy your SSH keys to `%homedrive%%homepath\.ssh`.
-5. If you need `ssh` to work behind the proxy you also need to install [proxytunnel](http://proxytunnel.sourceforge.net/)
+On **Windows,** the standard Command Prompt (`cmd.exe`) and
+[PowerShell](https://docs.microsoft.com/en-us/powershell/scripting/getting-started/getting-started-with-windows-powershell?view=powershell-6)
+are supported. We are aware of users also having a good experience with alternative shells,
+including:
 
-Getting Started
----------------
+* [MSYS2](https://www.msys2.org/):
+  * Install additional packages with the command:  
+    `pacman -S git openssh rsync`
+  * [Set a Windows environment variable](https://www.onmsft.com/how-to/how-to-set-an-environment-variable-in-windows-10): `MSYS2_PATH_TYPE=inherit`
+  * Note that a bug in the MSYS2 launch script (`msys2_shell.cmd`) makes text-based interactive CLI
+    menus to break. [Check this Github issue for a
+    workaround](https://github.com/msys2/MINGW-packages/issues/1633#issuecomment-240583890).
+* [MSYS](http://www.mingw.org/wiki/MSYS): select the `msys-rsync` and `msys-openssh` packages too
+* [Git for Windows](https://git-for-windows.github.io/)
+  * During the installation, you will be prompted to choose between _"Use MinTTY"_ and _"Use
+    Windows' default console window"._ Choose the latter, because of the same [MSYS2
+    bug](https://github.com/msys2/MINGW-packages/issues/1633) mentioned above (Git for Windows
+    actually uses MSYS2). For a screenshot, check this
+    [comment](https://github.com/balena-io/balena-cli/issues/598#issuecomment-556513098).
+* Microsoft's [Windows Subsystem for Linux](https://docs.microsoft.com/en-us/windows/wsl/about)
+  (WSL). In this case, a Linux distribution like Ubuntu is installed via the Microsoft Store, and a
+  balena CLI release **for Linux** is recommended. See
+  [FAQ](https://github.com/balena-io/balena-cli/blob/master/TROUBLESHOOTING.md) for using balena
+  CLI with WSL and Docker Desktop for Windows.
 
-### Install
+On **macOS** and **Linux,** the standard terminal window is supported. _Optionally,_ `bash` command
+auto completion may be enabled by copying the
+[balena-completion.bash](https://github.com/balena-io/balena-cli/blob/master/balena-completion.bash)
+file to your system's `bash_completion` directory: check [Docker's command completion
+guide](https://docs.docker.com/compose/completion/) for system setup instructions.
 
-This might require elevated privileges in some environments.
+### Logging in
+
+Several CLI commands require access to your balenaCloud account, for example in order to push a
+new release to your application. Those commands require creating a CLI login session by running:
 
 ```sh
-$ npm install --global --production resin-cli
+$ balena login
 ```
 
-### Login
+### Proxy support
 
-```sh
-$ resin login
+HTTP(S) proxies can be configured through any of the following methods, in precedence order
+(from higher to lower):
+
+* The `BALENARC_PROXY` environment variable in URL format, with protocol (`http` or `https`),
+  host, port and optionally basic auth. Examples:
+  * `export BALENARC_PROXY='https://bob:secret@proxy.company.com:12345'`
+  * `export BALENARC_PROXY='http://localhost:8000'`
+
+* The `proxy` setting in the [CLI config
+  file](https://www.npmjs.com/package/balena-settings-client#documentation). It may be:
+  * A string in URL format, e.g. `proxy: 'http://localhost:8000'`
+  * An object in the format:
+
+    ```yaml
+    proxy:
+        protocol: 'http'
+        host: 'proxy.company.com'
+        port: 12345
+        proxyAuth: 'bob:secret'
+    ```
+
+* The `HTTPS_PROXY` and/or `HTTP_PROXY` environment variables, in the same URL format as
+  `BALENARC_PROXY`.
+
+> Note: The `balena ssh` command has additional setup requirements to work behind a proxy.
+> Check the [installation instructions](https://github.com/balena-io/balena-cli/blob/master/INSTALL.md),
+> and ensure that the proxy server is configured to allow proxy requests to ssh port 22, using
+> SSL encryption. For example, in the case of the [Squid](http://www.squid-cache.org/) proxy
+> server, it should be configured with the following rules in the `squid.conf` file:  
+> `acl SSL_ports port 22`  
+> `acl Safe_ports port 22`  
+
+#### Proxy exclusion
+
+The `BALENARC_NO_PROXY` variable may be used to exclude specified destinations from proxying.
+
+> * This feature requires balena CLI version 11.30.8 or later. In the case of the npm [installation
+>   option](https://github.com/balena-io/balena-cli/blob/master/INSTALL.md), it also requires
+>   Node.js version 10.16.0 or later.
+> * To exclude a `balena ssh` target from proxying (IP address or `.local` hostname), the
+>   `--noproxy` option should be specified in addition to the `BALENARC_NO_PROXY` variable.
+
+By default (if `BALENARC_NO_PROXY` is not defined), all [private IPv4
+addresses](https://en.wikipedia.org/wiki/Private_network) and `'*.local'` hostnames are excluded
+from proxying. Other hostnames that resolve to private IPv4 addresses are **not** excluded by
+default, because matching takes place before name resolution.
+
+`localhost` and `127.0.0.1` are always excluded from proxying, regardless of the value of
+BALENARC_NO_PROXY.
+
+The format of the `BALENARC_NO_PROXY` environment variable is a comma-separated list of patterns
+that are matched against hostnames or IP addresses. For example:
+
+```
+export BALENARC_NO_PROXY='*.local,dev*.mycompany.com,192.168.*'
 ```
 
-_(Typically useful, but not strictly required for all commands)_
+Matched patterns are excluded from proxying. Wildcard expressions are documented at
+[matcher](https://www.npmjs.com/package/matcher#usage). Matching takes place _before_ name
+resolution, so a pattern like `'192.168.*'` will **not** match a hostname that resolves to an IP
+address like `192.168.1.2`.
 
-### Run commands
+## Command reference documentation
 
-Take a look at the full command documentation at [https://docs.resin.io/tools/cli/](https://docs.resin.io/tools/cli/#table-of-contents
-), or by running `resin help`.
+The full CLI command reference is available [on the web](https://www.balena.io/docs/reference/cli/
+) or by running `balena help` and `balena help --verbose`.
 
----
+## Support, FAQ and troubleshooting
 
-Plugins
--------
+If you come across any problems or would like to get in touch:
 
-The Resin CLI can be extended with plugins to automate laborious tasks and overall provide a better experience when working with Resin.io. Check the [plugin development tutorial](https://github.com/resin-io/resin-plugin-hello) to learn how to build your own!
+* Check our [FAQ / troubleshooting document](https://github.com/balena-io/balena-cli/blob/master/TROUBLESHOOTING.md).
+* Ask us a question through the [balenaCloud forum](https://forums.balena.io/c/balena-cloud).
+* For bug reports or feature requests,
+  [have a look at the GitHub issues or create a new one](https://github.com/balena-io/balena-cli/issues/).
 
-FAQ
----
+## Deprecation policy
 
-### Where is my configuration file?
+The balena CLI uses [semver versioning](https://semver.org/), with the concepts
+of major, minor and patch version releases.
 
-The per-user configuration file lives in `$HOME/.resinrc.yml` or `%UserProfile%\_resinrc.yml`, in Unix based operating systems and Windows respectively.
+The latest release of the previous major version of the balena CLI will remain
+compatible with the balenaCloud backend services for one year from the date when
+the next major version is released. For example, balena CLI v10.17.5, as the
+latest v10 release, would remain compatible with the balenaCloud backend for one
+year from the date when v11.0.0 is released.
 
-The Resin CLI also attempts to read a `resinrc.yml` file in the current directory, which takes precedence over the per-user configuration file.
+At the end of this period, the older major version is considered deprecated and
+some of the functionality that depends on balenaCloud services may stop working
+at any time.
+Users are encouraged to regularly update the balena CLI to the latest version.
 
-### How do I point the Resin CLI to staging?
+## Contributing (including editing documentation files)
 
-The easiest way is to set the `RESINRC_RESIN_URL=resinstaging.io` environment variable.
+Please have a look at the [CONTRIBUTING.md](./CONTRIBUTING.md) file for some guidance before
+submitting a pull request or updating documentation (because some files are automatically
+generated). Thank you for your help and interest!
 
-Alternatively, you can edit your configuration file and set `resinUrl: resinstaging.io` to persist this setting.
+## License
 
-### How do I make the Resin CLI persist data in another directory?
-
-The Resin CLI persists your session token, as well as cached images in `$HOME/.resin` or `%UserProfile%\_resin`.
-
-Pointing the Resin CLI to persist data in another location is necessary in certain environments, like a server, where there is no home directory, or a device running resinOS, which erases all data after a restart.
-
-You can accomplish this by setting `RESINRC_DATA_DIRECTORY=/opt/resin` or adding `dataDirectory: /opt/resin` to your configuration file, replacing `/opt/resin` with your desired directory.
-
-Support
--------
-
-If you're having any problems, check our [troubleshooting guide](https://github.com/resin-io/resin-cli/blob/master/TROUBLESHOOTING.md) and if your problem is not addressed there, please [raise an issue](https://github.com/resin-io/resin-cli/issues/new) on GitHub and the resin.io team will be happy to help.
-
-You can also get in touch with us in the resin.io [forums](https://forums.resin.io/).
-
-License
--------
-
-The project is licensed under the Apache 2.0 license.
+The project is licensed under the [Apache 2.0 License](https://www.apache.org/licenses/LICENSE-2.0).
+A copy is also available in the LICENSE file in this repository.

TROUBLESHOOTING.md

@@ -1,15 +1,41 @@
-Troubleshooting
-===============
+# FAQ & Troubleshooting
 
-This document contains common issues related to the Resin CLI, and how to fix them.
+This document contains some common issues, questions and answers related to the balena CLI.
 
-### After burning to an sdcard, my device doesn't boot
+## Where is my configuration file?
+
+The per-user configuration file lives in `$HOME/.balenarc.yml` or `%UserProfile%\_balenarc.yml`, in
+Unix based operating systems and Windows respectively.
+
+The balena CLI also attempts to read a `balenarc.yml` file in the current directory, which takes
+precedence over the per-user configuration file.
+
+## How do I point the balena CLI to staging?
+
+The easiest way is to set the `BALENARC_BALENA_URL=balena-staging.com` environment variable.
+
+Alternatively, you can edit your configuration file and set `balenaUrl: balena-staging.com` to
+persist this setting.
+
+## How do I make the balena CLI persist data in another directory?
+
+The balena CLI persists your session token, as well as cached images in `$HOME/.balena` or
+`%UserProfile%\_balena`.
+
+Pointing the balena CLI to persist data in another location is necessary in certain environments,
+like a server, where there is no home directory, or a device running balenaOS, which erases all
+data after a restart.
+
+You can accomplish this by setting `BALENARC_DATA_DIRECTORY=/opt/balena` or adding `dataDirectory:
+/opt/balena` to your configuration file, replacing `/opt/balena` with your desired directory.
+
+## After burning to an sdcard, my device doesn't boot
 
 - The downloaded image is not complete (download was interrupted).
 
-Please clean the cache (`%HOME/.resin/cache` or `C:\Users\<user>\_resin\cache`) and run the command again. In the future, the CLI will check that the image is not complete and clean the cache for you.
+Please clean the cache (`%HOME/.balena/cache` or `C:\Users\<user>\_balena\cache`) and run the command again. In the future, the CLI will check that the image is not complete and clean the cache for you.
 
-### I get a permission error when burning to an sdcard
+## I get a permission error when burning to an sdcard
 
 - The SDCard is locked.
 
@@ -24,36 +50,79 @@ net.js:156
 Error: EINVAL, invalid argument
   at new Socket (net.js:156:18)
   at process.stdin (node.js:664:19)
-  at Object.Interface.createInterface (C:\cygwin\home\Juan Cruz Viotti\Projects\resin-cli\node_modules\inquirer\node_modules\readline2\index.js:31:43)
-  at PromptUI.UI (C:\cygwin\home\Juan Cruz Viotti\Projects\resin-cli\node_modules\inquirer\lib\ui\baseUI.js:23:40)
-  at new PromptUI (C:\cygwin\home\Juan Cruz Viotti\Projects\resin-cli\node_modules\inquirer\lib\ui\prompt.js:26:8)
-  at Object.promptModule [as prompt] (C:\cygwin\home\Juan Cruz Viotti\Projects\resin-cli\node_modules\inquirer\lib\inquirer.js:27:14)
+  at Object.Interface.createInterface (C:\cygwin\home\Juan Cruz Viotti\Projects\balena-cli\node_modules\inquirer\node_modules\readline2\index.js:31:43)
+  at PromptUI.UI (C:\cygwin\home\Juan Cruz Viotti\Projects\balena-cli\node_modules\inquirer\lib\ui\baseUI.js:23:40)
+  at new PromptUI (C:\cygwin\home\Juan Cruz Viotti\Projects\balena-cli\node_modules\inquirer\lib\ui\prompt.js:26:8)
+  at Object.promptModule [as prompt] (C:\cygwin\home\Juan Cruz Viotti\Projects\balena-cli\node_modules\inquirer\lib\inquirer.js:27:14)
 ```
 
 - Some interactive widgets don't work on `Cygwin`. If you're running Windows, it's preferrable that you use `cmd.exe`, as `Cygwin` is [not official supported by Node.js](https://github.com/chjj/blessed/issues/56#issuecomment-42671945).
 
-### I get `Invalid MBR boot signature` when configuring a device
+## I get `Invalid MBR boot signature` when configuring a device
 
 This error, accompanied with something like: `Expected 0xAA55, but saw 0x29FE` usually indicates a corrupted device operating system image in the cache, due to bad a internet connection during the download process.
 
 Try clearing the cache with the following command and trying again:
 
 ```sh
-$ rm -rf $HOME/.resin/cache
+$ rm -rf $HOME/.balena/cache
 ```
 
 Or in Windows:
 
 ```sh
-> del /s /q %UserProfile%\_resin\cache
+> del /s /q %UserProfile%\_balena\cache
 ```
 
-### I get `EACCES: permission denied` when logging in
+## I get `EACCES: permission denied` when logging in
 
-The Resin CLI stores the session token in `$HOME/.resin` or `C:\Users\<user>\_resin` in UNIX based operating systems and Windows respectively. This error usually indicates that the user doesn't have permissions over that directory, which can happen if you ran the Resin CLI as `root`, and thus the directory got owned by him.
+The balena CLI stores the session token in `$HOME/.balena` or `C:\Users\<user>\_balena` in UNIX based operating systems and Windows respectively. This error usually indicates that the user doesn't have permissions over that directory, which can happen if you ran the balena CLI as `root`, and thus the directory got owned by him.
 
 Try resetting the ownership by running:
 
 ```sh
-$ sudo chown -R <user> $HOME/.resin
+$ sudo chown -R <user> $HOME/.balena
 ```
+
+## Broken line wrapping / cursor behavior with `balena ssh`
+
+Users sometimes come across broken line wrapping or cursor behavior in text terminals, for example when long command lines are typed in a `balena ssh` session, or when using text editors like `vim` or `nano`. This is not something specific to the balena CLI, being also a commonly reported issue with standard remote terminal tools like `ssh` or `telnet`. It is often a remote shell configuration issue (files like `/etc/profile`, `~/.bash_profile`, `~/.bash_login`, `~/.profile` and the like), including UTF-8 misconfiguration, the use of unsupported ASCII control characters in shell prompt formatting (e.g. the `$PS1` env var) or the output of tools or log files that use colored text. The issue can sometimes be fixed by resizing the client terminal window, or by running one or more of the following commands on the shell:
+
+```sh
+export TERMINAL=linux
+stty sane
+shopt -s checkwinsize
+bind 'set horizontal-scroll-mode off'
+```
+
+Terminal multiplexer tools like GNU `screen` or `tmux` are sometimes reported to fix the issues, though at other times they are reported as the _cause_ of the problem. They have their own configuration files to take into account.
+
+Further reference:
+* https://stackoverflow.com/questions/1133031/shell-prompt-line-wrapping-issue
+* https://superuser.com/questions/46948/any-way-to-fix-screens-mishandling-of-line-wrap-maybe-only-terminal-app
+* https://unix.stackexchange.com/questions/105958/terminal-prompt-not-wrapping-correctly
+* https://unix.stackexchange.com/questions/529377/terminal-long-line-wrapping
+* https://github.com/microsoft/WSL/issues/1436
+
+If nothing seems to help, consider also using a different client-side terminal application:
+* Linux: xterm, KDE Konsole, GNOME Terminal
+* Mac: Terminal, iTerm2
+* Windows: PowerShell, PuTTY, WSL (Windows Subsystem for Linux)
+
+## "Docker seems to be unavailable" error when using Windows Subsystem for Linux (WSL)
+
+When running on WSL, the recommendation is to install a CLI release for Linux, like the standalone
+zip package for Linux. However, commands like "balena build" that contact a local Docker daemon,
+like the Docker Desktop for Windows, will try to reach Docker at the Unix socket path
+`/var/run/docker.sock`, while Docker Desktop for Windows uses a Windows named pipe at
+`//./pipe/docker_engine` (which the Linux CLI on WSL cannot use). A solution is:
+
+- Open the Docker Desktop for Windows settings panel and tick the checkbox _"Expose daemon on tcp://localhost:2375 without TLS"._
+- On the WSL command line, set an env var:  
+`export DOCKER_HOST=tcp://localhost:2375`  
+Alternatively, use the command-line options `-h 127.0.0.1 -p 2375` for commands like `balena build` and `balena deploy`.
+
+Further reference:
+
+- https://techcommunity.microsoft.com/t5/Containers/WSL-Interoperability-with-Docker/ba-p/382405
+- https://forums.docker.com/t/wsl-and-docker-for-windows-cannot-connect-to-the-docker-daemon-at-tcp-localhost-2375-is-the-docker-daemon-running/63571/12

appveyor.yml

@@ -0,0 +1,43 @@
+# appveyor file
+# http://www.appveyor.com/docs/appveyor-yml
+
+image: Visual Studio 2017
+
+init:
+  - git config --global core.autocrlf input
+
+cache:
+  - C:\Users\appveyor\.node-gyp
+  - '%AppData%\npm-cache'
+
+matrix:
+  fast_finish: true
+
+# what combinations to test
+environment:
+  matrix:
+    - nodejs_version: 10
+
+install:
+  - ps: Install-Product node $env:nodejs_version x64
+  - set PATH=%APPDATA%\npm;%PATH%
+  - npm config set python 'C:\Python27\python.exe'
+  - npm --version
+  # - npm install
+
+build: off
+test: off
+deploy: off
+
+test_script:
+  - node --version
+  - npm --version
+  # - npm test
+
+deploy_script:
+  - node --version
+  - npm --version
+  # - npm run build:standalone
+  # - npm run build:installer
+  # - IF "%APPVEYOR_REPO_TAG%" == "true" (npm run release)
+  # - IF NOT "%APPVEYOR_REPO_TAG%" == "true" (echo 'Not tagged, skipping deploy')

automation/build-bin.ts

@@ -0,0 +1,420 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { JsonVersions } from '../lib/actions-oclif/version';
+
+import { run as oclifRun } from '@oclif/dev-cli';
+import * as archiver from 'archiver';
+import * as Bluebird from 'bluebird';
+import { execFile } from 'child_process';
+import * as filehound from 'filehound';
+import * as fs from 'fs-extra';
+import * as _ from 'lodash';
+import * as path from 'path';
+import * as rimraf from 'rimraf';
+import * as semver from 'semver';
+import * as util from 'util';
+
+import { stripIndent } from '../lib/utils/lazy';
+import {
+	diffLines,
+	getSubprocessStdout,
+	loadPackageJson,
+	MSYS2_BASH,
+	ROOT,
+	StdOutTap,
+	whichSpawn,
+} from './utils';
+
+export const packageJSON = loadPackageJson();
+export const version = 'v' + packageJSON.version;
+const arch = process.arch;
+
+function dPath(...paths: string[]) {
+	return path.join(ROOT, 'dist', ...paths);
+}
+
+interface PathByPlatform {
+	[platform: string]: string;
+}
+
+const standaloneZips: PathByPlatform = {
+	linux: dPath(`balena-cli-${version}-linux-${arch}-standalone.zip`),
+	darwin: dPath(`balena-cli-${version}-macOS-${arch}-standalone.zip`),
+	win32: dPath(`balena-cli-${version}-windows-${arch}-standalone.zip`),
+};
+
+const oclifInstallers: PathByPlatform = {
+	darwin: dPath('macos', `balena-${version}.pkg`),
+	win32: dPath('win', `balena-${version}-${arch}.exe`),
+};
+
+const renamedOclifInstallers: PathByPlatform = {
+	darwin: dPath(`balena-cli-${version}-macOS-${arch}-installer.pkg`),
+	win32: dPath(`balena-cli-${version}-windows-${arch}-installer.exe`),
+};
+
+export const finalReleaseAssets: { [platform: string]: string[] } = {
+	win32: [standaloneZips['win32'], renamedOclifInstallers['win32']],
+	darwin: [standaloneZips['darwin'], renamedOclifInstallers['darwin']],
+	linux: [standaloneZips['linux']],
+};
+
+/**
+ * Given the output of `pkg` as a string (containing warning messages),
+ * diff it against previously saved output of known "safe" warnings.
+ * Throw an error if the diff is not empty.
+ */
+async function diffPkgOutput(pkgOut: string) {
+	const { monochrome } = await import('../tests/helpers');
+	const relSavedPath = path.join(
+		'tests',
+		'test-data',
+		'pkg',
+		`expected-warnings-${process.platform}.txt`,
+	);
+	const absSavedPath = path.join(ROOT, relSavedPath);
+	const ignoreStartsWith = [
+		'> pkg@',
+		'> Fetching base Node.js binaries',
+		'  fetched-',
+	];
+	const modulesRE =
+		process.platform === 'win32'
+			? /(?<=[ '])([A-Z]:)?\\.+?\\node_modules(?=\\)/
+			: /(?<=[ '])\/.+?\/node_modules(?=\/)/;
+	const buildRE =
+		process.platform === 'win32'
+			? /(?<=[ '])([A-Z]:)?\\.+\\build(?=\\)/
+			: /(?<=[ '])\/.+\/build(?=\/)/;
+
+	const cleanLines = (chunks: string | string[]) => {
+		const lines = typeof chunks === 'string' ? chunks.split('\n') : chunks;
+		return lines
+			.map((line: string) => monochrome(line)) // remove ASCII colors
+			.filter((line: string) => !/^\s*$/.test(line)) // blank lines
+			.filter((line: string) =>
+				ignoreStartsWith.every((i) => !line.startsWith(i)),
+			)
+			.map((line: string) => {
+				// replace absolute paths with relative paths
+				let replaced = line.replace(modulesRE, 'node_modules');
+				if (replaced === line) {
+					replaced = line.replace(buildRE, 'build');
+				}
+				return replaced;
+			});
+	};
+
+	pkgOut = cleanLines(pkgOut).join('\n');
+	const { readFile } = (await import('fs')).promises;
+	const expectedOut = cleanLines(await readFile(absSavedPath, 'utf8')).join(
+		'\n',
+	);
+	if (expectedOut !== pkgOut) {
+		const sep =
+			'================================================================================';
+		const diff = diffLines(expectedOut, pkgOut);
+		const msg = `pkg output does not match expected output from "${relSavedPath}"
+Diff:
+${sep}
+${diff}
+${sep}
+Check whether the new or changed pkg warnings are safe to ignore, then update
+"${relSavedPath}"
+and share the result of your investigation as comments on the pull request.
+Hint: the fix is often a matter of updating the 'pkg.scripts' or 'pkg.assets'
+sections in the CLI's 'package.json' file, or a matter of updating the
+'buildPkg' function in 'automation/build-bin.ts'.  Sometimes it requires
+patching dependencies: See for example 'patches/all/open+7.0.2.patch'.
+${sep}
+`;
+		throw new Error(msg);
+	}
+}
+
+/**
+ * Call `pkg.exec` to generate the standalone zip file, capturing its warning
+ * messages (stdout and stderr) in order to call diffPkgOutput().
+ */
+async function execPkg(...args: any[]) {
+	const { exec: pkgExec } = await import('pkg');
+	const outTap = new StdOutTap(true);
+	try {
+		outTap.tap();
+		await (pkgExec as any)(...args);
+	} catch (err) {
+		outTap.untap();
+		console.log(outTap.stdoutBuf.join(''));
+		console.error(outTap.stderrBuf.join(''));
+		throw err;
+	}
+	outTap.untap();
+	await diffPkgOutput(outTap.allBuf.join(''));
+}
+
+/**
+ * Use the 'pkg' module to create a single large executable file with
+ * the contents of 'node_modules' and the CLI's javascript code.
+ * Also copy a number of native modules (binary '.node' files) that are
+ * compiled during 'npm install' to the 'build-bin' folder, alongside
+ * the single large executable file created by pkg. (This is necessary
+ * because of a pkg limitation that does not allow binary executables
+ * to be directly executed from inside another binary executable.)
+ */
+async function buildPkg() {
+	const args = [
+		'--target',
+		'host',
+		'--output',
+		'build-bin/balena',
+		'package.json',
+	];
+	console.log('=======================================================');
+	console.log(`execPkg ${args.join(' ')}`);
+	console.log(`cwd="${process.cwd()}" ROOT="${ROOT}"`);
+	console.log('=======================================================');
+
+	await execPkg(args);
+
+	const paths: Array<[string, string[], string[]]> = [
+		// [platform, [source path], [destination path]]
+		['*', ['open', 'xdg-open'], ['xdg-open']],
+		['*', ['opn', 'xdg-open'], ['xdg-open-402']],
+		['darwin', ['denymount', 'bin', 'denymount'], ['denymount']],
+	];
+	await Promise.all(
+		paths.map(([platform, source, dest]) => {
+			if (platform === '*' || platform === process.platform) {
+				// eg copy from node_modules/open/xdg-open to build-bin/xdg-open
+				return fs.copy(
+					path.join(ROOT, 'node_modules', ...source),
+					path.join(ROOT, 'build-bin', ...dest),
+				);
+			}
+		}),
+	);
+	const nativeExtensionPaths: string[] = await filehound
+		.create()
+		.paths(path.join(ROOT, 'node_modules'))
+		.ext(['node', 'dll'])
+		.find();
+
+	console.log(`\nCopying to build-bin:\n${nativeExtensionPaths.join('\n')}`);
+
+	await Promise.all(
+		nativeExtensionPaths.map((extPath) =>
+			fs.copy(
+				extPath,
+				extPath.replace(
+					path.join(ROOT, 'node_modules'),
+					path.join(ROOT, 'build-bin'),
+				),
+			),
+		),
+	);
+}
+
+/**
+ * Run some basic tests on the built pkg executable.
+ * TODO: test more than just `balena version -j`; integrate with the
+ * existing mocha/chai CLI command testing.
+ */
+async function testPkg() {
+	const pkgBalenaPath = path.join(
+		ROOT,
+		'build-bin',
+		process.platform === 'win32' ? 'balena.exe' : 'balena',
+	);
+	console.log(`Testing standalone package "${pkgBalenaPath}"...`);
+	// Run `balena version -j`, parse its stdout as JSON, and check that the
+	// reported Node.js major version matches semver.major(process.version)
+	const stdout = await getSubprocessStdout(pkgBalenaPath, ['version', '-j']);
+	let pkgNodeVersion = '';
+	let pkgNodeMajorVersion = 0;
+	try {
+		const balenaVersions: JsonVersions = JSON.parse(stdout);
+		pkgNodeVersion = balenaVersions['Node.js'];
+		pkgNodeMajorVersion = semver.major(pkgNodeVersion);
+	} catch (err) {
+		throw new Error(stripIndent`
+			Error parsing JSON output of "balena version -j": ${err}
+			Original output: "${stdout}"`);
+	}
+	if (semver.major(process.version) !== pkgNodeMajorVersion) {
+		throw new Error(
+			`Mismatched major version: built-in pkg Node version="${pkgNodeVersion}" vs process.version="${process.version}"`,
+		);
+	}
+	console.log('Success! (standalone package test successful)');
+}
+
+/**
+ * Create the zip file for the standalone 'pkg' bundle previously created
+ * by the buildPkg() function in 'build-bin.ts'.
+ */
+async function zipPkg() {
+	const outputFile = standaloneZips[process.platform];
+	if (!outputFile) {
+		throw new Error(
+			`Standalone installer unavailable for platform "${process.platform}"`,
+		);
+	}
+	await fs.mkdirp(path.dirname(outputFile));
+	await new Promise((resolve, reject) => {
+		console.log(`Zipping standalone package to "${outputFile}"...`);
+
+		const archive = archiver('zip', {
+			zlib: { level: 7 },
+		});
+		archive.directory(path.join(ROOT, 'build-bin'), 'balena-cli');
+
+		const outputStream = fs.createWriteStream(outputFile);
+
+		outputStream.on('close', resolve);
+		outputStream.on('error', reject);
+
+		archive.on('error', reject);
+		archive.on('warning', console.warn);
+
+		archive.pipe(outputStream);
+		archive.finalize();
+	});
+}
+
+export async function buildStandaloneZip() {
+	console.log(`Building standalone zip package for CLI ${version}`);
+	try {
+		await buildPkg();
+		await testPkg();
+		await zipPkg();
+		console.log(`Standalone zip package build completed`);
+	} catch (error) {
+		console.error(`Error creating or testing standalone zip package`);
+		throw error;
+	}
+}
+
+async function renameInstallerFiles() {
+	if (await fs.pathExists(oclifInstallers[process.platform])) {
+		await fs.rename(
+			oclifInstallers[process.platform],
+			renamedOclifInstallers[process.platform],
+		);
+	}
+}
+
+/**
+ * If the CSC_LINK and CSC_KEY_PASSWORD env vars are set, digitally sign the
+ * executable installer by running the balena-io/scripts/shared/sign-exe.sh
+ * script (which must be in the PATH) using a MSYS2 bash shell.
+ */
+async function signWindowsInstaller() {
+	if (process.env.CSC_LINK && process.env.CSC_KEY_PASSWORD) {
+		const exeName = renamedOclifInstallers[process.platform];
+		const execFileAsync = util.promisify<string, string[], void>(execFile);
+
+		console.log(`Signing installer "${exeName}"`);
+		await execFileAsync(MSYS2_BASH, [
+			'sign-exe.sh',
+			'-f',
+			exeName,
+			'-d',
+			`balena-cli ${version}`,
+		]);
+	} else {
+		console.log(
+			'Skipping installer signing step because CSC_* env vars are not set',
+		);
+	}
+}
+
+/**
+ * Run the `oclif-dev pack:win` or `pack:macos` command (depending on the value
+ * of process.platform) to generate the native installers (which end up under
+ * the 'dist' folder). There are some harcoded options such as selecting only
+ * 64-bit binaries under Windows.
+ */
+export async function buildOclifInstaller() {
+	let packOS = '';
+	let packOpts = ['-r', ROOT];
+	if (process.platform === 'darwin') {
+		packOS = 'macos';
+	} else if (process.platform === 'win32') {
+		packOS = 'win';
+		packOpts = packOpts.concat('-t', 'win32-x64');
+	}
+	if (packOS) {
+		console.log(`Building oclif installer for CLI ${version}`);
+		const packCmd = `pack:${packOS}`;
+		const dirs = [path.join(ROOT, 'dist', packOS)];
+		if (packOS === 'win') {
+			dirs.push(path.join(ROOT, 'tmp', 'win*'));
+		}
+		for (const dir of dirs) {
+			console.log(`rimraf(${dir})`);
+			await Bluebird.fromCallback((cb) => rimraf(dir, cb));
+		}
+		console.log('=======================================================');
+		console.log(`oclif-dev "${packCmd}" "${packOpts.join('" "')}"`);
+		console.log(`cwd="${process.cwd()}" ROOT="${ROOT}"`);
+		console.log('=======================================================');
+		await oclifRun([packCmd].concat(...packOpts));
+		await renameInstallerFiles();
+		// The Windows installer is explicitly signed here (oclif doesn't do it).
+		// The macOS installer is automatically signed by oclif (which runs the
+		// `pkgbuild` tool), using the certificate name given in package.json
+		// (`oclif.macos.sign` section).
+		if (process.platform === 'win32') {
+			await signWindowsInstaller();
+		}
+		console.log(`oclif installer build completed`);
+	}
+}
+
+/**
+ * Wrapper around the npm `catch-uncommitted` package in order to run it
+ * conditionally, only when:
+ * - A CI env var is set (CI=true), and
+ * - The OS is not Windows. (`catch-uncommitted` fails on Windows)
+ */
+export async function catchUncommitted(): Promise<void> {
+	if (process.env.DEBUG) {
+		console.error(`[debug] CI=${process.env.CI} platform=${process.platform}`);
+	}
+	if (
+		process.env.CI &&
+		['true', 'yes', '1'].includes(process.env.CI.toLowerCase()) &&
+		process.platform !== 'win32'
+	) {
+		await whichSpawn('npx', [
+			'catch-uncommitted',
+			'--catch-no-git',
+			'--skip-node-versionbot-changes',
+			'--ignore-space-at-eol',
+		]);
+	}
+}
+
+export async function testShrinkwrap(): Promise<void> {
+	if (process.env.DEBUG) {
+		console.error(`[debug] platform=${process.platform}`);
+	}
+	if (process.platform !== 'win32') {
+		await whichSpawn(path.resolve(__dirname, 'test-lock-deduplicated.sh'));
+	}
+}

automation/capitanodoc/capitanodoc.ts

@@ -0,0 +1,200 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import * as path from 'path';
+import { MarkdownFileParser } from './utils';
+
+/**
+ * This is the skeleton of CLI documentation/reference web page at:
+ * https://www.balena.io/docs/reference/cli/
+ *
+ * The `getCapitanoDoc` function in this module parses README.md and adds
+ * some content to this object.
+ */
+const capitanoDoc = {
+	title: 'Balena CLI Documentation',
+	introduction: '',
+	categories: [
+		{
+			title: 'API keys',
+			files: ['build/actions-oclif/api-key/generate.js'],
+		},
+		{
+			title: 'Application',
+			files: [
+				'build/actions-oclif/apps.js',
+				'build/actions-oclif/app/index.js',
+				'build/actions-oclif/app/create.js',
+				'build/actions-oclif/app/rm.js',
+				'build/actions-oclif/app/restart.js',
+			],
+		},
+		{
+			title: 'Authentication',
+			files: [
+				'build/actions-oclif/login.js',
+				'build/actions-oclif/logout.js',
+				'build/actions-oclif/whoami.js',
+			],
+		},
+		{
+			title: 'Device',
+			files: [
+				'build/actions-oclif/device/identify.js',
+				'build/actions-oclif/device/init.js',
+				'build/actions-oclif/device/index.js',
+				'build/actions-oclif/device/move.js',
+				'build/actions-oclif/device/reboot.js',
+				'build/actions-oclif/device/register.js',
+				'build/actions-oclif/device/rename.js',
+				'build/actions-oclif/device/rm.js',
+				'build/actions-oclif/device/shutdown.js',
+				'build/actions-oclif/devices/index.js',
+				'build/actions-oclif/devices/supported.js',
+				'build/actions-oclif/device/os-update.js',
+				'build/actions-oclif/device/public-url.js',
+			],
+		},
+		{
+			title: 'Environment Variables',
+			files: [
+				'build/actions-oclif/envs.js',
+				'build/actions-oclif/env/add.js',
+				'build/actions-oclif/env/rename.js',
+				'build/actions-oclif/env/rm.js',
+			],
+		},
+		{
+			title: 'Tags',
+			files: [
+				'build/actions-oclif/tags.js',
+				'build/actions-oclif/tag/rm.js',
+				'build/actions-oclif/tag/set.js',
+			],
+		},
+		{
+			title: 'Help and Version',
+			files: ['build/actions/help.js', 'build/actions-oclif/version.js'],
+		},
+		{
+			title: 'Keys',
+			files: [
+				'build/actions-oclif/keys.js',
+				'build/actions-oclif/key/index.js',
+				'build/actions-oclif/key/add.js',
+				'build/actions-oclif/key/rm.js',
+			],
+		},
+		{
+			title: 'Logs',
+			files: ['build/actions-oclif/logs.js'],
+		},
+		{
+			title: 'Network',
+			files: [
+				'build/actions-oclif/scan.js',
+				'build/actions-oclif/ssh.js',
+				'build/actions-oclif/tunnel.js',
+			],
+		},
+		{
+			title: 'Notes',
+			files: ['build/actions-oclif/note.js'],
+		},
+		{
+			title: 'OS',
+			files: [
+				'build/actions-oclif/os/build-config.js',
+				'build/actions-oclif/os/configure.js',
+				'build/actions-oclif/os/versions.js',
+				'build/actions-oclif/os/download.js',
+				'build/actions-oclif/os/initialize.js',
+			],
+		},
+		{
+			title: 'Config',
+			files: [
+				'build/actions-oclif/config/generate.js',
+				'build/actions-oclif/config/inject.js',
+				'build/actions-oclif/config/read.js',
+				'build/actions-oclif/config/reconfigure.js',
+				'build/actions-oclif/config/write.js',
+			],
+		},
+		{
+			title: 'Preload',
+			files: ['build/actions/preload.js'],
+		},
+		{
+			title: 'Push',
+			files: ['build/actions-oclif/push.js'],
+		},
+		{
+			title: 'Settings',
+			files: ['build/actions-oclif/settings.js'],
+		},
+		{
+			title: 'Local',
+			files: [
+				'build/actions-oclif/local/configure.js',
+				'build/actions-oclif/local/flash.js',
+			],
+		},
+		{
+			title: 'Deploy',
+			files: ['build/actions-oclif/build.js', 'build/actions/deploy.js'],
+		},
+		{
+			title: 'Platform',
+			files: ['build/actions-oclif/join.js', 'build/actions-oclif/leave.js'],
+		},
+		{
+			title: 'Utilities',
+			files: ['build/actions-oclif/util/available-drives.js'],
+		},
+	],
+};
+
+/**
+ * Modify and return the `capitanoDoc` object above in order to render the
+ * CLI documentation/reference web page at:
+ * https://www.balena.io/docs/reference/cli/
+ *
+ * This function parses the README.md file to extract relevant sections
+ * for the documentation web page.
+ */
+export async function getCapitanoDoc(): Promise<typeof capitanoDoc> {
+	const readmePath = path.join(__dirname, '..', '..', 'README.md');
+	const mdParser = new MarkdownFileParser(readmePath);
+	const sections: string[] = await Promise.all([
+		mdParser.getSectionOfTitle('About').then((sectionLines: string) => {
+			// delete the title of the 'About' section for the web page
+			const match = /^(#+)\s+.+?\n\s*([^]*)/.exec(sectionLines);
+			if (!match || match.length < 3) {
+				throw new Error(`Error parsing section title`);
+			}
+			// match[1] has the title, match[2] has the rest
+			return match && match[2];
+		}),
+		mdParser.getSectionOfTitle('Installation'),
+		mdParser.getSectionOfTitle('Getting Started'),
+		mdParser.getSectionOfTitle('Support, FAQ and troubleshooting'),
+		mdParser.getSectionOfTitle('Deprecation policy'),
+	]);
+	capitanoDoc.introduction = sections.join('\n');
+	return capitanoDoc;
+}

automation/capitanodoc/doc-types.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Command as OclifCommandClass } from '@oclif/command';
+import { CommandDefinition as CapitanoCommand } from 'capitano';
+
+type OclifCommand = typeof OclifCommandClass;
+
+export interface Document {
+	title: string;
+	introduction: string;
+	categories: Category[];
+}
+
+export interface Category {
+	title: string;
+	commands: Array<CapitanoCommand | OclifCommand>;
+}
+
+export { CapitanoCommand, OclifCommand };

automation/capitanodoc/index.ts

@@ -0,0 +1,92 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import * as _ from 'lodash';
+import * as path from 'path';
+
+import { getCapitanoDoc } from './capitanodoc';
+import { CapitanoCommand, Category, Document, OclifCommand } from './doc-types';
+import * as markdown from './markdown';
+
+/**
+ * Generates the markdown document (as a string) for the CLI documentation
+ * page on the web: https://www.balena.io/docs/reference/cli/
+ */
+export async function renderMarkdown(): Promise<string> {
+	const capitanodoc = await getCapitanoDoc();
+	const result: Document = {
+		title: capitanodoc.title,
+		introduction: capitanodoc.introduction,
+		categories: [],
+	};
+
+	for (const commandCategory of capitanodoc.categories) {
+		const category: Category = {
+			title: commandCategory.title,
+			commands: [],
+		};
+
+		for (const jsFilename of commandCategory.files) {
+			category.commands.push(
+				...(jsFilename.includes('actions-oclif')
+					? importOclifCommands(jsFilename)
+					: importCapitanoCommands(jsFilename)),
+			);
+		}
+		result.categories.push(category);
+	}
+
+	return markdown.render(result);
+}
+
+function importCapitanoCommands(jsFilename: string): CapitanoCommand[] {
+	const actions = require(path.join(process.cwd(), jsFilename));
+	const commands: CapitanoCommand[] = [];
+
+	if (actions.signature) {
+		commands.push(_.omit(actions, 'action') as any);
+	} else {
+		for (const actionName of Object.keys(actions)) {
+			const actionCommand = actions[actionName];
+			commands.push(_.omit(actionCommand, 'action') as any);
+		}
+	}
+	return commands;
+}
+
+function importOclifCommands(jsFilename: string): OclifCommand[] {
+	// TODO: Currently oclif commands with no `usage` overridden will cause
+	//  an error when parsed.  This should be improved so that `usage` does not have
+	//  to be overridden if not necessary.
+	const command: OclifCommand = require(path.join(process.cwd(), jsFilename))
+		.default as OclifCommand;
+	return [command];
+}
+
+/**
+ * Print the CLI docs markdown to stdout.
+ * See package.json for how the output is redirected to a file.
+ */
+async function printMarkdown() {
+	try {
+		console.log(await renderMarkdown());
+	} catch (error) {
+		console.error(error);
+		process.exit(1);
+	}
+}
+
+printMarkdown();

automation/capitanodoc/markdown.ts

@@ -0,0 +1,160 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { flagUsages } from '@oclif/parser';
+import * as ent from 'ent';
+import * as _ from 'lodash';
+
+import { getManualSortCompareFunction } from '../../lib/utils/helpers';
+import { capitanoizeOclifUsage } from '../../lib/utils/oclif-utils';
+import { CapitanoCommand, Category, Document, OclifCommand } from './doc-types';
+import * as utils from './utils';
+
+function renderCapitanoCommand(command: CapitanoCommand): string[] {
+	const result = [`## ${ent.encode(command.signature)}`, command.help!];
+
+	if (!_.isEmpty(command.options)) {
+		result.push('### Options');
+
+		for (const option of command.options!) {
+			if (option == null) {
+				throw new Error(`Undefined option in markdown generation!`);
+			}
+			if (option.description == null) {
+				throw new Error(`Undefined option.description in markdown generation!`);
+			}
+			result.push(
+				`#### ${utils.parseCapitanoOption(option)}`,
+				option.description,
+			);
+		}
+	}
+	return result;
+}
+
+function renderOclifCommand(command: OclifCommand): string[] {
+	const result = [`## ${ent.encode(command.usage)}`];
+	const description = (command.description || '')
+		.split('\n')
+		.slice(1) // remove the first line, which oclif uses as help header
+		.join('\n')
+		.trim();
+	result.push(description);
+
+	if (!_.isEmpty(command.examples)) {
+		result.push('Examples:', command.examples!.map((v) => `\t${v}`).join('\n'));
+	}
+
+	if (!_.isEmpty(command.args)) {
+		result.push('### Arguments');
+		for (const arg of command.args!) {
+			result.push(`#### ${arg.name.toUpperCase()}`, arg.description || '');
+		}
+	}
+
+	if (!_.isEmpty(command.flags)) {
+		result.push('### Options');
+		for (const [name, flag] of Object.entries(command.flags!)) {
+			if (name === 'help') {
+				continue;
+			}
+			flag.name = name;
+			const flagUsage = flagUsages([flag])
+				.map(([usage, _description]) => usage)
+				.join()
+				.trim();
+			result.push(`#### ${flagUsage}`);
+			result.push(flag.description || '');
+		}
+	}
+	return result;
+}
+
+function renderCategory(category: Category): string[] {
+	const result = [`# ${category.title}`];
+	for (const command of category.commands) {
+		result.push(
+			...(typeof command === 'object'
+				? renderCapitanoCommand(command)
+				: renderOclifCommand(command)),
+		);
+	}
+	return result;
+}
+
+function getAnchor(cmdSignature: string): string {
+	return `#${_.trim(cmdSignature.replace(/\W+/g, '-'), '-').toLowerCase()}`;
+}
+
+function renderToc(categories: Category[]): string[] {
+	const result = [`# CLI Command Reference`];
+
+	for (const category of categories) {
+		result.push(`- ${category.title}`);
+		result.push(
+			category.commands
+				.map((command) => {
+					const signature =
+						typeof command === 'object'
+							? command.signature // Capitano
+							: capitanoizeOclifUsage(command.usage); // oclif
+					return `\t- [${ent.encode(signature)}](${getAnchor(signature)})`;
+				})
+				.join('\n'),
+		);
+	}
+	return result;
+}
+
+const manualCategorySorting: { [category: string]: string[] } = {
+	'Environment Variables': ['envs', 'env rm', 'env add', 'env rename'],
+	OS: [
+		'os versions',
+		'os download',
+		'os build config',
+		'os configure',
+		'os initialize',
+	],
+};
+
+function sortCommands(doc: Document): void {
+	for (const category of doc.categories) {
+		if (category.title in manualCategorySorting) {
+			category.commands = category.commands.sort(
+				getManualSortCompareFunction<CapitanoCommand | OclifCommand, string>(
+					manualCategorySorting[category.title],
+					(cmd: CapitanoCommand | OclifCommand, x: string) =>
+						typeof cmd === 'object' // Capitano vs oclif command
+							? cmd.signature.replace(/\W+/g, ' ').includes(x)
+							: (cmd.usage || '').toString().replace(/\W+/g, ' ').includes(x),
+				),
+			);
+		}
+	}
+}
+
+export function render(doc: Document) {
+	sortCommands(doc);
+	const result = [
+		`# ${doc.title}`,
+		doc.introduction,
+		...renderToc(doc.categories),
+	];
+	for (const category of doc.categories) {
+		result.push(...renderCategory(category));
+	}
+	return result.join('\n\n');
+}

automation/capitanodoc/utils.ts

@@ -0,0 +1,136 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { OptionDefinition } from 'capitano';
+import * as ent from 'ent';
+import * as fs from 'fs';
+import * as readline from 'readline';
+
+export function getOptionPrefix(signature: string) {
+	if (signature.length > 1) {
+		return '--';
+	} else {
+		return '-';
+	}
+}
+
+export function getOptionSignature(signature: string) {
+	return `${getOptionPrefix(signature)}${signature}`;
+}
+
+export function parseCapitanoOption(option: OptionDefinition): string {
+	let result = getOptionSignature(option.signature);
+
+	if (Array.isArray(option.alias)) {
+		for (const alias of option.alias) {
+			result += `, ${getOptionSignature(alias)}`;
+		}
+	} else if (typeof option.alias === 'string') {
+		result += `, ${getOptionSignature(option.alias)}`;
+	}
+
+	if (option.parameter) {
+		result += ` <${option.parameter}>`;
+	}
+
+	return ent.encode(result);
+}
+
+export class MarkdownFileParser {
+	constructor(public mdFilePath: string) {}
+
+	/**
+	 * Extract the lines of a markdown document section with the given title.
+	 * For example, consider this sample markdown document:
+	 * ```
+	 *     # balena CLI
+	 *
+	 *     ## Introduction
+	 *     Lorem ipsum dolor sit amet, consectetur adipiscing elit,
+	 *
+	 *     ## Getting Started
+	 *     sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.
+	 *
+	 *     ### Prerequisites
+	 *     - Foo
+	 *     - Bar
+	 *
+	 *     ## Support
+	 *     Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris.
+	 * ```
+	 *
+	 * Calling getSectionOfTitle('Getting Started') for the markdown doc above
+	 * returns everything from line '## Getting Started' (included) to line
+	 * '## Support' (excluded). This method counts the number of '#' characters
+	 * to determine that subsections should be included as part of the parent
+	 * section.
+	 *
+	 * @param title The section title without '#' chars, eg. 'Getting Started'
+	 */
+	public async getSectionOfTitle(
+		title: string,
+		includeSubsections = true,
+	): Promise<string> {
+		let foundSectionLines: string[];
+		let foundSectionLevel = 0;
+
+		const rl = readline.createInterface({
+			input: fs.createReadStream(this.mdFilePath),
+			crlfDelay: Infinity,
+		});
+
+		rl.on('line', (line) => {
+			// try to match a line like "## Getting Started", where the number
+			// of '#' characters is the sectionLevel ('##' -> 2), and the
+			// sectionTitle is "Getting Started"
+			const match = /^(#+)\s+(.+)/.exec(line);
+			if (match) {
+				const sectionLevel = match[1].length;
+				const sectionTitle = match[2];
+
+				// If the target section had already been found: append a line, or end it
+				if (foundSectionLines) {
+					if (!includeSubsections || sectionLevel <= foundSectionLevel) {
+						// end previously found section
+						rl.close();
+					}
+				} else if (sectionTitle === title) {
+					// found the target section
+					foundSectionLevel = sectionLevel;
+					foundSectionLines = [];
+				}
+			}
+			if (foundSectionLines) {
+				foundSectionLines.push(line);
+			}
+		});
+
+		return await new Promise((resolve, reject) => {
+			rl.on('close', () => {
+				if (foundSectionLines) {
+					resolve(foundSectionLines.join('\n'));
+				} else {
+					reject(
+						new Error(
+							`Markdown section not found: title="${title}" file="${this.mdFilePath}"`,
+						),
+					);
+				}
+			});
+		});
+	}
+}

automation/check-doc.js

@@ -0,0 +1,84 @@
+/**
+ * @license
+ * Copyright 2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const stripIndent = require('common-tags/lib/stripIndent');
+const _ = require('lodash');
+const { promises: fs } = require('fs');
+const path = require('path');
+const simplegit = require('simple-git/promise');
+
+const ROOT = path.normalize(path.join(__dirname, '..'));
+
+/**
+ * Compare the timestamp of cli.markdown with the timestamp of staged files,
+ * issuing an error if cli.markdown is older.
+ * If cli.markdown does not require updating and the developer cannot run
+ * `npm run build` on their laptop, the error message suggests a workaround
+ * using `touch`.
+ */
+async function checkBuildTimestamps() {
+	const git = simplegit(ROOT);
+	const docFile = path.join(ROOT, 'doc', 'cli.markdown');
+	const [docStat, gitStatus] = await Promise.all([
+		fs.stat(docFile),
+		git.status(),
+	]);
+	const stagedFiles = _.uniq([
+		...gitStatus.created,
+		...gitStatus.staged,
+		...gitStatus.renamed.map((o) => o.to),
+	])
+		// select only staged files that start with lib/ or typings/
+		.filter((f) => f.match(/^(lib|typings)[/\\]/))
+		.map((f) => path.join(ROOT, f));
+
+	const fStats = await Promise.all(stagedFiles.map((f) => fs.stat(f)));
+	fStats.forEach((fStat, index) => {
+		if (fStat.mtimeMs > docStat.mtimeMs) {
+			const fPath = stagedFiles[index];
+			throw new Error(stripIndent`
+				--------------------------------------------------------------------------------
+				ERROR: at least one staged file: "${fPath}"
+				has a more recent modification timestamp than the documentation file:
+				"${docFile}"
+
+				This probably means that \`npm run build\` or \`npm test\` have not been executed,
+				and this error can be fixed by doing so. Running \`npm run build\` or \`npm test\`
+				before commiting is required in order to update the CLI markdown documentation
+				(in case any command-line options were updated, added or removed) and also to
+				catch Typescript type check errors sooner and reduce overall waiting time, given
+				that the CI build/tests are currently rather lengthy.
+
+				If you need/wish to bypass this check without running \`npm run build\`, run:
+				  npx touch -am "${docFile}"
+				and then try again.
+				--------------------------------------------------------------------------------
+			`);
+		}
+	});
+}
+
+async function run() {
+	try {
+		await checkBuildTimestamps();
+	} catch (err) {
+		console.error(err.message);
+		process.exitCode = 1;
+	}
+}
+
+run();

automation/check-npm-version.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Check that semver v1 is greater than or equal to semver v2.
+ *
+ * We don't `require('semver')` to allow this script to be run as a npm
+ * 'preinstall' hook, at which point no dependencies have been installed.
+ */
+function parseSemver(version) {
+	const match = /v?(\d+)\.(\d+).(\d+)/.exec(version);
+	if (match == null) {
+		throw new Error(`Invalid semver version: ${version}`);
+	}
+	const [, major, minor, patch] = match;
+	return [parseInt(major, 10), parseInt(minor, 10), parseInt(patch, 10)];
+}
+
+function semverGte(v1, v2) {
+	let v1Array = parseSemver(v1);
+	let v2Array = parseSemver(v2);
+	for (let i = 0; i < 3; i++) {
+		if (v1Array[i] < v2Array[i]) {
+			return false;
+		} else if (v1Array[i] > v2Array[i]) {
+			return true;
+		}
+	}
+	return true;
+}
+
+function checkNpmVersion() {
+	const execSync = require('child_process').execSync;
+	const npmVersion = execSync('npm --version').toString().trim();
+	const requiredVersion = '6.9.0';
+	if (!semverGte(npmVersion, requiredVersion)) {
+		// In case you take issue with the error message below:
+		//   "At this point, however, your 'npm-shrinkwrap.json' file has
+		//    already been damaged"
+		// ... and think: "why not add the check to the 'preinstall' hook?",
+		// the reason is that it would unnecessarily prevent end users from
+		// using npm v6.4.1 that ships with Node 8.  (It is OK for the
+		// shrinkwrap file to get damaged if it is not going to be reused.)
+		console.error(`\
+-------------------------------------------------------------------------------
+Error: npm version '${npmVersion}' detected. Please upgrade to npm v${requiredVersion} or later
+because of a bug that causes the 'npm-shrinkwrap.json' file to be damaged.
+At this point, however, your 'npm-shrinkwrap.json' file has already been
+damaged. Please revert it to the master branch state with a command such as:
+"git checkout master -- npm-shrinkwrap.json"
+Then re-run "npm install" using npm version ${requiredVersion} or later.
+-------------------------------------------------------------------------------`);
+		process.exit(1);
+	}
+}
+
+checkNpmVersion();

automation/deploy-bin.ts

@@ -0,0 +1,252 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import * as Bluebird from 'bluebird';
+import * as _ from 'lodash';
+import * as semver from 'semver';
+
+import { finalReleaseAssets, version } from './build-bin';
+
+const { GITHUB_TOKEN } = process.env;
+
+/**
+ * Create or update a release in GitHub's releases page, uploading the
+ * installer files (standalone zip + native oclif installers).
+ */
+export async function createGitHubRelease() {
+	console.log(`Publishing release ${version} to GitHub`);
+	const publishRelease = await import('publish-release');
+	const ghRelease = await Bluebird.fromCallback(
+		publishRelease.bind(null, {
+			token: GITHUB_TOKEN || '',
+			owner: 'balena-io',
+			repo: 'balena-cli',
+			tag: version,
+			name: `balena-CLI ${version}`,
+			reuseRelease: true,
+			assets: finalReleaseAssets[process.platform],
+		}),
+	);
+	console.log(`Release ${version} successful: ${ghRelease.html_url}`);
+}
+
+/**
+ * Top-level function to create a CLI release in GitHub's releases page:
+ * call zipStandaloneInstaller(), rename the files as we'd like them to
+ * display on the releases page, and call createGitHubRelease() to upload
+ * the files.
+ */
+export async function release() {
+	try {
+		await createGitHubRelease();
+	} catch (err) {
+		console.error('Release failed');
+		console.error(err);
+		process.exit(1);
+	}
+}
+
+/** Return a cached Octokit instance, creating a new one as needed. */
+const getOctokit = _.once(function () {
+	const Octokit = (require('@octokit/rest') as typeof import('@octokit/rest')).Octokit.plugin(
+		(require('@octokit/plugin-throttling') as typeof import('@octokit/plugin-throttling'))
+			.throttling,
+	);
+	return new Octokit({
+		auth: GITHUB_TOKEN,
+		throttle: {
+			onRateLimit: (retryAfter: number, options: any) => {
+				console.warn(
+					`Request quota exhausted for request ${options.method} ${options.url}`,
+				);
+				// retries 3 times
+				if (options.request.retryCount < 3) {
+					console.log(`Retrying after ${retryAfter} seconds!`);
+					return true;
+				}
+			},
+			onAbuseLimit: (_retryAfter: number, options: any) => {
+				// does not retry, only logs a warning
+				console.warn(
+					`Abuse detected for request ${options.method} ${options.url}`,
+				);
+			},
+		},
+	});
+});
+
+/**
+ * Extract pagination information (current page, total pages, ordinal number)
+ * from the 'link' response header (example below), using the parse-link-header
+ * npm package:
+ * "link": "<https://api.github.com/repositories/187370853/releases?per_page=2&page=2>; rel=\"next\",
+ *          <https://api.github.com/repositories/187370853/releases?per_page=2&page=3>; rel=\"last\""
+ *
+ * @param response Octokit response object (including response.headers.link)
+ * @param perPageDefault Default per_page pagination value if missing in URL
+ * @return Object where 'page' is the current page number (1-based),
+ * 'pages' is the total number of pages, and 'ordinal' is the ordinal number
+ * (3rd, 4th, 5th...) of the first item in the current page.
+ */
+function getPageNumbers(
+	response: any,
+	perPageDefault: number,
+): { page: number; pages: number; ordinal: number } {
+	const res = { page: 1, pages: 1, ordinal: 1 };
+	if (!response.headers.link) {
+		return res;
+	}
+	const parse = require('parse-link-header') as typeof import('parse-link-header');
+	const parsed = parse(response.headers.link);
+	if (parsed == null) {
+		throw new Error(`Failed to parse link header: '${response.headers.link}'`);
+	}
+	let perPage = perPageDefault;
+	if (parsed.next) {
+		if (parsed.next.per_page) {
+			perPage = parseInt(parsed.next.per_page, 10);
+		}
+		res.page = parseInt(parsed.next.page, 10) - 1;
+		res.pages = parseInt(parsed.last.page, 10);
+	} else {
+		if (parsed.prev.per_page) {
+			perPage = parseInt(parsed.prev.per_page, 10);
+		}
+		res.page = res.pages = parseInt(parsed.prev.page, 10) + 1;
+	}
+	res.ordinal = (res.page - 1) * perPage + 1;
+	return res;
+}
+
+/**
+ * Iterate over every GitHub release in the given owner/repo, check whether
+ * its tag_name matches against the affectedVersions semver spec, and if so
+ * replace its release description (body) with the given newDescription value.
+ * @param owner GitHub repo owner, e.g. 'balena-io' or 'pdcastro'
+ * @param repo GitHub repo, e.g. 'balena-cli'
+ * @param affectedVersions Semver spec, e.g. '2.6.1 - 7.10.9 || 8.0.0'
+ * @param newDescription New release description (body)
+ * @param editID Short string present in newDescription, e.g. '[AA101]', that
+ * can be searched to determine whether that release has already been updated.
+ */
+async function updateGitHubReleaseDescriptions(
+	owner: string,
+	repo: string,
+	affectedVersions: string,
+	newDescription: string,
+	editID: string,
+) {
+	const perPage = 30;
+	const octokit = getOctokit();
+	const options = await octokit.repos.listReleases.endpoint.merge({
+		owner,
+		repo,
+		per_page: perPage,
+	});
+	let errCount = 0;
+	for await (const response of octokit.paginate.iterator(options)) {
+		const { page: thisPage, pages: totalPages, ordinal } = getPageNumbers(
+			response,
+			perPage,
+		);
+		let i = 0;
+		for (const cliRelease of response.data) {
+			const prefix = `[#${ordinal + i++} pg ${thisPage}/${totalPages}]`;
+			if (!cliRelease.id) {
+				console.error(
+					`${prefix} Error: missing release ID (errCount=${++errCount})`,
+				);
+				continue;
+			}
+			const skipMsg = `${prefix} skipping release "${cliRelease.tag_name}" (${cliRelease.id})`;
+			if (cliRelease.draft === true) {
+				console.info(`${skipMsg}: draft release`);
+				continue;
+			} else if (cliRelease.body && cliRelease.body.includes(editID)) {
+				console.info(`${skipMsg}: already updated`);
+				continue;
+			} else if (!semver.satisfies(cliRelease.tag_name, affectedVersions)) {
+				console.info(`${skipMsg}: outside version range`);
+				continue;
+			} else {
+				const updatedRelease = {
+					owner,
+					repo,
+					release_id: cliRelease.id,
+					body: newDescription,
+				};
+				let oldBodyPreview = cliRelease.body;
+				if (oldBodyPreview) {
+					oldBodyPreview = oldBodyPreview.replace(/\s+/g, ' ').trim();
+					if (oldBodyPreview.length > 12) {
+						oldBodyPreview = oldBodyPreview.substring(0, 9) + '...';
+					}
+				}
+				console.info(
+					`${prefix} updating release "${cliRelease.tag_name}" (${cliRelease.id}) old body="${oldBodyPreview}"`,
+				);
+				try {
+					await octokit.repos.updateRelease(updatedRelease);
+				} catch (err) {
+					console.error(
+						`${skipMsg}: Error: ${err.message} (count=${++errCount})`,
+					);
+					continue;
+				}
+			}
+		}
+	}
+}
+
+/**
+ * Add a warning description to CLI releases affected by a mixpanel tracking
+ * security issue (#1359). This function can be executed "manually" with the
+ * following command line:
+ *
+ * npx ts-node --type-check -P automation/tsconfig.json automation/run.ts fix1359
+ */
+export async function updateDescriptionOfReleasesAffectedByIssue1359() {
+	// Run only on Linux/Node10, instead of all platform/Node combinations.
+	// (It could have been any other platform, as long as it only runs once.)
+	if (process.platform !== 'linux' || semver.major(process.version) !== 10) {
+		return;
+	}
+	const owner = 'balena-io';
+	const repo = 'balena-cli';
+	const affectedVersions =
+		'2.6.1 - 7.10.9 || 8.0.0 - 8.1.0 || 9.0.0 - 9.15.6 || 10.0.0 - 10.17.5 || 11.0.0 - 11.7.2';
+	const editID = '[AA100]';
+	let newDescription = `
+		Please note: the "login" command in this release is affected by a
+		security issue fixed in versions
+		[7.10.10](https://github.com/balena-io/balena-cli/releases/tag/v7.10.10),
+		[8.1.1](https://github.com/balena-io/balena-cli/releases/tag/v8.1.1),
+		[9.15.7](https://github.com/balena-io/balena-cli/releases/tag/v9.15.7),
+		[10.17.6](https://github.com/balena-io/balena-cli/releases/tag/v10.17.6),
+		[11.7.3](https://github.com/balena-io/balena-cli/releases/tag/v11.7.3)
+		and later. If you need to use this version, avoid passing your password,
+		keys or tokens as command-line arguments. ${editID}`;
+	// remove line breaks and collapse white space
+	newDescription = newDescription.replace(/\s+/g, ' ').trim();
+	await updateGitHubReleaseDescriptions(
+		owner,
+		repo,
+		affectedVersions,
+		newDescription,
+		editID,
+	);
+}

automation/run.ts

@@ -0,0 +1,123 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import * as _ from 'lodash';
+
+import {
+	buildOclifInstaller,
+	buildStandaloneZip,
+	catchUncommitted,
+	testShrinkwrap,
+} from './build-bin';
+import {
+	release,
+	updateDescriptionOfReleasesAffectedByIssue1359,
+} from './deploy-bin';
+import { fixPathForMsys, ROOT, runUnderMsys } from './utils';
+
+// DEBUG set to falsy for negative values else is truthy
+process.env.DEBUG = ['0', 'no', 'false', '', undefined].includes(
+	process.env.DEBUG?.toLowerCase(),
+)
+	? ''
+	: '1';
+
+function exitWithError(error: Error | string): never {
+	console.error(`Error: ${error}`);
+	process.exit(1);
+}
+
+/**
+ * Trivial command-line parser. Check whether the command-line argument is one
+ * of the following strings, then call the appropriate functions:
+ *     'build:installer'   (to build a native oclif installer)
+ * 	   'build:standalone'  (to build a standalone pkg package)
+ *     'release'           (to create/update a GitHub release)
+ *
+ * In the case of 'build:installer', also call runUnderMsys() to switch the
+ * shell from cmd.exe to MSYS2 bash.exe.
+ *
+ * @param args Arguments to parse (default is process.argv.slice(2))
+ */
+export async function run(args?: string[]) {
+	args = args || process.argv.slice(2);
+	console.log(`automation/run.ts process.argv=[${process.argv}]\n`);
+	console.log(`automation/run.ts args=[${args}]`);
+	if (_.isEmpty(args)) {
+		return exitWithError('missing command-line arguments');
+	}
+	const commands: { [cmd: string]: () => void | Promise<void> } = {
+		'build:installer': buildOclifInstaller,
+		'build:standalone': buildStandaloneZip,
+		'catch-uncommitted': catchUncommitted,
+		'test-shrinkwrap': testShrinkwrap,
+		fix1359: updateDescriptionOfReleasesAffectedByIssue1359,
+		release,
+	};
+	for (const arg of args) {
+		if (!commands.hasOwnProperty(arg)) {
+			return exitWithError(`command unknown: ${arg}`);
+		}
+	}
+
+	// If runUnderMsys() is called to re-execute this script under MSYS2,
+	// the current working dir becomes the MSYS2 homedir, so we change back.
+	process.chdir(ROOT);
+
+	// The BUILD_TMP env var is used as an alternative location for oclif
+	// (patched) to copy/extract the CLI files, run npm install and then
+	// create the NSIS executable installer for Windows. This was necessary
+	// to avoid issues with a 260-char limit on Windows paths (possibly a
+	// limitation of some library used by NSIS), as the "current working dir"
+	// provided by balena CI is a rather long path to start with.
+	if (process.platform === 'win32' && !process.env.BUILD_TMP) {
+		const randID = (await import('crypto'))
+			.randomBytes(6)
+			.toString('base64')
+			.replace(/\+/g, '-')
+			.replace(/\//g, '_'); // base64url (RFC 4648)
+		process.env.BUILD_TMP = `C:\\tmp\\${randID}`;
+	}
+
+	for (const arg of args) {
+		try {
+			if (arg === 'build:installer' && process.platform === 'win32') {
+				// ensure running under MSYS2
+				if (!process.env.MSYSTEM) {
+					process.env.MSYS2_PATH_TYPE = 'inherit';
+					await runUnderMsys([
+						fixPathForMsys(process.argv[0]),
+						fixPathForMsys(process.argv[1]),
+						arg,
+					]);
+					continue;
+				}
+				if (process.env.MSYS2_PATH_TYPE !== 'inherit') {
+					throw new Error(
+						'the MSYS2_PATH_TYPE env var must be set to "inherit"',
+					);
+				}
+			}
+			const cmdFunc = commands[arg];
+			await cmdFunc();
+		} catch (err) {
+			return exitWithError(`"${arg}": ${err}`);
+		}
+	}
+}
+
+run();

automation/test-lock-deduplicated.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+
+cp npm-shrinkwrap.json npm-shrinkwrap.json.old
+npm i
+npm dedupe
+npm i
+
+if ! diff -q npm-shrinkwrap.json npm-shrinkwrap.json.old > /dev/null; then
+  rm npm-shrinkwrap.json.old
+  echo "** npm-shrinkwrap.json was not deduplicated or not fully committed - FAIL **";
+  echo "** Please run 'npm ci', followed by 'npm dedupe' **";
+  exit 1;
+fi
+
+rm npm-shrinkwrap.json.old

automation/update-module.ts

@@ -0,0 +1,140 @@
+import { exec } from 'child_process';
+import * as semver from 'semver';
+
+const changeTypes = ['major', 'minor', 'patch'] as const;
+
+const validateChangeType = (maybeChangeType: string = 'minor') => {
+	maybeChangeType = maybeChangeType.toLowerCase();
+	switch (maybeChangeType) {
+		case 'patch':
+		case 'minor':
+		case 'major':
+			return maybeChangeType;
+		default:
+			console.error(`Invalid change type: '${maybeChangeType}'`);
+			return process.exit(1);
+	}
+};
+
+const compareSemverChangeType = (oldVersion: string, newVersion: string) => {
+	const oldSemver = semver.parse(oldVersion)!;
+	const newSemver = semver.parse(newVersion)!;
+
+	for (const changeType of changeTypes) {
+		if (oldSemver[changeType] !== newSemver[changeType]) {
+			return changeType;
+		}
+	}
+};
+
+const run = async (cmd: string) => {
+	console.info(`Running '${cmd}'`);
+	return new Promise<{ stdout: string; stderr: string }>((resolve, reject) => {
+		const p = exec(cmd, { encoding: 'utf8' }, (err, stdout, stderr) => {
+			if (err) {
+				reject(err);
+				return;
+			}
+			resolve({ stdout, stderr });
+		});
+		p.stdout.pipe(process.stdout);
+		p.stderr.pipe(process.stderr);
+	});
+};
+
+const getVersion = async (module: string): Promise<string> => {
+	const { stdout } = await run(`npm ls --json --depth 0 ${module}`);
+	return JSON.parse(stdout).dependencies[module].version;
+};
+
+interface Upstream {
+	repo: string;
+	url: string;
+	module?: string;
+}
+
+const getUpstreams = async () => {
+	const fs = await import('fs');
+	const repoYaml = fs.readFileSync(__dirname + '/../repo.yml', 'utf8');
+
+	const yaml = await import('js-yaml');
+	const { upstream } = yaml.safeLoad(repoYaml) as {
+		upstream: Upstream[];
+	};
+
+	return upstream;
+};
+
+const printUsage = (upstreams: Upstream[], upstreamName: string) => {
+	console.error(
+		`
+Usage: npm run update ${upstreamName} $version [$changeType=minor]
+
+Upstream names: ${upstreams.map(({ repo }) => repo).join(', ')}
+`,
+	);
+	return process.exit(1);
+};
+
+// TODO: Drop the wrapper function once we move to TS 3.8,
+// which will support top level await.
+async function main() {
+	const upstreams = await getUpstreams();
+
+	if (process.argv.length < 3) {
+		return printUsage(upstreams, '$upstreamName');
+	}
+
+	const upstreamName = process.argv[2];
+
+	const upstream = upstreams.find((v) => v.repo === upstreamName);
+
+	if (!upstream) {
+		console.error(
+			`Invalid upstream name '${upstreamName}', valid options: ${upstreams
+				.map(({ repo }) => repo)
+				.join(', ')}`,
+		);
+		return process.exit(1);
+	}
+
+	if (process.argv.length < 4) {
+		printUsage(upstreams, upstreamName);
+	}
+
+	const packageName = upstream.module || upstream.repo;
+
+	const oldVersion = await getVersion(packageName);
+	await run(`npm install ${packageName}@${process.argv[3]}`);
+	const newVersion = await getVersion(packageName);
+	if (newVersion === oldVersion) {
+		console.error(`Already on version '${newVersion}'`);
+		return process.exit(1);
+	}
+
+	console.log(`Updated ${upstreamName} from ${oldVersion} to ${newVersion}`);
+	const semverChangeType = compareSemverChangeType(oldVersion, newVersion);
+
+	const changeType = process.argv[4]
+		? // if the caller specified a change type, use that one
+		  validateChangeType(process.argv[4])
+		: // use the same change type as in the dependency, but avoid major bumps
+		semverChangeType && semverChangeType !== 'major'
+		? semverChangeType
+		: 'minor';
+	console.log(`Using Change-type: ${changeType}`);
+
+	let { stdout: currentBranch } = await run('git rev-parse --abbrev-ref HEAD');
+	currentBranch = currentBranch.trim();
+	console.log(`Currenty on branch: '${currentBranch}'`);
+	if (currentBranch === 'master') {
+		await run(`git checkout -b "update-${upstreamName}-${newVersion}"`);
+	}
+
+	await run(`git add package.json npm-shrinkwrap.json`);
+	await run(
+		`git commit --message "Update ${upstreamName} to ${newVersion}" --message "Update ${upstreamName} from ${oldVersion} to ${newVersion}" --message "Change-type: ${changeType}"`,
+	);
+}
+
+main();

automation/utils.ts

@@ -0,0 +1,237 @@
+/**
+ * @license
+ * Copyright 2019-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { spawn } from 'child_process';
+import * as _ from 'lodash';
+import * as path from 'path';
+import * as shellEscape from 'shell-escape';
+
+export const MSYS2_BASH = 'C:\\msys64\\usr\\bin\\bash.exe';
+export const ROOT = path.join(__dirname, '..');
+
+/** Tap and buffer this process' stdout and stderr */
+export class StdOutTap {
+	public stdoutBuf: string[] = [];
+	public stderrBuf: string[] = [];
+	public allBuf: string[] = []; // both stdout and stderr
+
+	protected origStdoutWrite: typeof process.stdout.write;
+	protected origStderrWrite: typeof process.stdout.write;
+
+	constructor(protected printDots = false) {}
+
+	tap() {
+		this.origStdoutWrite = process.stdout.write;
+		this.origStderrWrite = process.stderr.write;
+
+		process.stdout.write = (chunk: string, ...args: any[]): boolean => {
+			this.stdoutBuf.push(chunk);
+			this.allBuf.push(chunk);
+			const str = this.printDots ? '.' : chunk;
+			return this.origStdoutWrite.call(process.stdout, str, ...args);
+		};
+
+		process.stderr.write = (chunk: string, ...args: any[]): boolean => {
+			this.stderrBuf.push(chunk);
+			this.allBuf.push(chunk);
+			const str = this.printDots ? '.' : chunk;
+			return this.origStderrWrite.call(process.stderr, str, ...args);
+		};
+	}
+
+	untap() {
+		process.stdout.write = this.origStdoutWrite;
+		process.stderr.write = this.origStderrWrite;
+		if (this.printDots) {
+			console.error('');
+		}
+	}
+}
+
+/**
+ * Diff strings by line, using the 'diff' npm package:
+ * https://www.npmjs.com/package/diff
+ */
+export function diffLines(str1: string, str2: string): string {
+	const { diffTrimmedLines } = require('diff');
+	const diffObjs = diffTrimmedLines(str1, str2);
+	const prefix = (chunk: string, char: string) =>
+		chunk
+			.split('\n')
+			.map((line: string) => `${char} ${line}`)
+			.join('\n');
+	const diffStr = diffObjs
+		.map((part: any) => {
+			return part.added
+				? prefix(part.value, '+')
+				: part.removed
+				? prefix(part.value, '-')
+				: prefix(part.value, ' ');
+		})
+		.join('\n');
+	return diffStr;
+}
+
+export function loadPackageJson() {
+	return require(path.join(ROOT, 'package.json'));
+}
+
+/**
+ * Convert e.g. 'C:\myfolder' -> '/C/myfolder' so that the path can be given
+ * as argument to "unix tools" like 'tar' under MSYS or MSYS2 on Windows.
+ */
+export function fixPathForMsys(p: string): string {
+	return p.replace(/\\/g, '/').replace(/^([a-zA-Z]):/, '/$1');
+}
+
+/**
+ * Run the MSYS2 bash.exe shell in a child process (child_process.spawn()).
+ * The given argv arguments are escaped using the 'shell-escape' package,
+ * so that backslashes in Windows paths, and other bash-special characters,
+ * are preserved. If argv is not provided, defaults to process.argv, to the
+ * effect that this current (parent) process is re-executed under MSYS2 bash.
+ * This is useful to change the default shell from cmd.exe to MSYS2 bash on
+ * Windows.
+ * @param argv Arguments to be shell-escaped and given to MSYS2 bash.exe.
+ */
+export async function runUnderMsys(argv?: string[]) {
+	const newArgv = argv || process.argv;
+	await new Promise((resolve, reject) => {
+		const args = ['-lc', shellEscape(newArgv)];
+		const child = spawn(MSYS2_BASH, args, { stdio: 'inherit' });
+		child.on('close', (code) => {
+			if (code) {
+				console.log(`runUnderMsys: child process exited with code ${code}`);
+				reject(code);
+			} else {
+				resolve();
+			}
+		});
+	});
+}
+
+/**
+ * Run the executable at execPath as a child process, and resolve a promise
+ * to the executable's stdout output as a string. Reject the promise if
+ * anything is printed to stderr, or if the child process exits with a
+ * non-zero exit code.
+ * @param execPath Executable path
+ * @param args Command-line argument for the executable
+ */
+export async function getSubprocessStdout(
+	execPath: string,
+	args: string[],
+): Promise<string> {
+	const child = spawn(execPath, args);
+	return new Promise((resolve, reject) => {
+		let stdout = '';
+		child.stdout.on('error', reject);
+		child.stderr.on('error', reject);
+		child.stdout.on('data', (data: Buffer) => {
+			try {
+				stdout = data.toString();
+			} catch (err) {
+				reject(err);
+			}
+		});
+		child.stderr.on('data', (data: Buffer) => {
+			try {
+				const stderr = data.toString();
+
+				// ignore any debug lines, but ensure that we parse
+				// every line provided to the stderr stream
+				const lines = _.filter(
+					stderr.trim().split(/\r?\n/),
+					(line) => !line.startsWith('[debug]'),
+				);
+				if (lines.length > 0) {
+					reject(
+						new Error(`"${execPath}": non-empty stderr "${lines.join('\n')}"`),
+					);
+				}
+			} catch (err) {
+				reject(err);
+			}
+		});
+		child.on('exit', (code: number) => {
+			if (code) {
+				reject(new Error(`"${execPath}": non-zero exit code "${code}"`));
+			} else {
+				resolve(stdout);
+			}
+		});
+	});
+}
+
+/**
+ * Error handling wrapper around the npm `which` package:
+ * "Like the unix which utility. Finds the first instance of a specified
+ * executable in the PATH environment variable. Does not cache the results,
+ * so hash -r is not needed when the PATH changes."
+ *
+ * @param program Basename of a program, for example 'ssh'
+ * @returns The program's full path, e.g. 'C:\WINDOWS\System32\OpenSSH\ssh.EXE'
+ */
+export async function which(program: string): Promise<string> {
+	const whichMod = await import('which');
+	let programPath: string;
+	try {
+		programPath = await whichMod(program);
+	} catch (err) {
+		if (err.code === 'ENOENT') {
+			throw new Error(`'${program}' program not found. Is it installed?`);
+		}
+		throw err;
+	}
+	return programPath;
+}
+
+/**
+ * Call which(programName) and spawn() with the given arguments. Throw an error
+ * if the process exit code is not zero.
+ */
+export async function whichSpawn(
+	programName: string,
+	args?: string[],
+): Promise<void> {
+	const program = await which(programName);
+	let error: Error | undefined;
+	let exitCode: number | undefined;
+	try {
+		exitCode = await new Promise<number>((resolve, reject) => {
+			try {
+				spawn(program, args, { stdio: 'inherit' })
+					.on('error', reject)
+					.on('close', resolve);
+			} catch (err) {
+				reject(err);
+			}
+		});
+	} catch (err) {
+		error = err;
+	}
+	if (error || exitCode) {
+		const msg = [
+			`${programName} failed with exit code ${exitCode}:`,
+			`"${program}" [${args}]`,
+		];
+		if (error) {
+			msg.push(`${error}`);
+		}
+		throw new Error(msg.join('\n'));
+	}
+}

balena-completion.bash

@@ -0,0 +1,73 @@
+#!/bin/bash
+
+_balena_complete()
+{
+  local cur prev
+
+  # Valid top-level completions
+  commands="app apps build config deploy device devices env envs help key \
+            keys local login logout logs note os preload quickstart settings \
+            scan ssh util version whoami"
+  # Sub-completions
+  app_cmds="create restart rm"
+  config_cmds="generate inject read reconfigure write"
+  device_cmds="identify init move public-url reboot register rename rm \
+               shutdown"
+  device_public_url_cmds="disable enable status"
+  env_cmds="add rename rm"
+  key_cmds="add rm"
+  local_cmds="configure flash"
+  os_cmds="build-config configure download initialize versions"
+  util_cmds="available-drives"
+
+
+  COMPREPLY=()
+  cur=${COMP_WORDS[COMP_CWORD]}
+  prev=${COMP_WORDS[COMP_CWORD-1]}
+
+  if [ $COMP_CWORD -eq 1 ]
+  then
+    COMPREPLY=( $(compgen -W "${commands}" -- $cur) )
+  elif [ $COMP_CWORD -eq 2 ]
+  then
+    case "$prev" in
+      "app")
+        COMPREPLY=( $(compgen -W "$app_cmds" -- $cur) )
+        ;;
+      "config")
+        COMPREPLY=( $(compgen -W "$config_cmds" -- $cur) )
+        ;;
+      "device")
+        COMPREPLY=( $(compgen -W "$device_cmds" -- $cur) )
+        ;;
+      "env")
+        COMPREPLY=( $(compgen -W "$env_cmds" -- $cur) )
+        ;;
+      "key")
+        COMPREPLY=( $(compgen -W "$key_cmds" -- $cur) )
+        ;;
+      "local")
+        COMPREPLY=( $(compgen -W "$local_cmds" -- $cur) )
+        ;;
+      "os")
+        COMPREPLY=( $(compgen -W "$os_cmds" -- $cur) )
+        ;;
+      "util")
+        COMPREPLY=( $(compgen -W "$util_cmds" -- $cur) )
+        ;;
+      "*")
+        ;;
+    esac
+  elif [ $COMP_CWORD -eq 3 ]
+  then
+    case "$prev" in
+      "public-url")
+        COMPREPLY=( $(compgen -W "$device_public_url_cmds" -- $cur) )
+        ;;
+      "*")
+        ;;
+    esac
+  fi
+
+}
+complete -F _balena_complete balena

bin/balena

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+
+// We boost the threadpool size as ext2fs can deadlock with some
+// operations otherwise, if the pool runs out.
+process.env.UV_THREADPOOL_SIZE = '64';
+
+// Disable oclif registering ts-node
+process.env.OCLIF_TS_NODE = 0;
+
+// Use fast-boot to cache require lookups, speeding up startup
+require('fast-boot2').start({
+	cacheScope: __dirname + '/..',
+	cacheFile: __dirname + '/.fast-boot.json'
+});
+
+// Set the desired es version for downstream modules that support it
+require('@balena/es-version').set('es2018');
+
+// Run the CLI
+require('../build/app').run();

bin/balena-dev

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+
+// ****************************************************************************
+// THIS IS FOR DEV PERROSES ONLY AND WILL NOT BE PART OF THE PUBLISHED PACKAGE
+// Before opening a PR you should build and test your changes using bin/balena
+// ****************************************************************************
+
+// We boost the threadpool size as ext2fs can deadlock with some
+// operations otherwise, if the pool runs out.
+process.env.UV_THREADPOOL_SIZE = '64';
+
+// Use fast-boot to cache require lookups, speeding up startup
+require('fast-boot2').start({
+	cacheScope: __dirname + '/..',
+	cacheFile: '.fast-boot.json',
+});
+
+// Set the desired es version for downstream modules that support it
+require('@balena/es-version').set('es2018');
+
+const path = require('path');
+const rootDir = path.join(__dirname, '..');
+// Note: before ts-node v6.0.0, 'transpile-only' (no type checking) was the
+// default option. We upgraded ts-node and found that adding 'transpile-only'
+// was necessary to avoid a mysterious 'null' error message. On the plus side,
+// it is supposed to run faster. We still benefit from type checking when
+// running 'npm run build'.
+require('ts-node').register({
+	project: path.join(rootDir, 'tsconfig.json'),
+	transpileOnly: true,
+});
+require('../lib/app').run();

bin/resin

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-require('../build/app');

capitanodoc.coffee

@@ -1,115 +0,0 @@
-# coffeelint: disable=max_line_length
-
-module.exports =
-	title: 'Resin CLI Documentation'
-	introduction: '''
-		This tool allows you to interact with the resin.io api from the comfort of your command line.
-
-		Please make sure your system meets the requirements as specified in the [README](https://github.com/resin-io/resin-cli).
-
-		To get started download the CLI from npm.
-
-			$ npm install resin-cli -g
-
-		Then authenticate yourself:
-
-			$ resin login
-
-		Now you have access to all the commands referenced below.
-
-		## Proxy support
-
-		The CLI does support HTTP(S) proxies.
-
-		You can configure the proxy using several methods (in order of their precedence):
-
-		* set the `RESINRC_PROXY` environment variable in the URL format (with protocol, host, port, and optionally the basic auth),
-		* use the [resin config file](https://www.npmjs.com/package/resin-settings-client#documentation) (project-specific or user-level)
-		and set the `proxy` setting. This can be:
-			* a string in the URL format,
-			* or an object following [this format](https://www.npmjs.com/package/global-tunnel-ng#options), which allows more control,
-		* or set the conventional `https_proxy` / `HTTPS_PROXY` / `http_proxy` / `HTTP_PROXY`
-		environment variable (in the same standard URL format).
-	'''
-
-	categories: [
-		{
-			title: 'Application'
-			files: [ 'lib/actions/app.coffee' ]
-		},
-		{
-			title: 'Authentication',
-			files: [ 'lib/actions/auth.coffee' ]
-		},
-		{
-			title: 'Device',
-			files: [ 'lib/actions/device.coffee' ]
-		},
-		{
-			title: 'Environment Variables',
-			files: [ 'lib/actions/environment-variables.coffee' ]
-		},
-		{
-			title: 'Help',
-			files: [ 'lib/actions/help.coffee' ]
-		},
-		{
-			title: 'Information',
-			files: [ 'lib/actions/info.coffee' ]
-		},
-		{
-			title: 'Keys',
-			files: [ 'lib/actions/keys.coffee' ]
-		},
-		{
-			title: 'Logs',
-			files: [ 'lib/actions/logs.coffee' ]
-		},
-		{
-			title: 'Sync',
-			files: [ 'lib/actions/sync.coffee' ]
-		},
-		{
-			title: 'SSH',
-			files: [ 'lib/actions/ssh.coffee' ]
-		},
-		{
-			title: 'Notes',
-			files: [ 'lib/actions/notes.coffee' ]
-		},
-		{
-			title: 'OS',
-			files: [ 'lib/actions/os.coffee' ]
-		},
-		{
-			title: 'Config',
-			files: [ 'lib/actions/config.coffee' ]
-		},
-		{
-			title: 'Preload',
-			files: [ 'lib/actions/preload.coffee' ]
-		},
-		{
-			title: 'Settings',
-			files: [ 'lib/actions/settings.coffee' ]
-		},
-		{
-			title: 'Wizard',
-			files: [ 'lib/actions/wizard.coffee' ]
-		},
-		{
-			title: 'Local',
-			files: [ 'lib/actions/local/index.coffee' ]
-		},
-		{
-			title: 'Deploy',
-			files: [
-				'lib/actions/build.coffee'
-				'lib/actions/deploy.coffee'
-			]
-		},
-		{
-			title: 'Utilities',
-			files: [ 'lib/actions/util.coffee' ]
-		},
-	]

coffeelint.json

@@ -1,127 +0,0 @@
-{
-    "coffeescript_error": {
-        "level": "error"
-    },
-    "arrow_spacing": {
-        "name": "arrow_spacing",
-        "level": "error"
-    },
-    "no_tabs": {
-        "name": "no_tabs",
-        "level": "ignore"
-    },
-    "no_trailing_whitespace": {
-        "name": "no_trailing_whitespace",
-        "level": "error",
-        "allowed_in_comments": false,
-        "allowed_in_empty_lines": false
-    },
-    "max_line_length": {
-        "name": "max_line_length",
-        "value": 120,
-        "level": "error",
-        "limitComments": true
-    },
-    "line_endings": {
-        "name": "line_endings",
-        "level": "ignore",
-        "value": "unix"
-    },
-    "no_trailing_semicolons": {
-        "name": "no_trailing_semicolons",
-        "level": "error"
-    },
-    "indentation": {
-        "name": "indentation",
-        "value": 1,
-        "level": "error"
-    },
-    "camel_case_classes": {
-        "name": "camel_case_classes",
-        "level": "error"
-    },
-    "colon_assignment_spacing": {
-        "name": "colon_assignment_spacing",
-        "level": "error",
-        "spacing": {
-            "left": 0,
-            "right": 1
-        }
-    },
-    "no_implicit_braces": {
-        "name": "no_implicit_braces",
-        "level": "ignore",
-        "strict": false
-    },
-    "no_plusplus": {
-        "name": "no_plusplus",
-        "level": "ignore"
-    },
-    "no_throwing_strings": {
-        "name": "no_throwing_strings",
-        "level": "error"
-    },
-    "no_backticks": {
-        "name": "no_backticks",
-        "level": "error"
-    },
-    "no_implicit_parens": {
-        "name": "no_implicit_parens",
-        "strict": false,
-        "level": "ignore"
-    },
-    "no_empty_param_list": {
-        "name": "no_empty_param_list",
-        "level": "error"
-    },
-    "no_stand_alone_at": {
-        "name": "no_stand_alone_at",
-        "level": "ignore"
-    },
-    "space_operators": {
-        "name": "space_operators",
-        "level": "error"
-    },
-    "duplicate_key": {
-        "name": "duplicate_key",
-        "level": "error"
-    },
-    "empty_constructor_needs_parens": {
-        "name": "empty_constructor_needs_parens",
-        "level": "ignore"
-    },
-    "cyclomatic_complexity": {
-        "name": "cyclomatic_complexity",
-        "value": 10,
-        "level": "ignore"
-    },
-    "newlines_after_classes": {
-        "name": "newlines_after_classes",
-        "value": 3,
-        "level": "ignore"
-    },
-    "no_unnecessary_fat_arrows": {
-        "name": "no_unnecessary_fat_arrows",
-        "level": "error"
-    },
-    "missing_fat_arrows": {
-        "name": "missing_fat_arrows",
-        "level": "ignore"
-    },
-    "non_empty_constructor_needs_parens": {
-        "name": "non_empty_constructor_needs_parens",
-        "level": "ignore"
-    },
-    "no_unnecessary_double_quotes": {
-        "name": "no_unnecessary_double_quotes",
-        "level": "error"
-    },
-    "no_debugger": {
-        "name": "no_debugger",
-        "level": "warn"
-    },
-    "no_interpolation_in_single_quotes": {
-        "name": "no_interpolation_in_single_quotes",
-        "level": "error"
-    }
-}

doc/automated-init.md

@@ -1,4 +1,4 @@
-# Provisioning Resin.io devices in automated (non-interactive) mode
+# Provisioning balena devices in automated (non-interactive) mode
 
 This document describes how to run the `device init` command in non-interactive mode.
 
@@ -7,7 +7,7 @@ It requires collecting some preliminary information _once_.
 The final command to provision the device looks like this:
 
 ```bash
-resin device init --app APP_ID --os-version OS_VERSION --drive DRIVE --config CONFIG_FILE --yes
+balena device init --app APP_ID --os-version OS_VERSION --drive DRIVE --config CONFIG_FILE --yes
 
 ```
 
@@ -20,15 +20,15 @@ But before you can run it you need to collect the parameters and build the confi
 
 1. `DEVICE_TYPE`. Run
 	```bash
-	resin devices supported
+	balena devices supported
 	```
 	and find the _slug_ for your target device type, like _raspberrypi3_.
 
-1. `APP_ID`. Create an application (`resin app create APP_NAME --type DEVICE_TYPE`) or find an existing one (`resin apps`) and notice its ID.
+1. `APP_ID`. Create an application (`balena app create APP_NAME --type DEVICE_TYPE`) or find an existing one (`balena apps`) and notice its ID.
 
 1. `OS_VERSION`. Run
 	```bash
-	resin os versions DEVICE_TYPE
+	balena os versions DEVICE_TYPE
 	```
 	and pick the version that you need, like _v2.0.6+rev1.prod_.
 	_Note_ that even though we support _semver ranges_ it's recommended to use the exact version when doing the automated provisioning as it
@@ -36,10 +36,10 @@ But before you can run it you need to collect the parameters and build the confi
 
 1. `DRIVE`. Plug in your target medium (SD card or the USB stick, depending on your device type) and run
 	```bash
-	resin util available-drives
+	balena util available-drives
 	```
 	and get the drive name, like _/dev/sdb_ or _/dev/mmcblk0_.
-	The resin CLI will not display the system drives to protect you,
+	The balena CLI will not display the system drives to protect you,
 	but still please check very carefully that you've picked the correct drive as it will be erased during the provisioning process.
 
 Now we have all the parameters -- time to build the config file.
@@ -50,21 +50,21 @@ Interactive device provisioning process often includes collecting some extra dev
 
 To skip this interactive step we need to buid this configuration once and save it to the JSON file for later reuse.
 
-Let's say we will place it into the `CONFIG_FILE` path, like _./resin-os/raspberrypi3-config.json_.
+Let's say we will place it into the `CONFIG_FILE` path, like _./balena-os/raspberrypi3-config.json_.
 
-We also need to put the OS image somewhere, let's call this path `OS_IMAGE_PATH`, it can be something like _./resin-os/raspberrypi3-v2.0.6+rev1.prod.img_.
+We also need to put the OS image somewhere, let's call this path `OS_IMAGE_PATH`, it can be something like _./balena-os/raspberrypi3-v2.0.6+rev1.prod.img_.
 
 1. First we need to download the OS image once. That's needed for building the config, and will speedup the subsequent operations as the downloaded OS image is placed into the local cache.
 
 	Run:
 	```bash
-	resin os download DEVICE_TYPE --output OS_IMAGE_PATH --version OS_VERSION
+	balena os download DEVICE_TYPE --output OS_IMAGE_PATH --version OS_VERSION
 	```
 
 1. Now we're ready to build the config:
 
 	```bash
-	resin os build-config OS_IMAGE_PATH DEVICE_TYPE --output CONFIG_FILE
+	balena os build-config OS_IMAGE_PATH DEVICE_TYPE --output CONFIG_FILE
 	```
 
 	This will run you through the interactive configuration wizard and in the end save the generated config as `CONFIG_FILE`. You can then verify it's not empty:
@@ -97,11 +97,11 @@ There are several ways to eliminate it and make the process fully non-interactiv
 
 Obviously you shouldn't do that if the machine you're working on has access to any sensitive resources or information.
 
-But if you're using a machine dedicated to resin provisioning this can be fine, and also the simplest thing to do.
+But if you're using a machine dedicated to balena provisioning this can be fine, and also the simplest thing to do.
 
 #### Option 2: `NOPASSWD` directive
 
-You can configure the `resin` CLI command to be sudo-runnable without the password. Check [this post](https://askubuntu.com/questions/159007/how-do-i-run-specific-sudo-commands-without-a-password) for an example.
+You can configure the `balena` CLI command to be sudo-runnable without the password. Check [this post](https://askubuntu.com/questions/159007/how-do-i-run-specific-sudo-commands-without-a-password) for an example.
 
 ### Extra initialization config
 
@@ -109,4 +109,4 @@ As of June 2017 all the supported devices should not require any other interacti
 
 But by the design of our system it is _possible_ (though it doesn't look very likely it's going to happen any time soon) that some extra initialization options may be requested for the specific device types.
 
-If that is the case please raise the issue in the resin CLI repository and the maintainers will add the necessary options to build the similar JSON config for this step.
+If that is the case please raise the issue in the balena CLI repository and the maintainers will add the necessary options to build the similar JSON config for this step.

extras/capitanodoc/index.coffee

@@ -1,46 +0,0 @@
-_ = require('lodash')
-path = require('path')
-capitanodoc = require('../../capitanodoc')
-markdown = require('./markdown')
-
-result = {}
-result.title = capitanodoc.title
-result.introduction = capitanodoc.introduction
-result.categories = []
-
-for commandCategory in capitanodoc.categories
-	category = {}
-	category.title = commandCategory.title
-	category.commands = []
-
-	for file in commandCategory.files
-		actions = require(path.join(process.cwd(), file))
-
-		if actions.signature?
-			category.commands.push(_.omit(actions, 'action'))
-		else
-			for actionName, actionCommand of actions
-				category.commands.push(_.omit(actionCommand, 'action'))
-
-	result.categories.push(category)
-
-result.toc = _.cloneDeep(result.categories)
-result.toc = _.map result.toc, (category) ->
-	category.commands = _.map category.commands, (command) ->
-		return {
-			signature: command.signature
-			anchor: '#' + command.signature
-								.replace(/\s/g,'-')
-								.replace(/</g, '60-')
-								.replace(/>/g, '-62-')
-								.replace(/\[/g, '')
-								.replace(/\]/g, '-')
-								.replace(/--/g, '-')
-								.replace(/\.\.\./g, '')
-								.replace(/\|/g, '')
-								.toLowerCase()
-		}
-
-	return category
-
-console.log(markdown.display(result))

extras/capitanodoc/markdown.coffee

@@ -1,66 +0,0 @@
-_ = require('lodash')
-ent = require('ent')
-utils = require('./utils')
-
-exports.command = (command) ->
-	result = """
-		## #{ent.encode(command.signature)}
-
-		#{command.help}\n
-	"""
-
-	if not _.isEmpty(command.options)
-		result += '\n### Options'
-
-		for option in command.options
-			result += """
-				\n\n#### #{utils.parseSignature(option)}
-
-				#{option.description}
-			"""
-
-		result += '\n'
-
-	return result
-
-exports.category = (category) ->
-	result = """
-		# #{category.title}\n
-	"""
-
-	for command in category.commands
-		result += '\n' + exports.command(command)
-
-	return result
-
-exports.toc = (toc) ->
-	result = '''
-		# Table of contents\n
-	'''
-
-	for category in toc
-
-		result += """
-			\n- #{category.title}\n\n
-		"""
-
-		for command in category.commands
-			result += """
-				\t- [#{ent.encode(command.signature)}](#{command.anchor})\n
-			"""
-
-	return result
-
-exports.display = (doc) ->
-	result = """
-		# #{doc.title}
-
-		#{doc.introduction}
-
-		#{exports.toc(doc.toc)}
-	"""
-
-	for category in doc.categories
-		result += '\n' + exports.category(category)
-
-	return result

extras/capitanodoc/utils.coffee

@@ -1,26 +0,0 @@
-_ = require('lodash')
-ent = require('ent')
-
-exports.getOptionPrefix = (signature) ->
-	if signature.length > 1
-		return '--'
-	else
-		return '-'
-
-exports.getOptionSignature = (signature) ->
-	return "#{exports.getOptionPrefix(signature)}#{signature}"
-
-exports.parseSignature = (option) ->
-	result = exports.getOptionSignature(option.signature)
-
-	if not _.isEmpty(option.alias)
-		if _.isString(option.alias)
-			result += ", #{exports.getOptionSignature(option.alias)}"
-		else
-			for alias in option.alias
-				result += ", #{exports.getOptionSignature(option.alias)}"
-
-	if option.parameter?
-		result += " <#{option.parameter}>"
-
-	return ent.encode(result)

gulpfile.coffee

@@ -1,50 +0,0 @@
-path = require('path')
-gulp = require('gulp')
-coffee = require('gulp-coffee')
-coffeelint = require('gulp-coffeelint')
-inlinesource = require('gulp-inline-source')
-mocha = require('gulp-mocha')
-shell = require('gulp-shell')
-packageJSON = require('./package.json')
-
-OPTIONS =
-	config:
-		coffeelint: path.join(__dirname, 'coffeelint.json')
-	files:
-		coffee: [ 'lib/**/*.coffee', 'gulpfile.coffee' ]
-		app: 'lib/**/*.coffee'
-		tests: 'tests/**/*.spec.coffee'
-		pages: 'lib/auth/pages/*.ejs'
-	directories:
-		build: 'build/'
-
-gulp.task 'pages', ->
-	gulp.src(OPTIONS.files.pages)
-		.pipe(inlinesource())
-		.pipe(gulp.dest('build/auth/pages'))
-
-gulp.task 'coffee', [ 'lint' ], ->
-	gulp.src(OPTIONS.files.app)
-		.pipe(coffee(bare: true, header: true))
-		.pipe(gulp.dest(OPTIONS.directories.build))
-
-gulp.task 'lint', ->
-	gulp.src(OPTIONS.files.coffee)
-		.pipe(coffeelint({
-			optFile: OPTIONS.config.coffeelint
-		}))
-		.pipe(coffeelint.reporter())
-
-gulp.task 'test', ->
-	gulp.src(OPTIONS.files.tests, read: false)
-		.pipe(mocha({
-			reporter: 'min'
-		}))
-
-gulp.task 'build', [
-	'coffee',
-	'pages'
-]
-
-gulp.task 'watch', [ 'build' ], ->
-	gulp.watch([ OPTIONS.files.coffee ], [ 'build' ])

gulpfile.js

@@ -0,0 +1,15 @@
+const gulp = require('gulp');
+const inlinesource = require('gulp-inline-source');
+
+const OPTIONS = {
+	files: {
+		pages: 'lib/auth/pages/*.ejs',
+	},
+};
+
+gulp.task('pages', () =>
+	gulp
+		.src(OPTIONS.files.pages)
+		.pipe(inlinesource())
+		.pipe(gulp.dest('build/auth/pages')),
+);

lib/actions-oclif/api-key/generate.ts

@@ -0,0 +1,85 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class GenerateCmd extends Command {
+	public static description = stripIndent`
+		Generate a new balenaCloud API key.
+
+		Generate a new balenaCloud API key for the current user, with the given
+		name. The key will be logged to the console.
+
+		This key can be used to log into the CLI using 'balena login --token <key>',
+		or to authenticate requests to the API with an 'Authorization: Bearer <key>' header.
+`;
+	public static examples = ['$ balena api-key generate "Jenkins Key"'];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'the API key name',
+			required: true,
+		},
+	];
+
+	public static usage = 'api-key generate <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(GenerateCmd);
+
+		let key;
+		try {
+			key = await getBalenaSdk().models.apiKey.create(params.name);
+		} catch (e) {
+			if (e.name === 'BalenaNotLoggedIn') {
+				throw new ExpectedError(stripIndent`
+					This command cannot be run when logged in with an API key.
+					Please login again with 'balena login' and select an alternative method.
+				`);
+			} else {
+				throw e;
+			}
+		}
+
+		console.log(stripIndent`
+			Registered api key '${params.name}':
+
+			${key}
+
+			This key will not be shown again, so please save it now.
+		`);
+	}
+}

lib/actions-oclif/app/create.ts

@@ -0,0 +1,104 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import type * as BalenaSDK from 'balena-sdk';
+
+interface FlagsDef {
+	type?: string; // application device type
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class AppCreateCmd extends Command {
+	public static description = stripIndent`
+		Create an application.
+
+		Create a new balena application.
+
+		You can specify the application device type with the \`--type\` option.
+		Otherwise, an interactive dropdown will be shown for you to select from.
+
+		You can see a list of supported device types with:
+
+		$ balena devices supported
+`;
+	public static examples = [
+		'$ balena app create MyApp',
+		'$ balena app create MyApp --type raspberry-pi',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'application name',
+			required: true,
+		},
+	];
+
+	public static usage = 'app create <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		type: flags.string({
+			char: 't',
+			description:
+				'application device type (Check available types with `balena devices supported`)',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			AppCreateCmd,
+		);
+
+		const balena = getBalenaSdk();
+
+		// Create application
+		const deviceType =
+			options.type ||
+			(await (await import('../../utils/patterns')).selectDeviceType());
+		let application: BalenaSDK.Application;
+		try {
+			application = await balena.models.application.create({
+				name: params.name,
+				deviceType,
+				organization: (await balena.auth.whoami())!,
+			});
+		} catch (err) {
+			// BalenaRequestError: Request error: Unique key constraint violated
+			if ((err.message || '').toLowerCase().includes('unique')) {
+				throw new ExpectedError(
+					`Error: application "${params.name}" already exists`,
+				);
+			}
+			throw err;
+		}
+		console.info(
+			`Application created: ${application.slug} (${deviceType}, id ${application.id})`,
+		);
+	}
+}

lib/actions-oclif/app/index.ts

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+import { Release } from 'balena-sdk';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class AppCmd extends Command {
+	public static description = stripIndent`
+		Display information about a single application.
+
+		Display detailed information about a single balena application.
+`;
+	public static examples = ['$ balena app MyApp'];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'application name or numeric ID',
+			required: true,
+		},
+	];
+
+	public static usage = 'app <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+	public static primary = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(AppCmd);
+
+		const application = (await getBalenaSdk().models.application.get(
+			tryAsInteger(params.name),
+			{
+				$expand: {
+					is_for__device_type: { $select: 'slug' },
+					should_be_running__release: { $select: 'commit' },
+				},
+			},
+		)) as ApplicationWithDeviceType & {
+			should_be_running__release: [Release?];
+		};
+
+		// @ts-expect-error
+		application.device_type = application.is_for__device_type[0].slug;
+		// @ts-expect-error
+		application.commit = application.should_be_running__release[0]?.commit;
+		console.log(
+			getVisuals().table.vertical(application, [
+				`$${application.app_name}$`,
+				'id',
+				'device_type',
+				'slug',
+				'commit',
+			]),
+		);
+	}
+}

lib/actions-oclif/app/restart.ts

@@ -0,0 +1,61 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class AppRestartCmd extends Command {
+	public static description = stripIndent`
+		Restart an application.
+
+		Restart all devices that belongs to a certain application.
+`;
+	public static examples = ['$ balena app restart MyApp'];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'application name or numeric ID',
+			required: true,
+		},
+	];
+
+	public static usage = 'app restart <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(AppRestartCmd);
+
+		await getBalenaSdk().models.application.restart(tryAsInteger(params.name));
+	}
+}

lib/actions-oclif/app/rm.ts

@@ -0,0 +1,79 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	yes: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+}
+
+export default class AppRmCmd extends Command {
+	public static description = stripIndent`
+		Remove an application.
+
+		Permanently remove a balena application.
+
+		The --yes option may be used to avoid interactive confirmation.
+`;
+	public static examples = [
+		'$ balena app rm MyApp',
+		'$ balena app rm MyApp --yes',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'application name or numeric ID',
+			required: true,
+		},
+	];
+
+	public static usage = 'app rm <name>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		yes: cf.yes,
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			AppRmCmd,
+		);
+
+		const patterns = await import('../../utils/patterns');
+
+		// Confirm
+		await patterns.confirm(
+			options.yes ?? false,
+			`Are you sure you want to delete application ${params.name}?`,
+		);
+
+		// Remove
+		await getBalenaSdk().models.application.remove(tryAsInteger(params.name));
+	}
+}

lib/actions-oclif/apps.ts

@@ -0,0 +1,97 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, getVisuals, stripIndent } from '../utils/lazy';
+import { isV12 } from '../utils/version';
+
+interface ExtendedApplication extends ApplicationWithDeviceType {
+	device_count?: number;
+	online_devices?: number;
+}
+
+interface FlagsDef {
+	help: void;
+	verbose?: boolean;
+}
+
+export default class AppsCmd extends Command {
+	public static description = stripIndent`
+		List all applications.
+
+		list all your balena applications.
+
+		For detailed information on a particular application,
+		use \`balena app <name> instead\`.
+`;
+	public static examples = ['$ balena apps'];
+
+	public static usage = 'apps';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+		verbose: flags.boolean({
+			char: 'v',
+			description: isV12()
+				? 'No-op since release v12.0.0'
+				: 'add extra columns in the tabular output (SLUG)',
+		}),
+	};
+
+	public static authenticated = true;
+	public static primary = true;
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(AppsCmd);
+
+		const balena = getBalenaSdk();
+
+		// Get applications
+		const applications = (await balena.models.application.getAll({
+			$select: ['id', 'app_name', 'slug'],
+			$expand: {
+				is_for__device_type: { $select: 'slug' },
+				owns__device: { $select: 'is_online' },
+			},
+		})) as ExtendedApplication[];
+
+		const _ = await import('lodash');
+		// Add extended properties
+		applications.forEach((application) => {
+			application.device_count = application.owns__device?.length ?? 0;
+			application.online_devices = _.sumBy(application.owns__device, (d) =>
+				d.is_online === true ? 1 : 0,
+			);
+			// @ts-expect-error
+			application.device_type = application.is_for__device_type[0].slug;
+		});
+
+		// Display
+		console.log(
+			getVisuals().table.horizontal(applications, [
+				'id',
+				'app_name',
+				options.verbose || isV12() ? 'slug' : '',
+				'device_type',
+				'online_devices',
+				'device_count',
+			]),
+		);
+	}
+}

lib/actions-oclif/build.ts

@@ -0,0 +1,269 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk } from '../utils/lazy';
+import * as compose from '../utils/compose';
+import type { Application, ApplicationType, BalenaSDK } from 'balena-sdk';
+import { dockerignoreHelp, registrySecretsHelp } from '../utils/messages';
+import type { ComposeCliFlags, ComposeOpts } from '../utils/compose-types';
+import { composeCliFlags } from '../utils/compose_ts';
+import type { DockerCliFlags } from '../utils/docker';
+import { dockerCliFlags } from '../utils/docker';
+
+interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
+	arch?: string;
+	deviceType?: string;
+	application?: string;
+	source?: string; // Not part of command profile - source param copied here.
+	help: void;
+}
+
+interface ArgsDef {
+	source?: string;
+}
+
+export default class BuildCmd extends Command {
+	public static description = `\
+Build a project locally.
+
+Use this command to build an image or a complete multicontainer project with
+the provided docker daemon in your development machine or balena device.
+(See also the \`balena push\` command for the option of building images in the
+balenaCloud build servers.)
+
+You must provide either an application or a device-type/architecture pair.
+
+This command will look into the given source directory (or the current working
+directory if one isn't specified) for a docker-compose.yml file, and if found,
+each service defined in the compose file will be built. If a compose file isn't
+found, it will look for a Dockerfile[.template] file (or alternative Dockerfile
+specified with the \`--dockerfile\` option), and if no dockerfile is found, it
+will try to generate one.
+
+${registrySecretsHelp}
+
+${dockerignoreHelp}
+`;
+	public static examples = [
+		'$ balena build --application myApp',
+		'$ balena build ./source/ --application myApp',
+		'$ balena build --deviceType raspberrypi3 --arch armv7hf --emulated',
+		'$ balena build --docker /var/run/docker.sock --application myApp   # Linux, Mac',
+		'$ balena build --docker //./pipe/docker_engine --application myApp # Windows',
+		'$ balena build --dockerHost my.docker.host --dockerPort 2376 --ca ca.pem --key key.pem --cert cert.pem -a myApp',
+	];
+
+	public static args = [
+		{
+			name: 'source',
+			description: 'path of project source directory',
+		},
+	];
+
+	public static usage = 'build [source]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		arch: flags.string({
+			description: 'the architecture to build for',
+			char: 'A',
+		}),
+		deviceType: flags.string({
+			description: 'the type of device this build is for',
+			char: 'd',
+		}),
+		application: flags.string({
+			description: 'name of the target balena application this build is for',
+			char: 'a',
+		}),
+		...composeCliFlags,
+		...dockerCliFlags,
+		help: cf.help,
+	};
+
+	public static primary = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			BuildCmd,
+		);
+
+		await Command.checkLoggedInIf(!!options.application);
+
+		// compositions with many services trigger misleading warnings
+		// @ts-ignore editing property that isn't typed but does exist
+		(await import('events')).defaultMaxListeners = 1000;
+
+		const sdk = getBalenaSdk();
+
+		const logger = await Command.getLogger();
+		logger.logDebug('Parsing input...');
+
+		this.translateParams(params, options);
+		await this.validateOptions(options, sdk);
+
+		const app = await this.getAppAndResolveArch(options);
+
+		const { docker, buildOpts, composeOpts } = await this.prepareBuild(options);
+
+		try {
+			await this.buildProject(docker, logger, composeOpts, {
+				app,
+				arch: options.arch!,
+				deviceType: options.deviceType!,
+				buildEmulated: options.emulated,
+				buildOpts,
+			});
+		} catch (err) {
+			logger.logError('Build failed.');
+			throw err;
+		}
+
+		logger.outputDeferredMessages();
+		logger.logSuccess('Build succeeded!');
+	}
+
+	protected translateParams(params: ArgsDef, options: FlagsDef) {
+		// Copy flags to those expected by other modules
+		options.arg = options.buildArg;
+		delete options.buildArg;
+		options['image-list'] = options['cache-from'];
+		delete options['cache-from'];
+
+		// `build` accepts `[source]` as a parameter, but compose expects it
+		// as an option. swap them here
+		if (options.source == null) {
+			options.source = params.source;
+		}
+		delete params.source;
+	}
+
+	protected async validateOptions(opts: FlagsDef, sdk: BalenaSDK) {
+		// Validate option combinations
+		if (
+			(opts.application == null &&
+				(opts.arch == null || opts.deviceType == null)) ||
+			(opts.application != null &&
+				(opts.arch != null || opts.deviceType != null))
+		) {
+			const { ExpectedError } = await import('../errors');
+			throw new ExpectedError(
+				'You must specify either an application or an arch/deviceType pair to build for',
+			);
+		}
+
+		// Validate project directory
+		const { validateProjectDirectory } = await import('../utils/compose_ts');
+		const { dockerfilePath, registrySecrets } = await validateProjectDirectory(
+			sdk,
+			{
+				dockerfilePath: opts.dockerfile,
+				noParentCheck: opts['noparent-check'] || false,
+				projectPath: opts.source || '.',
+				registrySecretsPath: opts['registry-secrets'],
+			},
+		);
+
+		opts.dockerfile = dockerfilePath;
+		opts['registry-secrets'] = registrySecrets;
+	}
+
+	protected async getAppAndResolveArch(opts: FlagsDef) {
+		if (opts.application) {
+			const { getAppWithArch } = await import('../utils/helpers');
+			const app = await getAppWithArch(opts.application);
+			opts.arch = app.arch;
+			opts.deviceType = app.is_for__device_type[0].slug;
+			return app;
+		}
+	}
+
+	protected async prepareBuild(options: FlagsDef) {
+		const { getDocker, generateBuildOpts } = await import('../utils/docker');
+		const [docker, buildOpts, composeOpts] = await Promise.all([
+			getDocker(options),
+			generateBuildOpts(options),
+			compose.generateOpts(options),
+		]);
+		return {
+			docker,
+			buildOpts,
+			composeOpts,
+		};
+	}
+
+	/**
+	 * Opts must be an object with the following keys:
+	 *   app: the app this build is for (optional)
+	 *   arch: the architecture to build for
+	 *   deviceType: the device type to build for
+	 *   buildEmulated
+	 *   buildOpts: arguments to forward to docker build command
+	 *
+	 * @param {DockerToolbelt} docker
+	 * @param {Logger} logger
+	 * @param {ComposeOpts} composeOpts
+	 * @param opts
+	 */
+	protected async buildProject(
+		docker: import('docker-toolbelt'),
+		logger: import('../utils/logger'),
+		composeOpts: ComposeOpts,
+		opts: {
+			app?: Application;
+			arch: string;
+			deviceType: string;
+			buildEmulated: boolean;
+			buildOpts: any;
+		},
+	) {
+		const { loadProject } = await import('../utils/compose_ts');
+
+		const project = await loadProject(logger, composeOpts);
+
+		const appType = (opts.app?.application_type as ApplicationType[])?.[0];
+		if (
+			appType != null &&
+			project.descriptors.length > 1 &&
+			!appType.supports_multicontainer
+		) {
+			logger.logWarn(
+				'Target application does not support multiple containers.\n' +
+					'Continuing with build, but you will not be able to deploy.',
+			);
+		}
+
+		await compose.buildProject(
+			docker,
+			logger,
+			project.path,
+			project.name,
+			project.composition,
+			opts.arch,
+			opts.deviceType,
+			opts.buildEmulated,
+			opts.buildOpts,
+			composeOpts.inlineLogs,
+			composeOpts.convertEol,
+			composeOpts.dockerfilePath,
+			composeOpts.nogitignore,
+			composeOpts.multiDockerignore,
+		);
+	}
+}

lib/actions-oclif/config/generate.ts

@@ -0,0 +1,246 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, getCliForm, stripIndent } from '../../utils/lazy';
+import type { Application, PineDeferred } from 'balena-sdk';
+
+interface FlagsDef {
+	version: string; // OS version
+	application?: string;
+	app?: string; // application alias
+	device?: string;
+	deviceApiKey?: string;
+	deviceType?: string;
+	'generate-device-api-key': boolean;
+	output?: string;
+	// Options for non-interactive configuration
+	network?: string;
+	wifiSsid?: string;
+	wifiKey?: string;
+	appUpdatePollInterval?: string;
+	help: void;
+}
+
+export default class ConfigGenerateCmd extends Command {
+	public static description = stripIndent`
+		Generate a config.json file.
+
+		Generate a config.json file for a device or application.
+
+		Calling this command with the exact version number of the targeted image is required.
+
+		This command is interactive by default, but you can do this automatically without interactivity
+		by specifying an option for each question on the command line, if you know the questions
+		that will be asked for the relevant device type.
+
+		In case that you want to configure an image for an application with mixed device types,
+		you can pass the --device-type argument along with --app to specify the target device type.
+	`;
+
+	public static examples = [
+		'$ balena config generate --device 7cf02a6 --version 2.12.7',
+		'$ balena config generate --device 7cf02a6 --version 2.12.7 --generate-device-api-key',
+		'$ balena config generate --device 7cf02a6 --version 2.12.7 --device-api-key <existingDeviceKey>',
+		'$ balena config generate --device 7cf02a6 --version 2.12.7 --output config.json',
+		'$ balena config generate --app MyApp --version 2.12.7',
+		'$ balena config generate --app MyApp --version 2.12.7 --device-type fincm3',
+		'$ balena config generate --app MyApp --version 2.12.7 --output config.json',
+		'$ balena config generate --app MyApp --version 2.12.7 --network wifi --wifiSsid mySsid --wifiKey abcdefgh --appUpdatePollInterval 1',
+	];
+
+	public static usage = 'config generate';
+
+	public static flags: flags.Input<FlagsDef> = {
+		version: flags.string({
+			description: 'a balenaOS version',
+			required: true,
+		}),
+		application: flags.string({
+			description: 'application name',
+			char: 'a',
+			exclusive: ['app', 'device'],
+		}),
+		app: flags.string({
+			description: "same as '--application'",
+			exclusive: ['application', 'device'],
+		}),
+		device: flags.string({
+			description: 'device uuid',
+			char: 'd',
+			exclusive: ['application', 'app'],
+		}),
+		deviceApiKey: flags.string({
+			description:
+				'custom device key - note that this is only supported on balenaOS 2.0.3+',
+			char: 'k',
+		}),
+		deviceType: flags.string({
+			description: 'device type slug',
+		}),
+		'generate-device-api-key': flags.boolean({
+			description: 'generate a fresh device key for the device',
+		}),
+		output: flags.string({
+			description: 'path of output file',
+			char: 'o',
+		}),
+		// Options for non-interactive configuration
+		network: flags.string({
+			description: 'the network type to use: ethernet or wifi',
+			options: ['ethernet', 'wifi'],
+		}),
+		wifiSsid: flags.string({
+			description:
+				'the wifi ssid to use (used only if --network is set to wifi)',
+		}),
+		wifiKey: flags.string({
+			description:
+				'the wifi key to use (used only if --network is set to wifi)',
+		}),
+		appUpdatePollInterval: flags.string({
+			description:
+				'how frequently (in minutes) to poll for application updates',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(ConfigGenerateCmd);
+
+		const balena = getBalenaSdk();
+
+		await this.validateOptions(options);
+
+		let deviceType = options.deviceType;
+		// Get device | application
+		let resource;
+		if (options.device != null) {
+			const { tryAsInteger } = await import('../../utils/validation');
+			resource = (await balena.models.device.get(tryAsInteger(options.device), {
+				$expand: {
+					is_of__device_type: { $select: 'slug' },
+				},
+			})) as DeviceWithDeviceType & { belongs_to__application: PineDeferred };
+			deviceType = deviceType || resource.is_of__device_type[0].slug;
+		} else {
+			resource = (await balena.models.application.get(options.application!, {
+				$expand: {
+					is_for__device_type: { $select: 'slug' },
+				},
+			})) as ApplicationWithDeviceType;
+			deviceType = deviceType || resource.is_for__device_type[0].slug;
+		}
+
+		const deviceManifest = await balena.models.device.getManifestBySlug(
+			deviceType!,
+		);
+
+		// Check compatibility if application and deviceType provided
+		if (options.application && options.deviceType) {
+			const appDeviceManifest = await balena.models.device.getManifestBySlug(
+				deviceType!,
+			);
+
+			const helpers = await import('../../utils/helpers');
+			if (
+				!helpers.areDeviceTypesCompatible(appDeviceManifest, deviceManifest)
+			) {
+				throw new balena.errors.BalenaInvalidDeviceType(
+					`Device type ${options.deviceType} is incompatible with application ${options.application}`,
+				);
+			}
+		}
+
+		// Prompt for values
+		// Pass params as an override: if there is any param with exactly the same name as a
+		// required option, that value is used (and the corresponding question is not asked)
+		const answers = await getCliForm().run(deviceManifest.options, {
+			override: options,
+		});
+		answers.version = options.version;
+
+		// Generate config
+		const { generateDeviceConfig, generateApplicationConfig } = await import(
+			'../../utils/config'
+		);
+
+		let config;
+		if ('uuid' in resource && resource.uuid != null) {
+			config = await generateDeviceConfig(
+				resource,
+				options.deviceApiKey || options['generate-device-api-key'] || undefined,
+				answers,
+			);
+		} else {
+			answers.deviceType = deviceType;
+			config = await generateApplicationConfig(
+				resource as Application,
+				answers,
+			);
+		}
+
+		// Output
+		if (options.output != null) {
+			const fs = await import('fs');
+			await fs.promises.writeFile(options.output, JSON.stringify(config));
+		}
+
+		const prettyjson = await import('prettyjson');
+		console.log(prettyjson.render(config));
+	}
+
+	protected readonly missingDeviceOrAppMessage = stripIndent`
+		Either a device or an application must be specified.
+
+		See the help page for examples:
+
+		  $ balena help config generate
+  	`;
+
+	protected readonly deviceTypeNotAllowedMessage = stripIndent`
+		Specifying a different device type is only supported when
+		generating a config for an application:
+
+		* An application, with --app <appname>
+		* A specific device type, with --device-type <deviceTypeSlug>
+
+		See the help page for examples:
+
+		  $ balena help config generate
+	`;
+
+	protected async validateOptions(options: FlagsDef) {
+		const { ExpectedError } = await import('../../errors');
+
+		// Prefer options.application over options.app
+		options.application = options.application || options.app;
+		delete options.app;
+
+		if (options.device == null && options.application == null) {
+			throw new ExpectedError(this.missingDeviceOrAppMessage);
+		}
+
+		if (!options.application && options.deviceType) {
+			throw new ExpectedError(this.deviceTypeNotAllowedMessage);
+		}
+	}
+}

lib/actions-oclif/config/inject.ts

@@ -0,0 +1,96 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getVisuals, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	type: string;
+	drive?: string;
+	help: void;
+}
+
+interface ArgsDef {
+	file: string;
+}
+
+export default class ConfigInjectCmd extends Command {
+	public static description = stripIndent`
+		Inject a configuration file into a device or OS image.
+
+		Inject a config.json file to the mounted filesystem,
+		e.g. the SD card of a provisioned device or balenaOS image.
+	`;
+
+	public static examples = [
+		'$ balena config inject my/config.json --type raspberrypi3',
+		'$ balena config inject my/config.json --type raspberrypi3 --drive /dev/disk2',
+	];
+
+	public static args = [
+		{
+			name: 'file',
+			description: 'the path to the config.json file to inject',
+			required: true,
+		},
+	];
+
+	public static usage = 'config inject <file>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		type: flags.string({
+			description:
+				'device type (Check available types with `balena devices supported`)',
+			char: 't',
+			required: true,
+		}),
+		drive: flags.string({
+			description: 'device filesystem or OS image location',
+			char: 'd',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public static root = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			ConfigInjectCmd,
+		);
+
+		const { promisify } = await import('util');
+		const umountAsync = promisify((await import('umount')).umount);
+
+		const drive =
+			options.drive || (await getVisuals().drive('Select the device/OS drive'));
+		await umountAsync(drive);
+
+		const fs = await import('fs');
+		const configJSON = JSON.parse(
+			await fs.promises.readFile(params.file, 'utf8'),
+		);
+
+		const config = await import('balena-config-json');
+		await config.write(drive, options.type, configJSON);
+
+		console.info('Done');
+	}
+}

lib/actions-oclif/config/read.ts

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getVisuals, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	type: string;
+	drive?: string;
+	help: void;
+}
+
+export default class ConfigReadCmd extends Command {
+	public static description = stripIndent`
+		Read the configuration of a device or OS image.
+
+		Read the config.json file from the mounted filesystem,
+		e.g. the SD card of a provisioned device or balenaOS image.
+	`;
+
+	public static examples = [
+		'$ balena config read --type raspberrypi3',
+		'$ balena config read --type raspberrypi3 --drive /dev/disk2',
+	];
+
+	public static usage = 'config read';
+
+	public static flags: flags.Input<FlagsDef> = {
+		type: flags.string({
+			description:
+				'device type (Check available types with `balena devices supported`)',
+			char: 't',
+			required: true,
+		}),
+		drive: flags.string({
+			description: 'device filesystem or OS image location',
+			char: 'd',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public static root = true;
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(ConfigReadCmd);
+
+		const { promisify } = await import('util');
+		const umountAsync = promisify((await import('umount')).umount);
+
+		const drive =
+			options.drive || (await getVisuals().drive('Select the device drive'));
+		await umountAsync(drive);
+
+		const config = await import('balena-config-json');
+		const configJSON = await config.read(drive, options.type);
+
+		const prettyjson = await import('prettyjson');
+		console.info(prettyjson.render(configJSON));
+	}
+}

lib/actions-oclif/config/reconfigure.ts

@@ -0,0 +1,90 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getVisuals, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	type: string;
+	drive?: string;
+	advanced: boolean;
+	help: void;
+}
+
+export default class ConfigReconfigureCmd extends Command {
+	public static description = stripIndent`
+		Interactively reconfigure a device or OS image.
+
+		Interactively reconfigure a provisioned device or OS image.
+`;
+	public static examples = [
+		'$ balena config reconfigure --type raspberrypi3',
+		'$ balena config reconfigure --type raspberrypi3 --advanced',
+		'$ balena config reconfigure --type raspberrypi3 --drive /dev/disk2',
+	];
+
+	public static usage = 'config reconfigure';
+
+	public static flags: flags.Input<FlagsDef> = {
+		type: flags.string({
+			description:
+				'device type (Check available types with `balena devices supported`)',
+			char: 't',
+			required: true,
+		}),
+		drive: flags.string({
+			description: 'device filesystem or OS image location',
+			char: 'd',
+		}),
+		advanced: flags.boolean({
+			description: 'show advanced commands',
+			char: 'v',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public static root = true;
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(ConfigReconfigureCmd);
+
+		const { promisify } = await import('util');
+		const umountAsync = promisify((await import('umount')).umount);
+
+		const drive =
+			options.drive || (await getVisuals().drive('Select the device drive'));
+		await umountAsync(drive);
+
+		const config = await import('balena-config-json');
+		const { uuid } = await config.read(drive, options.type);
+		await umountAsync(drive);
+
+		const configureCommand = ['os', 'configure', drive, '--device', uuid];
+		if (options.advanced) {
+			configureCommand.push('--advanced');
+		}
+
+		const { runCommand } = await import('../../utils/helpers');
+		await runCommand(configureCommand);
+
+		console.info('Done');
+	}
+}

lib/actions-oclif/config/write.ts

@@ -0,0 +1,106 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getVisuals, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	type: string;
+	drive?: string;
+	help: void;
+}
+
+interface ArgsDef {
+	key: string;
+	value: string;
+}
+
+export default class ConfigWriteCmd extends Command {
+	public static description = stripIndent`
+		Write a key-value pair to configuration of a device or OS image.
+
+		Write a key-value pair to the config.json file on the mounted filesystem,
+		e.g. the SD card of a provisioned device or balenaOS image.
+	`;
+
+	public static examples = [
+		'$ balena config write --type raspberrypi3 username johndoe',
+		'$ balena config write --type raspberrypi3 --drive /dev/disk2 username johndoe',
+		'$ balena config write --type raspberrypi3 files.network/settings "..."',
+	];
+
+	public static args = [
+		{
+			name: 'key',
+			description: 'the key of the config parameter to write',
+			required: true,
+		},
+		{
+			name: 'value',
+			description: 'the value of the config parameter to write',
+			required: true,
+		},
+	];
+
+	public static usage = 'config write <key> <value>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		type: flags.string({
+			description:
+				'device type (Check available types with `balena devices supported`)',
+			char: 't',
+			required: true,
+		}),
+		drive: flags.string({
+			description: 'device filesystem or OS image location',
+			char: 'd',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public static root = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			ConfigWriteCmd,
+		);
+
+		const { promisify } = await import('util');
+		const umountAsync = promisify((await import('umount')).umount);
+
+		const drive =
+			options.drive || (await getVisuals().drive('Select the device drive'));
+		await umountAsync(drive);
+
+		const config = await import('balena-config-json');
+		const configJSON = await config.read(drive, options.type);
+
+		console.info(`Setting ${params.key} to ${params.value}`);
+		const _ = await import('lodash');
+		_.set(configJSON, params.key, params.value);
+
+		await umountAsync(drive);
+
+		await config.write(drive, options.type, configJSON);
+
+		console.info('Done');
+	}
+}

lib/actions-oclif/device/identify.ts

@@ -0,0 +1,75 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+import { ExpectedError } from '../../errors';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+}
+
+export default class DeviceIdentifyCmd extends Command {
+	public static description = stripIndent`
+		Identify a device.
+
+		Identify a device by making the ACT LED blink (Raspberry Pi).
+		`;
+	public static examples = ['$ balena device identify 23c73a1'];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: 'the uuid of the device to identify',
+			parse: (dev) => tryAsInteger(dev),
+			required: true,
+		},
+	];
+
+	public static usage = 'device identify <uuid>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(DeviceIdentifyCmd);
+
+		const balena = getBalenaSdk();
+
+		try {
+			await balena.models.device.identify(params.uuid);
+		} catch (e) {
+			// Expected message: 'Request error: No online device(s) found'
+			if (e.message?.toLowerCase().includes('online')) {
+				throw new ExpectedError(`Device ${params.uuid} is not online`);
+			} else {
+				throw e;
+			}
+		}
+	}
+}

lib/actions-oclif/device/index.ts

@@ -0,0 +1,125 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { expandForAppName } from '../../utils/helpers';
+import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+import type { Application, Release } from 'balena-sdk';
+
+interface ExtendedDevice extends DeviceWithDeviceType {
+	dashboard_url?: string;
+	application_name?: string;
+	device_type?: string;
+	commit?: string;
+	last_seen?: string;
+}
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+}
+
+export default class DeviceCmd extends Command {
+	public static description = stripIndent`
+		Show info about a single device.
+
+		Show information about a single device.
+		`;
+	public static examples = ['$ balena device 7cf02a6'];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: 'the device uuid',
+			parse: (dev) => tryAsInteger(dev),
+			required: true,
+		},
+	];
+
+	public static usage = 'device <uuid>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+	public static primary = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(DeviceCmd);
+
+		const balena = getBalenaSdk();
+
+		const device = (await balena.models.device.get(params.uuid, {
+			$select: [
+				'device_name',
+				'id',
+				'overall_status',
+				'is_online',
+				'ip_address',
+				'mac_address',
+				'last_connectivity_event',
+				'uuid',
+				'supervisor_version',
+				'is_web_accessible',
+				'note',
+				'os_version',
+			],
+			...expandForAppName,
+		})) as ExtendedDevice;
+		device.status = device.overall_status;
+
+		device.dashboard_url = balena.models.device.getDashboardUrl(device.uuid);
+
+		const belongsToApplication = device.belongs_to__application as Application[];
+		device.application_name = belongsToApplication?.[0]
+			? belongsToApplication[0].app_name
+			: 'N/a';
+
+		device.device_type = device.is_of__device_type[0].slug;
+		device.commit = (device.is_running__release as Release[])[0].commit;
+		device.last_seen = device.last_connectivity_event ?? undefined;
+
+		console.log(
+			getVisuals().table.vertical(device, [
+				`$${device.device_name}$`,
+				'id',
+				'device_type',
+				'status',
+				'is_online',
+				'ip_address',
+				'mac_address',
+				'application_name',
+				'last_seen',
+				'uuid',
+				'commit',
+				'supervisor_version',
+				'is_web_accessible',
+				'note',
+				'os_version',
+				'dashboard_url',
+			]),
+		);
+	}
+}

lib/actions-oclif/device/init.ts

@@ -0,0 +1,168 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { runCommand } from '../../utils/helpers';
+
+interface FlagsDef {
+	application?: string;
+	app?: string;
+	yes: boolean;
+	advanced: boolean;
+	'os-version'?: string;
+	drive?: string;
+	config?: string;
+	help: void;
+}
+
+export default class DeviceInitCmd extends Command {
+	public static description = stripIndent`
+		Initialise a device with balenaOS.
+
+		Initialise a device by downloading the OS image of a certain application
+		and writing it to an SD Card.
+
+		Note, if the application option is omitted it will be prompted
+		for interactively.
+		`;
+	public static examples = [
+		'$ balena device init',
+		'$ balena device init --application MyApp',
+	];
+
+	public static usage = 'device init';
+
+	public static flags: flags.Input<FlagsDef> = {
+		application: cf.application,
+		app: cf.app,
+		yes: cf.yes,
+		advanced: flags.boolean({
+			char: 'v',
+			description: 'show advanced configuration options',
+		}),
+		'os-version': flags.string({
+			description: stripIndent`
+				exact version number, or a valid semver range,
+				or 'latest' (includes pre-releases),
+				or 'default' (excludes pre-releases if at least one stable version is available),
+				or 'recommended' (excludes pre-releases, will fail if only pre-release versions are available),
+				or 'menu' (will show the interactive menu)
+				`,
+		}),
+		drive: cf.drive,
+		config: flags.string({
+			description: 'path to the config JSON file, see `balena os build-config`',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(DeviceInitCmd);
+
+		// Imports
+		const { promisify } = await import('util');
+		const rimraf = promisify(await import('rimraf'));
+		const tmp = await import('tmp');
+		const tmpNameAsync = promisify(tmp.tmpName);
+		tmp.setGracefulCleanup();
+		const balena = getBalenaSdk();
+		const { downloadOSImage } = await import('../../utils/cloud');
+		const Logger = await import('../../utils/logger');
+
+		const logger = Logger.getLogger();
+
+		// Consolidate application options
+		options.application = options.application || options.app;
+		delete options.app;
+
+		// Get application and
+		const application = (await balena.models.application.get(
+			options['application'] ||
+				(await (await import('../../utils/patterns')).selectApplication()),
+			{
+				$expand: {
+					is_for__device_type: {
+						$select: 'slug',
+					},
+				},
+			},
+		)) as ApplicationWithDeviceType;
+
+		// Register new device
+		const deviceUuid = balena.models.device.generateUniqueKey();
+		console.info(`Registering to ${application.app_name}: ${deviceUuid}`);
+		await balena.models.device.register(application.id, deviceUuid);
+		const device = await balena.models.device.get(deviceUuid);
+
+		// Download OS, configure, and flash
+		const tmpPath = (await tmpNameAsync()) as string;
+		try {
+			logger.logDebug(`Downloading OS image...`);
+			const osVersion = options['os-version'] || 'default';
+			const deviceType = application.is_for__device_type[0].slug;
+			await downloadOSImage(deviceType, tmpPath, osVersion);
+
+			logger.logDebug(`Configuring OS image...`);
+			await this.configureOsImage(tmpPath, device.uuid, options);
+
+			logger.logDebug(`Writing OS image...`);
+			await this.writeOsImage(tmpPath, deviceType, options);
+		} catch (e) {
+			// Remove device in failed cases
+			try {
+				logger.logDebug(`Process failed, removing device ${device.uuid}`);
+				await balena.models.device.remove(device.uuid);
+			} catch (e) {
+				// Ignore removal failures, and throw original error
+			}
+			throw e;
+		} finally {
+			// Remove temp download
+			logger.logDebug(`Removing temporary OS image download...`);
+			await rimraf(tmpPath);
+		}
+
+		console.log('Done');
+		return device.uuid;
+	}
+
+	async configureOsImage(path: string, uuid: string, options: FlagsDef) {
+		const configureCommand = ['os', 'configure', path, '--device', uuid];
+		if (options.config) {
+			configureCommand.push('--config', options.config);
+		} else if (options.advanced) {
+			configureCommand.push('--advanced');
+		}
+		await runCommand(configureCommand);
+	}
+
+	async writeOsImage(path: string, deviceType: string, options: FlagsDef) {
+		const osInitCommand = ['os', 'initialize', path, '--type', deviceType];
+		if (options.yes) {
+			osInitCommand.push('--yes');
+		}
+		if (options.drive) {
+			osInitCommand.push('--drive', options.drive);
+		}
+		await runCommand(osInitCommand);
+	}
+}

lib/actions-oclif/device/move.ts

@@ -0,0 +1,165 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import type { Application } from 'balena-sdk';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { expandForAppName } from '../../utils/helpers';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+import { ExpectedError } from '../../errors';
+
+interface ExtendedDevice extends DeviceWithDeviceType {
+	application_name?: string;
+}
+
+interface FlagsDef {
+	application?: string;
+	app?: string;
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+}
+
+export default class DeviceMoveCmd extends Command {
+	public static description = stripIndent`
+		Move one or more devices to another application.
+
+		Move one or more devices to another application.
+
+		Note, if the application option is omitted it will be prompted
+		for interactively.
+		`;
+	public static examples = [
+		'$ balena device move 7cf02a6',
+		'$ balena device move 7cf02a6,dc39e52',
+		'$ balena device move 7cf02a6 --application MyNewApp',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description:
+				'comma-separated list (no blank spaces) of device UUIDs to be moved',
+			parse: (dev) => tryAsInteger(dev),
+			required: true,
+		},
+	];
+
+	public static usage = 'device move <uuid(s)>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		application: cf.application,
+		app: cf.app,
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			DeviceMoveCmd,
+		);
+
+		const balena = getBalenaSdk();
+
+		// Consolidate application options
+		options.application = options.application || options.app;
+		delete options.app;
+
+		const devices = await Promise.all(
+			params.uuid
+				.split(',')
+				.map(
+					(uuid) =>
+						balena.models.device.get(uuid, expandForAppName) as Promise<
+							ExtendedDevice
+						>,
+				),
+		);
+
+		for (const device of devices) {
+			const belongsToApplication = device.belongs_to__application as Application[];
+			device.application_name = belongsToApplication?.[0]
+				? belongsToApplication[0].app_name
+				: 'N/a';
+		}
+
+		// Get destination application
+		let application;
+		if (options.application) {
+			application = options.application;
+		} else {
+			const [deviceDeviceTypes, deviceTypes] = await Promise.all([
+				Promise.all(
+					devices.map((device) =>
+						balena.models.device.getManifestBySlug(
+							device.is_of__device_type[0].slug,
+						),
+					),
+				),
+				balena.models.config.getDeviceTypes(),
+			]);
+
+			const compatibleDeviceTypes = deviceTypes.filter((dt) =>
+				deviceDeviceTypes.every(
+					(deviceDeviceType) =>
+						balena.models.os.isArchitectureCompatibleWith(
+							deviceDeviceType.arch,
+							dt.arch,
+						) &&
+						!!dt.isDependent === !!deviceDeviceType.isDependent &&
+						dt.state !== 'DISCONTINUED',
+				),
+			);
+
+			const patterns = await import('../../utils/patterns');
+			try {
+				application = await patterns.selectApplication(
+					(app) =>
+						compatibleDeviceTypes.some(
+							(dt) => dt.slug === app.is_for__device_type[0].slug,
+						) &&
+						// @ts-ignore using the extended device object prop
+						devices.some((device) => device.application_name !== app.app_name),
+					true,
+				);
+			} catch (err) {
+				if (deviceDeviceTypes.length) {
+					throw new ExpectedError(
+						`${err.message}\nDo all devices have a compatible architecture?`,
+					);
+				}
+				throw err;
+			}
+		}
+
+		for (const uuid of params.uuid.split(',')) {
+			try {
+				await balena.models.device.move(uuid, tryAsInteger(application));
+				console.info(`${uuid} was moved to ${application}`);
+			} catch (err) {
+				console.info(`${err.message}, uuid: ${uuid}`);
+				process.exitCode = 1;
+			}
+		}
+	}
+}

lib/actions-oclif/device/os-update.ts

@@ -0,0 +1,150 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+import type { Device } from 'balena-sdk';
+import { ExpectedError } from '../../errors';
+
+interface FlagsDef {
+	version?: string;
+	yes: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+}
+
+export default class DeviceOsUpdateCmd extends Command {
+	public static description = stripIndent`
+		Start a Host OS update for a device.
+
+		Start a Host OS update for a device.
+
+		Note this command will ask for confirmation interactively.
+		This can be avoided by passing the \`--yes\` option.
+
+		Requires balenaCloud; will not work with openBalena or standalone balenaOS.
+		`;
+	public static examples = [
+		'$ balena device os-update 23c73a1',
+		'$ balena device os-update 23c73a1 --version 2.31.0+rev1.prod',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: 'the uuid of the device to update',
+			parse: (dev) => tryAsInteger(dev),
+			required: true,
+		},
+	];
+
+	public static usage = 'device os-update <uuid>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		version: flags.string({
+			description: 'a balenaOS version',
+		}),
+		yes: cf.yes,
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			DeviceOsUpdateCmd,
+		);
+
+		const sdk = getBalenaSdk();
+
+		// Get device info
+		const {
+			uuid,
+			is_of__device_type,
+			os_version,
+			os_variant,
+		} = (await sdk.models.device.get(params.uuid, {
+			$select: ['uuid', 'os_version', 'os_variant'],
+			$expand: {
+				is_of__device_type: {
+					$select: 'slug',
+				},
+			},
+		})) as DeviceWithDeviceType;
+
+		// Get current device OS version
+		const currentOsVersion = sdk.models.device.getOsVersion({
+			os_version,
+			os_variant,
+		} as Device);
+		if (!currentOsVersion) {
+			throw new ExpectedError(
+				'The current os version of the device is not available',
+			);
+		}
+
+		// Get supported OS update versions
+		const hupVersionInfo = await sdk.models.os.getSupportedOsUpdateVersions(
+			is_of__device_type[0].slug,
+			currentOsVersion,
+		);
+		if (hupVersionInfo.versions.length === 0) {
+			throw new ExpectedError(
+				'There are no available Host OS update targets for this device',
+			);
+		}
+
+		// Get target OS version
+		let targetOsVersion = options.version;
+		if (targetOsVersion != null) {
+			if (!hupVersionInfo.versions.includes(targetOsVersion)) {
+				throw new ExpectedError(
+					`The provided version ${targetOsVersion} is not in the Host OS update targets for this device`,
+				);
+			}
+		} else {
+			targetOsVersion = await getCliForm().ask({
+				message: 'Target OS version',
+				type: 'list',
+				choices: hupVersionInfo.versions.map((version) => ({
+					name:
+						hupVersionInfo.recommended === version
+							? `${version} (recommended)`
+							: version,
+					value: version,
+				})),
+			});
+		}
+
+		const patterns = await import('../../utils/patterns');
+		// Confirm and start update
+		await patterns.confirm(
+			options.yes || false,
+			'Host OS updates require a device restart when they complete. Are you sure you want to proceed?',
+		);
+
+		await sdk.models.device.startOsUpdate(uuid, targetOsVersion);
+		await patterns.awaitDeviceOsUpdate(uuid, targetOsVersion);
+	}
+}

lib/actions-oclif/device/public-url.ts

@@ -0,0 +1,148 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	enable: boolean;
+	disable: boolean;
+	status: boolean;
+	help?: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+	// Optional hidden arg to support old command format
+	legacyUuid?: string;
+}
+
+export default class DevicePublicUrlCmd extends Command {
+	public static description = stripIndent`
+		Get or manage the public URL for a device.
+
+		This command will output the current public URL for the
+		specified device.  It can also enable or disable the URL,
+		or output the enabled status, using the respective options.
+
+		The old command style 'balena device public-url enable <uuid>'
+		is deprecated, but still supported.
+	`;
+
+	public static examples = [
+		'$ balena device public-url 23c73a1',
+		'$ balena device public-url 23c73a1 --enable',
+		'$ balena device public-url 23c73a1 --disable',
+		'$ balena device public-url 23c73a1 --status',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: 'the uuid of the device to manage',
+			parse: (dev) => tryAsInteger(dev),
+			required: true,
+		},
+		{
+			// Optional hidden arg to support old command format
+			name: 'legacyUuid',
+			parse: (dev) => tryAsInteger(dev),
+			hidden: true,
+		},
+	];
+
+	public static usage = 'device public-url <uuid>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		enable: flags.boolean({
+			description: 'enable the public URL',
+			exclusive: ['disable', 'status'],
+		}),
+		disable: flags.boolean({
+			description: 'disable the public URL',
+			exclusive: ['enable', 'status'],
+		}),
+		status: flags.boolean({
+			description: 'determine if public URL is enabled',
+			exclusive: ['enable', 'disable'],
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			DevicePublicUrlCmd,
+		);
+
+		// Legacy command format support.
+		// Previously this command used the following format
+		// (changed due to oclif technicalities):
+		//   `balena device public-url enable|disable|status <uuid>`
+		if (params.legacyUuid) {
+			const action = params.uuid;
+			if (!['enable', 'disable', 'status'].includes(action)) {
+				throw new ExpectedError(
+					`Unexpected arguments: ${params.uuid} ${params.legacyUuid}`,
+				);
+			}
+
+			options.enable = action === 'enable';
+			options.disable = action === 'disable';
+			options.status = action === 'status';
+			params.uuid = params.legacyUuid;
+			delete params.legacyUuid;
+		}
+
+		const balena = getBalenaSdk();
+
+		if (options.enable) {
+			// Enable public URL
+			await balena.models.device.enableDeviceUrl(params.uuid);
+		} else if (options.disable) {
+			// Disable public URL
+			await balena.models.device.disableDeviceUrl(params.uuid);
+		} else if (options.status) {
+			// Output bool indicating if public URL enabled
+			const hasUrl = await balena.models.device.hasDeviceUrl(params.uuid);
+			console.log(hasUrl);
+		} else {
+			// Output public URL
+			try {
+				const url = await balena.models.device.getDeviceUrl(params.uuid);
+				console.log(url);
+			} catch (e) {
+				if (e.message.includes('Device is not web accessible')) {
+					throw new ExpectedError(stripIndent`
+					Public URL is not enabled for this device.
+
+					To enable, use:
+						balena device public-url ${params.uuid} --enable
+					`);
+				} else {
+					throw e;
+				}
+			}
+		}
+	}
+}

lib/actions-oclif/device/reboot.ts

@@ -0,0 +1,72 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	force: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+}
+
+export default class DeviceRebootCmd extends Command {
+	public static description = stripIndent`
+		Restart a device.
+
+		Remotely reboot a device.
+		`;
+	public static examples = ['$ balena device reboot 23c73a1'];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: 'the uuid of the device to reboot',
+			parse: (dev) => tryAsInteger(dev),
+			required: true,
+		},
+	];
+
+	public static usage = 'device reboot <uuid>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		force: cf.force,
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			DeviceRebootCmd,
+		);
+
+		const balena = getBalenaSdk();
+
+		// The SDK current throws "BalenaDeviceNotFound: Device not found: xxxxx"
+		// when the device is not online, which may be confusing.
+		// https://github.com/balena-io/balena-cli/issues/1872
+		await balena.models.device.reboot(params.uuid, options);
+	}
+}

lib/actions-oclif/device/register.ts

@@ -0,0 +1,82 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	uuid?: string;
+	help: void;
+}
+
+interface ArgsDef {
+	application: string;
+}
+
+export default class DeviceRegisterCmd extends Command {
+	public static description = stripIndent`
+		Register a device.
+
+		Register a device to an application.
+		`;
+	public static examples = [
+		'$ balena device register MyApp',
+		'$ balena device register MyApp --uuid <uuid>',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'application',
+			description: 'the name or id of application to register device with',
+			parse: (app) => tryAsInteger(app),
+			required: true,
+		},
+	];
+
+	public static usage = 'device register <application>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		uuid: flags.string({
+			description: 'custom uuid',
+			char: 'u',
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			DeviceRegisterCmd,
+		);
+
+		const balena = getBalenaSdk();
+
+		const application = await balena.models.application.get(params.application);
+		const uuid = options.uuid ?? balena.models.device.generateUniqueKey();
+
+		console.info(`Registering to ${application.app_name}: ${uuid}`);
+
+		const result = await balena.models.device.register(application.id, uuid);
+
+		return result && result.uuid;
+	}
+}

lib/actions-oclif/device/rename.ts

@@ -0,0 +1,83 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+	newName?: string;
+}
+
+export default class DeviceRenameCmd extends Command {
+	public static description = stripIndent`
+		Rename a device.
+
+		Rename a device.
+
+		Note, if the name is omitted, it will be prompted for interactively.
+		`;
+	public static examples = [
+		'$ balena device rename 7cf02a6',
+		'$ balena device rename 7cf02a6 MyPi',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: 'the uuid of the device to rename',
+			parse: (dev) => tryAsInteger(dev),
+			required: true,
+		},
+		{
+			name: 'newName',
+			description: 'the new name for the device',
+		},
+	];
+
+	public static usage = 'device rename <uuid> [newName]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(DeviceRenameCmd);
+
+		const balena = getBalenaSdk();
+
+		const newName =
+			params.newName ||
+			(await getCliForm().ask({
+				message: 'How do you want to name this device?',
+				type: 'input',
+			})) ||
+			'';
+
+		await balena.models.device.rename(params.uuid, newName);
+	}
+}

lib/actions-oclif/device/rm.ts

@@ -0,0 +1,96 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	yes: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+}
+
+export default class DeviceRmCmd extends Command {
+	public static description = stripIndent`
+		Remove one or more devices.
+
+		Remove one or more devices from balena.
+
+		Note this command asks for confirmation interactively.
+		You can avoid this by passing the \`--yes\` option.
+		`;
+	public static examples = [
+		'$ balena device rm 7cf02a6',
+		'$ balena device rm 7cf02a6,dc39e52',
+		'$ balena device rm 7cf02a6 --yes',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description:
+				'comma-separated list (no blank spaces) of device UUIDs to be removed',
+			parse: (dev) => tryAsInteger(dev),
+			required: true,
+		},
+	];
+
+	public static usage = 'device rm <uuid(s)>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		yes: cf.yes,
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			DeviceRmCmd,
+		);
+
+		const balena = getBalenaSdk();
+		const patterns = await import('../../utils/patterns');
+
+		// Confirm
+		const uuids = params.uuid.split(',');
+		await patterns.confirm(
+			options.yes,
+			uuids.length > 1
+				? `Are you sure you want to delete ${uuids.length} devices?`
+				: `Are you sure you want to delete device ${uuids[0]} ?`,
+		);
+
+		// Remove
+		for (const uuid of params.uuid.split(',')) {
+			try {
+				await balena.models.device.remove(uuid);
+			} catch (err) {
+				console.info(`${err.message}, uuid: ${uuid}`);
+				process.exitCode = 1;
+				continue;
+			}
+		}
+	}
+}

lib/actions-oclif/device/shutdown.ts

@@ -0,0 +1,79 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+import { ExpectedError } from '../../errors';
+
+interface FlagsDef {
+	force: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+}
+
+export default class DeviceShutdownCmd extends Command {
+	public static description = stripIndent`
+		Shutdown a device.
+
+		Remotely shutdown a device.
+		`;
+	public static examples = ['$ balena device shutdown 23c73a1'];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: 'the uuid of the device to shutdown',
+			parse: (dev) => tryAsInteger(dev),
+			required: true,
+		},
+	];
+
+	public static usage = 'device shutdown <uuid>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		force: cf.force,
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			DeviceShutdownCmd,
+		);
+
+		const balena = getBalenaSdk();
+
+		try {
+			await balena.models.device.shutdown(params.uuid, options);
+		} catch (e) {
+			// Expected message: 'Request error: No online device(s) found'
+			if (e.message?.toLowerCase().includes('online')) {
+				throw new ExpectedError(`Device ${params.uuid} is not online`);
+			} else {
+				throw e;
+			}
+		}
+	}
+}

lib/actions-oclif/devices/index.ts

@@ -0,0 +1,136 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { expandForAppName } from '../../utils/helpers';
+import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+import type { Application } from 'balena-sdk';
+
+interface ExtendedDevice extends DeviceWithDeviceType {
+	dashboard_url?: string;
+	application_name?: string;
+}
+
+interface FlagsDef {
+	application?: string;
+	app?: string;
+	help: void;
+	json: boolean;
+}
+
+export default class DevicesCmd extends Command {
+	public static description = stripIndent`
+		List all devices.
+
+		list all devices that belong to you.
+
+		You can filter the devices by application by using the \`--application\` option.
+
+		The --json option is recommended when scripting the output of this command,
+		because field names are less likely to change in JSON format and because it
+		better represents data types like arrays and empty strings. The 'jq' utility
+		may also be helpful in shell scripts (https://stedolan.github.io/jq/manual/).
+	`;
+	public static examples = [
+		'$ balena devices',
+		'$ balena devices --application MyApp',
+		'$ balena devices --app MyApp',
+		'$ balena devices -a MyApp',
+	];
+
+	public static usage = 'devices';
+
+	public static flags: flags.Input<FlagsDef> = {
+		application: cf.application,
+		app: cf.app,
+		help: cf.help,
+		json: flags.boolean({
+			char: 'j',
+			description: 'produce JSON output instead of tabular output',
+		}),
+	};
+
+	public static primary = true;
+
+	public static authenticated = true;
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(DevicesCmd);
+
+		const balena = getBalenaSdk();
+
+		// Consolidate application options
+		options.application = options.application || options.app;
+		delete options.app;
+
+		let devices;
+
+		if (options.application != null) {
+			devices = (await balena.models.device.getAllByApplication(
+				tryAsInteger(options.application),
+				expandForAppName,
+			)) as ExtendedDevice[];
+		} else {
+			devices = (await balena.models.device.getAll(
+				expandForAppName,
+			)) as ExtendedDevice[];
+		}
+
+		devices = devices.map(function (device) {
+			device.dashboard_url = balena.models.device.getDashboardUrl(device.uuid);
+
+			const belongsToApplication = device.belongs_to__application as Application[];
+			device.application_name = belongsToApplication?.[0]
+				? belongsToApplication[0].app_name
+				: 'N/a';
+
+			device.uuid = device.uuid.slice(0, 7);
+
+			// @ts-ignore
+			device.device_type = device.is_of__device_type[0].slug;
+			return device;
+		});
+
+		const fields = [
+			'id',
+			'uuid',
+			'device_name',
+			'device_type',
+			'application_name',
+			'status',
+			'is_online',
+			'supervisor_version',
+			'os_version',
+			'dashboard_url',
+		];
+		if (options.json) {
+			const _ = await import('lodash');
+			console.log(
+				JSON.stringify(
+					devices.map((device) => _.pick(device, fields)),
+					null,
+					4,
+				),
+			);
+		} else {
+			console.log(getVisuals().table.horizontal(devices, fields));
+		}
+	}
+}

lib/actions-oclif/devices/supported.ts

@@ -0,0 +1,122 @@
+/**
+ * @license
+ * Copyright 2016-2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { flags } from '@oclif/command';
+import type * as SDK from 'balena-sdk';
+import * as _ from 'lodash';
+import Command from '../../command';
+
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+import { CommandHelp } from '../../utils/oclif-utils';
+
+interface FlagsDef {
+	discontinued: boolean;
+	help: void;
+	json?: boolean;
+	verbose?: boolean;
+}
+
+export default class DevicesSupportedCmd extends Command {
+	public static description = stripIndent`
+		List the supported device types (like 'raspberrypi3' or 'intel-nuc').
+
+		List the supported device types (like 'raspberrypi3' or 'intel-nuc').
+
+		The --verbose option adds extra columns/fields to the output, including the
+		"STATE" column whose values are one of 'new', 'released' or 'discontinued'.
+		However, 'discontinued' device types are only listed if the '--discontinued'
+		option is used.
+
+		The --json option is recommended when scripting the output of this command,
+		because the JSON format is less likely to change and it better represents data
+		types like lists and empty strings (for example, the ALIASES column contains a
+		list of zero or more values). The 'jq' utility may be helpful in shell scripts
+		(https://stedolan.github.io/jq/manual/).
+`;
+	public static examples = [
+		'$ balena devices supported',
+		'$ balena devices supported --verbose',
+		'$ balena devices supported -vj',
+	];
+
+	public static usage = (
+		'devices supported ' +
+		new CommandHelp({ args: DevicesSupportedCmd.args }).defaultUsage()
+	).trim();
+
+	public static flags: flags.Input<FlagsDef> = {
+		discontinued: flags.boolean({
+			description: 'include "discontinued" device types',
+		}),
+		help: cf.help,
+		json: flags.boolean({
+			char: 'j',
+			description: 'produce JSON output instead of tabular output',
+		}),
+		verbose: flags.boolean({
+			char: 'v',
+			description:
+				'add extra columns in the tabular output (ALIASES, ARCH, STATE)',
+		}),
+	};
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(DevicesSupportedCmd);
+		let deviceTypes: Array<Partial<
+			SDK.DeviceTypeJson.DeviceType
+		>> = await getBalenaSdk()
+			.models.config.getDeviceTypes()
+			.then((dts) =>
+				dts.map((d) => {
+					if (d.aliases && d.aliases.length) {
+						// remove aliases that are equal to the slug
+						d.aliases = d.aliases.filter((alias: string) => alias !== d.slug);
+						if (!options.json) {
+							// stringify the aliases array with commas and spaces
+							d.aliases = [d.aliases.join(', ')];
+						}
+					} else {
+						// ensure it is always an array (for the benefit of JSON output)
+						d.aliases = [];
+					}
+					return d;
+				}),
+			);
+		if (!options.discontinued) {
+			deviceTypes = deviceTypes.filter((dt) => dt.state !== 'DISCONTINUED');
+		}
+		const fields = options.verbose
+			? ['slug', 'aliases', 'arch', 'state', 'name']
+			: ['slug', 'aliases', 'arch', 'name'];
+		deviceTypes = _.sortBy(
+			deviceTypes.map((d) => {
+				const picked = _.pick(d, fields);
+				// 'BETA' renamed to 'NEW'
+				picked.state = picked.state === 'BETA' ? 'NEW' : picked.state;
+				return picked;
+			}),
+			fields,
+		);
+		if (options.json) {
+			console.log(JSON.stringify(deviceTypes, null, 4));
+		} else {
+			const visuals = getVisuals();
+			const output = await visuals.table.horizontal(deviceTypes, fields);
+			console.log(output);
+		}
+	}
+}

lib/actions-oclif/env/add.ts

@@ -0,0 +1,284 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type * as BalenaSdk from 'balena-sdk';
+import Command from '../../command';
+
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { CommandHelp } from '../../utils/oclif-utils';
+
+interface FlagsDef {
+	application?: string; // application name
+	device?: string; // device UUID
+	help: void;
+	quiet: boolean;
+	service?: string; // service name
+}
+
+interface ArgsDef {
+	name: string;
+	value?: string;
+}
+
+export default class EnvAddCmd extends Command {
+	public static description = stripIndent`
+		Add an environment or config variable to one or more applications, devices or services.
+
+		Add an environment or config variable to one or more applications, devices 
+		or services, as selected by the respective command-line options. Either the 
+		--application or the --device option must be provided, and either may be be 
+		used alongside the --service option to define a service-specific variable. 
+		(A service is an application container in a "microservices" application.) 
+		When the --service option is used in conjunction with the --device option, 
+		the service variable applies to the selected device only. Otherwise, it 
+		applies to all devices of the selected application (i.e., the application's 
+		fleet). If the --service option is omitted, the variable applies to all 
+		services.
+
+		If VALUE is omitted, the CLI will attempt to use the value of the environment
+		variable of same name in the CLI process' environment. In this case, a warning
+		message will be printed. Use \`--quiet\` to suppress it.
+
+		'BALENA_' or 'RESIN_' are reserved variable name prefixes used to identify
+		"configuration variables". Configuration variables control balena platform
+		features and are treated specially by balenaOS and the balena supervisor
+		running on devices. They are also stored differently in the balenaCloud API
+		database. Configuration variables cannot be set for specific services,
+		therefore the --service option cannot be used when the variable name starts
+		with a reserved prefix. When defining custom application variables, please
+		avoid the reserved prefixes.
+`;
+	public static examples = [
+		'$ balena env add TERM --application MyApp',
+		'$ balena env add EDITOR vim --application MyApp',
+		'$ balena env add EDITOR vim --application MyApp,MyApp2',
+		'$ balena env add EDITOR vim --application MyApp --service MyService',
+		'$ balena env add EDITOR vim --application MyApp,MyApp2 --service MyService,MyService2',
+		'$ balena env add EDITOR vim --device 7cf02a6',
+		'$ balena env add EDITOR vim --device 7cf02a6,d6f1433',
+		'$ balena env add EDITOR vim --device 7cf02a6 --service MyService',
+		'$ balena env add EDITOR vim --device 7cf02a6,d6f1433 --service MyService,MyService2',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			required: true,
+			description: 'environment or config variable name',
+		},
+		{
+			name: 'value',
+			required: false,
+			description:
+				"variable value; if omitted, use value from this process' environment",
+		},
+	];
+
+	// hardcoded 'env add' to avoid oclif's 'env:add' topic syntax
+	public static usage =
+		'env add ' + new CommandHelp({ args: EnvAddCmd.args }).defaultUsage();
+
+	public static flags: flags.Input<FlagsDef> = {
+		application: { exclusive: ['device'], ...cf.application },
+		device: { exclusive: ['application'], ...cf.device },
+		help: cf.help,
+		quiet: cf.quiet,
+		service: cf.service,
+	};
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			EnvAddCmd,
+		);
+		const cmd = this;
+
+		if (!options.application && !options.device) {
+			throw new ExpectedError(
+				'Either the --application or the --device option must always be used',
+			);
+		}
+
+		await Command.checkLoggedIn();
+
+		if (params.value == null) {
+			params.value = process.env[params.name];
+
+			if (params.value == null) {
+				throw new ExpectedError(
+					`Value not found for environment variable: ${params.name}`,
+				);
+			} else if (!options.quiet) {
+				cmd.warn(
+					`Using ${params.name}=${params.value} from CLI process environment`,
+				);
+			}
+		}
+
+		const balena = getBalenaSdk();
+		const reservedPrefixes = await getReservedPrefixes(balena);
+		const isConfigVar = reservedPrefixes.some((prefix) =>
+			params.name.startsWith(prefix),
+		);
+
+		if (options.service) {
+			if (isConfigVar) {
+				throw new ExpectedError(stripIndent`
+					Configuration variables prefixed with "${reservedPrefixes.join(
+						'" or "',
+					)}" cannot be set per service.
+					Hint: remove the --service option or rename the variable.
+				`);
+			}
+			await setServiceVars(balena, params, options);
+			return;
+		}
+
+		const varType = isConfigVar ? 'configVar' : 'envVar';
+		if (options.application) {
+			for (const app of options.application.split(',')) {
+				try {
+					await balena.models.application[varType].set(
+						app,
+						params.name,
+						params.value,
+					);
+				} catch (err) {
+					console.error(`${err.message}, app: ${app}`);
+					process.exitCode = 1;
+				}
+			}
+		} else if (options.device) {
+			for (const device of options.device.split(',')) {
+				try {
+					await balena.models.device[varType].set(
+						device,
+						params.name,
+						params.value,
+					);
+				} catch (err) {
+					console.error(`${err.message}, device: ${device}`);
+					process.exitCode = 1;
+				}
+			}
+		}
+	}
+}
+
+/**
+ * Add service variables for a device or application.
+ */
+async function setServiceVars(
+	sdk: BalenaSdk.BalenaSDK,
+	params: ArgsDef,
+	options: FlagsDef,
+) {
+	if (options.application) {
+		for (const app of options.application.split(',')) {
+			for (const service of options.service!.split(',')) {
+				try {
+					const serviceId = await getServiceIdForApp(sdk, app, service);
+					await sdk.models.service.var.set(
+						serviceId,
+						params.name,
+						params.value!,
+					);
+				} catch (err) {
+					console.error(`${err.message}, application: ${app}`);
+					process.exitCode = 1;
+				}
+			}
+		}
+	} else if (options.device) {
+		const { getDeviceAndAppFromUUID } = await import('../../utils/cloud');
+		for (const uuid of options.device.split(',')) {
+			let device;
+			let app;
+			try {
+				[device, app] = await getDeviceAndAppFromUUID(
+					sdk,
+					uuid,
+					['id'],
+					['app_name'],
+				);
+			} catch (err) {
+				console.error(`${err.message}, device: ${uuid}`);
+				process.exitCode = 1;
+				continue;
+			}
+			for (const service of options.service!.split(',')) {
+				try {
+					const serviceId = await getServiceIdForApp(
+						sdk,
+						app.app_name,
+						service,
+					);
+					await sdk.models.device.serviceVar.set(
+						device.id,
+						serviceId,
+						params.name,
+						params.value!,
+					);
+				} catch (err) {
+					console.error(`${err.message}, service: ${service}`);
+					process.exitCode = 1;
+				}
+			}
+		}
+	}
+}
+
+/**
+ * Return a sevice ID for the given app name and service name.
+ */
+async function getServiceIdForApp(
+	sdk: BalenaSdk.BalenaSDK,
+	appName: string,
+	serviceName: string,
+): Promise<number> {
+	let serviceId: number | undefined;
+	const services = await sdk.models.service.getAllByApplication(appName, {
+		$filter: { service_name: serviceName },
+	});
+	if (services.length > 0) {
+		serviceId = services[0].id;
+	}
+	if (serviceId === undefined) {
+		throw new ExpectedError(
+			`Cannot find service ${serviceName} for application ${appName}`,
+		);
+	}
+	return serviceId;
+}
+
+/**
+ * Return an array of variable name prefixes like: [ 'RESIN_', 'BALENA_' ].
+ * These prefixes can be used to identify "configuration variables".
+ */
+async function getReservedPrefixes(
+	balena: BalenaSdk.BalenaSDK,
+): Promise<string[]> {
+	const settings = await balena.settings.getAll();
+	const response = await balena.request.send({
+		baseUrl: settings.apiUrl,
+		url: '/config/vars',
+	});
+
+	return response.body.reservedNamespaces;
+}

lib/actions-oclif/env/rename.ts

@@ -0,0 +1,99 @@
+/**
+ * @license
+ * Copyright 2016-2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { flags } from '@oclif/command';
+import Command from '../../command';
+
+import * as cf from '../../utils/common-flags';
+import * as ec from '../../utils/env-common';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { CommandHelp } from '../../utils/oclif-utils';
+import { parseAsInteger } from '../../utils/validation';
+
+type IArg<T> = import('@oclif/parser').args.IArg<T>;
+
+interface FlagsDef {
+	config: boolean;
+	device: boolean;
+	service: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	id: number;
+	value: string;
+}
+
+export default class EnvRenameCmd extends Command {
+	public static description = stripIndent`
+		Change the value of a config or env var for an app, device or service.
+
+		Change the value of a configuration or environment variable for an application,
+		device or service, as selected by command-line options.
+
+		${ec.rmRenameHelp.split('\n').join('\n\t\t')}
+`;
+	public static examples = [
+		'$ balena env rename 123123 emacs',
+		'$ balena env rename 234234 emacs --service',
+		'$ balena env rename 345345 emacs --device',
+		'$ balena env rename 456456 emacs --device --service',
+		'$ balena env rename 567567 1 --config',
+		'$ balena env rename 678678 1 --device --config',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'id',
+			required: true,
+			description: "variable's numeric database ID",
+			parse: (input) => parseAsInteger(input, 'id'),
+		},
+		{
+			name: 'value',
+			required: true,
+			description:
+				"variable value; if omitted, use value from this process' environment",
+		},
+	];
+
+	// hardcoded 'env rename' to avoid oclif's 'env:rename' topic syntax
+	public static usage =
+		'env rename ' + new CommandHelp({ args: EnvRenameCmd.args }).defaultUsage();
+
+	public static flags: flags.Input<FlagsDef> = {
+		config: ec.booleanConfig,
+		device: ec.booleanDevice,
+		service: ec.booleanService,
+		help: cf.help,
+	};
+
+	public async run() {
+		const { args: params, flags: opt } = this.parse<FlagsDef, ArgsDef>(
+			EnvRenameCmd,
+		);
+
+		await Command.checkLoggedIn();
+
+		await getBalenaSdk().pine.patch({
+			resource: ec.getVarResourceName(opt.config, opt.device, opt.service),
+			id: params.id,
+			body: {
+				value: params.value,
+			},
+		});
+	}
+}

lib/actions-oclif/env/rm.ts

@@ -0,0 +1,107 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+
+import * as ec from '../../utils/env-common';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { CommandHelp } from '../../utils/oclif-utils';
+import { parseAsInteger } from '../../utils/validation';
+
+type IArg<T> = import('@oclif/parser').args.IArg<T>;
+
+interface FlagsDef {
+	config: boolean;
+	device: boolean;
+	service: boolean;
+	yes: boolean;
+}
+
+interface ArgsDef {
+	id: number;
+}
+
+export default class EnvRmCmd extends Command {
+	public static description = stripIndent`
+		Remove a config or env var from an application, device or service.
+
+		Remove a configuration or environment variable from an application, device
+		or service, as selected by command-line options.
+
+		${ec.rmRenameHelp.split('\n').join('\n\t\t')}
+
+		Interactive confirmation is normally asked before the variable is deleted.
+		The --yes option disables this behavior.
+`;
+	public static examples = [
+		'$ balena env rm 123123',
+		'$ balena env rm 234234 --yes',
+		'$ balena env rm 345345 --config',
+		'$ balena env rm 456456 --service',
+		'$ balena env rm 567567 --device',
+		'$ balena env rm 678678 --device --config',
+		'$ balena env rm 789789 --device --service --yes',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'id',
+			required: true,
+			description: "variable's numeric database ID",
+			parse: (input) => parseAsInteger(input, 'id'),
+		},
+	];
+
+	// hardcoded 'env rm' to avoid oclif's 'env:rm' topic syntax
+	public static usage =
+		'env rm ' + new CommandHelp({ args: EnvRmCmd.args }).defaultUsage();
+
+	public static flags: flags.Input<FlagsDef> = {
+		config: ec.booleanConfig,
+		device: ec.booleanDevice,
+		service: ec.booleanService,
+		yes: flags.boolean({
+			char: 'y',
+			description:
+				'do not prompt for confirmation before deleting the variable',
+			default: false,
+		}),
+	};
+
+	public async run() {
+		const { args: params, flags: opt } = this.parse<FlagsDef, ArgsDef>(
+			EnvRmCmd,
+		);
+
+		await Command.checkLoggedIn();
+
+		const { confirm } = await import('../../utils/patterns');
+		await confirm(
+			opt.yes || false,
+			'Are you sure you want to delete the environment variable?',
+			undefined,
+			true,
+		);
+
+		const balena = getBalenaSdk();
+		await balena.pine.delete({
+			resource: ec.getVarResourceName(opt.config, opt.device, opt.service),
+			id: params.id,
+		});
+	}
+}

lib/actions-oclif/envs.ts

@@ -0,0 +1,442 @@
+/**
+ * @license
+ * Copyright 2016-2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { flags } from '@oclif/command';
+import type * as SDK from 'balena-sdk';
+import * as _ from 'lodash';
+import Command from '../command';
+
+import { ExpectedError } from '../errors';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, getVisuals, stripIndent } from '../utils/lazy';
+import { CommandHelp } from '../utils/oclif-utils';
+import { isV12 } from '../utils/version';
+
+interface FlagsDef {
+	all?: boolean; // whether to include application-wide, device-wide variables //TODO: REMOVE
+	application?: string; // application name
+	config: boolean;
+	device?: string; // device UUID
+	json: boolean;
+	help: void;
+	service?: string; // service name
+	verbose: boolean;
+}
+
+interface EnvironmentVariableInfo extends SDK.EnvironmentVariableBase {
+	appName?: string | null; // application name
+	deviceUUID?: string; // device UUID
+	serviceName?: string; // service name
+}
+
+interface DeviceServiceEnvironmentVariableInfo
+	extends SDK.DeviceServiceEnvironmentVariable {
+	appName?: string; // application name
+	deviceUUID?: string; // device UUID
+	serviceName?: string; // service name
+}
+
+interface ServiceEnvironmentVariableInfo
+	extends SDK.ServiceEnvironmentVariable {
+	appName?: string; // application name
+	deviceUUID?: string; // device UUID
+	serviceName?: string; // service name
+}
+
+export default class EnvsCmd extends Command {
+	public static description = isV12()
+		? stripIndent`
+		List the environment or config variables of an application, device or service.
+
+		List the environment or configuration variables of an application, device or
+		service, as selected by the respective command-line options. (A service is
+		an application container in a "microservices" application.)
+
+		The results include application-wide (fleet), device-wide (multiple services on
+		a device) and service-specific variables that apply to the selected application,
+		device or service. It can be thought of as including "inherited" variables;
+		for example, a service inherits device-wide variables, and a device inherits
+		application-wide variables.
+
+		The printed output may include DEVICE and/or SERVICE columns to distinguish
+		between application-wide, device-specific and service-specific variables.
+		An asterisk in these columns indicates that the variable applies to
+		"all devices" or "all services".
+
+		The --config option is used to list "configuration variables" that control
+		balena platform features, as opposed to custom environment variables defined
+		by the user. The --config and the --service options are mutually exclusive
+		because configuration variables cannot be set for specific services.
+
+		The --json option is recommended when scripting the output of this command,
+		because the JSON format is less likely to change and it better represents data
+		types like lists and empty strings. The 'jq' utility may be helpful in shell
+		scripts (https://stedolan.github.io/jq/manual/). When --json is used, an empty
+		JSON array ([]) is printed instead of an error message when no variables exist
+		for the given query. When querying variables for a device, note that the
+		application name may be null in JSON output (or 'N/A' in tabular output) if the
+		application linked to the device is no longer accessible by the current user
+		(for example, in case the current user has been removed from the application
+		by its owner).
+`
+		: stripIndent`
+		List the environment or config variables of an application, device or service.
+
+		List the environment or configuration variables of an application, device or
+		service, as selected by the respective command-line options. (A service is
+		an application container in a "microservices" application.)
+
+		The --config option is used to list "configuration variables" that control
+		balena platform features, as opposed to custom environment variables defined
+		by the user. The --config and the --service options are mutually exclusive
+		because configuration variables cannot be set for specific services.
+
+		The --all option is used to include application-wide (fleet), device-wide
+		(multiple services on a device) and service-specific variables that apply to
+		the selected application, device or service. It can be thought of as including
+		"inherited" variables: for example, a service inherits device-wide variables,
+		and a device inherits application-wide variables. Variables are still filtered
+		out by type with the --config option, such that configuration and non-
+		configuration variables are never listed together.
+
+		When the --all option is used, the printed output may include DEVICE and/or
+		SERVICE columns to distinguish between application-wide, device-specific and
+		service-specific variables. An asterisk in these columns indicates that the
+		variable applies to "all devices" or "all services".
+
+		The --json option is recommended when scripting the output of this command,
+		because the JSON format is less likely to change and it better represents data
+		types like lists and empty strings. The 'jq' utility may be helpful in shell
+		scripts (https://stedolan.github.io/jq/manual/). When --json is used, an empty
+		JSON array ([]) is printed instead of an error message when no variables exist
+		for the given query. When querying variables for a device, note that the
+		application name may be null in JSON output (or 'N/A' in tabular output) if the
+		application linked to the device is no longer accessible by the current user
+		(for example, in case the current user has been removed from the application
+		by its owner).
+`;
+	public static examples = isV12()
+		? [
+				'$ balena envs --application MyApp',
+				'$ balena envs --application MyApp --json',
+				'$ balena envs --application MyApp --service MyService',
+				'$ balena envs --application MyApp --service MyService',
+				'$ balena envs --application MyApp --config',
+				'$ balena envs --device 7cf02a6',
+				'$ balena envs --device 7cf02a6 --json',
+				'$ balena envs --device 7cf02a6 --config --json',
+				'$ balena envs --device 7cf02a6 --service MyService',
+		  ]
+		: [
+				'$ balena envs --application MyApp',
+				'$ balena envs --application MyApp --all --json',
+				'$ balena envs --application MyApp --service MyService',
+				'$ balena envs --application MyApp --all --service MyService',
+				'$ balena envs --application MyApp --config',
+				'$ balena envs --device 7cf02a6',
+				'$ balena envs --device 7cf02a6 --all --json',
+				'$ balena envs --device 7cf02a6 --config --all --json',
+				'$ balena envs --device 7cf02a6 --all --service MyService',
+		  ];
+
+	public static usage = (
+		'envs ' + new CommandHelp({ args: EnvsCmd.args }).defaultUsage()
+	).trim();
+
+	public static flags: flags.Input<FlagsDef> = {
+		...(isV12()
+			? {
+					all: flags.boolean({
+						description: stripIndent`
+				No-op since balena CLI v12.0.0.`,
+						hidden: true,
+					}),
+			  }
+			: {
+					all: flags.boolean({
+						description: stripIndent`
+				include app-wide, device-wide variables that apply to the selected device or service.
+				Variables are still filtered out by type with the --config option.`,
+					}),
+			  }),
+		application: { exclusive: ['device'], ...cf.application },
+		config: flags.boolean({
+			char: 'c',
+			description: 'show configuration variables only',
+			exclusive: ['service'],
+		}),
+		device: { exclusive: ['application'], ...cf.device },
+		help: cf.help,
+		json: flags.boolean({
+			char: 'j',
+			description: 'produce JSON output instead of tabular output',
+		}),
+		verbose: cf.verbose,
+		service: { exclusive: ['config'], ...cf.service },
+	};
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(EnvsCmd);
+		const variables: EnvironmentVariableInfo[] = [];
+
+		options.all = options.all || isV12();
+
+		await Command.checkLoggedIn();
+
+		if (!options.application && !options.device) {
+			throw new ExpectedError('You must specify an application or device');
+		}
+
+		const balena = getBalenaSdk();
+
+		let appName = options.application;
+		let fullUUID: string | undefined; // as oppposed to the short, 7-char UUID
+
+		if (options.device) {
+			const { getDeviceAndMaybeAppFromUUID } = await import('../utils/cloud');
+			const [device, app] = await getDeviceAndMaybeAppFromUUID(
+				balena,
+				options.device,
+				['uuid'],
+				['app_name'],
+			);
+			fullUUID = device.uuid;
+			if (app) {
+				appName = app.app_name;
+			}
+		}
+		if (appName && options.service) {
+			await validateServiceName(balena, options.service, appName);
+		}
+		if (options.application || options.all) {
+			variables.push(...(await getAppVars(balena, appName, options)));
+		}
+		if (fullUUID) {
+			variables.push(
+				...(await getDeviceVars(balena, fullUUID, appName, options)),
+			);
+		}
+		if (!options.json && variables.length === 0) {
+			const target =
+				(options.service ? `service "${options.service}" of ` : '') +
+				(options.application
+					? `application "${options.application}"`
+					: `device "${options.device}"`);
+			throw new ExpectedError(`No environment variables found for ${target}`);
+		}
+
+		await this.printVariables(variables, options);
+	}
+
+	protected async printVariables(
+		varArray: EnvironmentVariableInfo[],
+		options: FlagsDef,
+	) {
+		const fields = ['id', 'name', 'value'];
+
+		if (options.all) {
+			// Replace undefined app names with 'N/A' or null
+			varArray = varArray.map((i: EnvironmentVariableInfo) => {
+				i.appName = i.appName || (options.json ? null : 'N/A');
+				return i;
+			});
+
+			fields.push(options.json ? 'appName' : 'appName => APPLICATION');
+			if (options.device) {
+				fields.push(options.json ? 'deviceUUID' : 'deviceUUID => DEVICE');
+			}
+			if (!options.config) {
+				fields.push(options.json ? 'serviceName' : 'serviceName => SERVICE');
+			}
+		}
+
+		if (options.json) {
+			this.log(
+				stringifyVarArray<SDK.EnvironmentVariableBase>(varArray, fields),
+			);
+		} else {
+			this.log(
+				getVisuals().table.horizontal(
+					_.sortBy(varArray, (v: SDK.EnvironmentVariableBase) => v.name),
+					fields,
+				),
+			);
+		}
+	}
+}
+
+async function validateServiceName(
+	sdk: SDK.BalenaSDK,
+	serviceName: string,
+	appName: string,
+) {
+	const services = await sdk.models.service.getAllByApplication(appName, {
+		$filter: { service_name: serviceName },
+	});
+	if (services.length === 0) {
+		throw new ExpectedError(
+			`Service "${serviceName}" not found for application "${appName}"`,
+		);
+	}
+}
+
+/**
+ * Fetch application-wide config / env / service vars.
+ * If options.application is undefined, an attempt is made to obtain the
+ * application name from the device UUID (options.device). If this attempt
+ * fails because the device does not belong to any application, an emtpy
+ * array is returned.
+ */
+async function getAppVars(
+	sdk: SDK.BalenaSDK,
+	appName: string | undefined,
+	options: FlagsDef,
+): Promise<EnvironmentVariableInfo[]> {
+	const appVars: EnvironmentVariableInfo[] = [];
+	if (!appName) {
+		return appVars;
+	}
+	if (options.config || options.all || !options.service) {
+		const vars = await sdk.models.application[
+			options.config ? 'configVar' : 'envVar'
+		].getAllByApplication(appName);
+		fillInInfoFields(vars, appName);
+		appVars.push(...vars);
+	}
+	if (!options.config && (options.service || options.all)) {
+		const pineOpts: SDK.PineOptions<SDK.ServiceEnvironmentVariable> = {
+			$expand: {
+				service: {},
+			},
+		};
+		if (options.service) {
+			pineOpts.$filter = {
+				service: {
+					service_name: options.service,
+				},
+			};
+		}
+		const serviceVars = await sdk.models.service.var.getAllByApplication(
+			appName,
+			pineOpts,
+		);
+		fillInInfoFields(serviceVars, appName);
+		appVars.push(...serviceVars);
+	}
+	return appVars;
+}
+
+/**
+ * Fetch config / env / service vars when the '--device' option is provided.
+ * Precondition: options.device must be defined.
+ */
+async function getDeviceVars(
+	sdk: SDK.BalenaSDK,
+	fullUUID: string,
+	appName: string | undefined,
+	options: FlagsDef,
+): Promise<EnvironmentVariableInfo[]> {
+	const printedUUID = options.json ? fullUUID : options.device!;
+	const deviceVars: EnvironmentVariableInfo[] = [];
+	if (options.config) {
+		const deviceConfigVars = await sdk.models.device.configVar.getAllByDevice(
+			fullUUID,
+		);
+		fillInInfoFields(deviceConfigVars, appName, printedUUID);
+		deviceVars.push(...deviceConfigVars);
+	} else {
+		if (options.service || options.all) {
+			const pineOpts: SDK.PineOptions<SDK.DeviceServiceEnvironmentVariable> = {
+				$expand: {
+					service_install: {
+						$expand: 'installs__service',
+					},
+				},
+			};
+			if (options.service) {
+				pineOpts.$filter = {
+					service_install: {
+						installs__service: { service_name: options.service },
+					},
+				};
+			}
+			const deviceServiceVars = await sdk.models.device.serviceVar.getAllByDevice(
+				fullUUID,
+				pineOpts,
+			);
+			fillInInfoFields(deviceServiceVars, appName, printedUUID);
+			deviceVars.push(...deviceServiceVars);
+		}
+		if (!options.service || options.all) {
+			const deviceEnvVars = await sdk.models.device.envVar.getAllByDevice(
+				fullUUID,
+			);
+			fillInInfoFields(deviceEnvVars, appName, printedUUID);
+			deviceVars.push(...deviceEnvVars);
+		}
+	}
+	return deviceVars;
+}
+
+/**
+ * For each env var object in varArray, fill in its top-level serviceName
+ * and deviceUUID fields. An asterisk is used to indicate that the variable
+ * applies to "all services" or "all devices".
+ */
+function fillInInfoFields(
+	varArray:
+		| EnvironmentVariableInfo[]
+		| DeviceServiceEnvironmentVariableInfo[]
+		| ServiceEnvironmentVariableInfo[],
+	appName?: string,
+	deviceUUID?: string,
+) {
+	for (const envVar of varArray) {
+		if ('service' in envVar) {
+			// envVar is of type ServiceEnvironmentVariableInfo
+			envVar.serviceName = (envVar.service as SDK.Service[])[0]?.service_name;
+		} else if ('service_install' in envVar) {
+			// envVar is of type DeviceServiceEnvironmentVariableInfo
+			envVar.serviceName = ((envVar.service_install as SDK.ServiceInstall[])[0]
+				?.installs__service as SDK.Service[])[0]?.service_name;
+		}
+		envVar.appName = appName;
+		envVar.serviceName = envVar.serviceName || '*';
+		envVar.deviceUUID = deviceUUID || '*';
+	}
+}
+
+/**
+ * Transform each object (item) of varArray to preserve only the
+ * fields (keys) listed in the fields argument.
+ */
+function stringifyVarArray<T = Dictionary<any>>(
+	varArray: T[],
+	fields: string[],
+): string {
+	const transformed = varArray.map((o: Dictionary<any>) =>
+		_.transform(
+			o,
+			(result, value, key) => {
+				if (fields.includes(key)) {
+					result[key] = value;
+				}
+			},
+			{} as Dictionary<any>,
+		),
+	);
+	return JSON.stringify(transformed, null, 4);
+}

lib/actions-oclif/internal/osinit.ts

@@ -0,0 +1,81 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import Command from '../../command';
+import { stripIndent } from '../../utils/lazy';
+import { CommandHelp } from '../../utils/oclif-utils';
+
+// 'Internal' commands are called during the execution of other commands.
+// `osinit` is called during `os initialize`
+// TODO: These should be refactored to modules/functions, and removed
+// 	See previous `internal sudo` refactor:
+//    - https://github.com/balena-io/balena-cli/pull/1455/files
+//    - https://github.com/balena-io/balena-cli/pull/1455#discussion_r334308357
+//    - https://github.com/balena-io/balena-cli/pull/1455#discussion_r334308526
+
+interface ArgsDef {
+	image: string;
+	type: string;
+	config: string;
+}
+
+export default class OsinitCmd extends Command {
+	public static description = stripIndent`
+		Do actual init of the device with the preconfigured os image.
+
+		Don't use this command directly!
+		Use \`balena os initialize <image>\` instead.
+	`;
+
+	public static args = [
+		{
+			name: 'image',
+			required: true,
+		},
+		{
+			name: 'type',
+			required: true,
+		},
+		{
+			name: 'config',
+			required: true,
+		},
+	];
+
+	public static usage = (
+		'internal osinit ' +
+		new CommandHelp({ args: OsinitCmd.args }).defaultUsage()
+	).trim();
+
+	public static hidden = true;
+	public static root = true;
+
+	public async run() {
+		const { args: params } = this.parse<{}, ArgsDef>(OsinitCmd);
+
+		const config = JSON.parse(params.config);
+
+		const { getManifest, osProgressHandler } = await import(
+			'../../utils/helpers'
+		);
+		const manifest = await getManifest(params.image, params.type);
+
+		const { initialize } = await import('balena-device-init');
+		const initializeEmitter = await initialize(params.image, manifest, config);
+		await osProgressHandler(initializeEmitter);
+	}
+}

lib/actions-oclif/internal/scandevices.ts

@@ -0,0 +1,46 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import Command from '../../command';
+import { stripIndent } from '../../utils/lazy';
+
+// 'Internal' commands are called during the execution of other commands.
+// `scandevices` is called during by `join`,`leave'.
+// TODO: These should be refactored to modules/functions, and removed
+// 	See previous `internal sudo` refactor:
+//    - https://github.com/balena-io/balena-cli/pull/1455/files
+//    - https://github.com/balena-io/balena-cli/pull/1455#discussion_r334308357
+//    - https://github.com/balena-io/balena-cli/pull/1455#discussion_r334308526
+
+export default class ScandevicesCmd extends Command {
+	public static description = stripIndent`
+		Scan for local balena-enabled devices and show a picker to choose one.
+
+		Don't use this command directly!
+	`;
+
+	public static usage = 'internal scandevices';
+
+	public static root = true;
+	public static hidden = true;
+
+	public async run() {
+		const { forms } = await import('balena-sync');
+		const hostnameOrIp = await forms.selectLocalBalenaOsDevice();
+		return console.error(`==> Selected device: ${hostnameOrIp}`);
+	}
+}

lib/actions-oclif/join.ts

@@ -0,0 +1,97 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
+
+interface FlagsDef {
+	application?: string;
+	help?: void;
+}
+
+interface ArgsDef {
+	deviceIpOrHostname?: string;
+}
+
+export default class JoinCmd extends Command {
+	public static description = stripIndent`
+		Move a local device to an application on another balena server.
+
+		Move a local device to an application on another balena server, causing
+		the device to "join" the new server. The device must be running balenaOS.
+
+		For example, you could provision a device against an openBalena installation
+		where you perform end-to-end tests and then move it to balenaCloud when it's
+		ready for production.
+
+		To move a device between applications on the same server, use the
+		\`balena device move\` command instead of \`balena join\`.
+
+		If you don't specify a device hostname or IP, this command will automatically
+		scan the local network for balenaOS devices and prompt you to select one
+		from an interactive picker. This requires root privileges.  Likewise, if
+		the application flag is not provided then a picker will be shown.
+	`;
+
+	public static examples = [
+		'$ balena join',
+		'$ balena join balena.local',
+		'$ balena join balena.local --application MyApp',
+		'$ balena join 192.168.1.25',
+		'$ balena join 192.168.1.25 --application MyApp',
+	];
+
+	public static args = [
+		{
+			name: 'deviceIpOrHostname',
+			description: 'the IP or hostname of device',
+		},
+	];
+
+	// Hardcoded to preserve camelcase
+	public static usage = 'join [deviceIpOrHostname]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		application: {
+			description: 'the name of the application the device should join',
+			...cf.application,
+		},
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+	public static primary = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			JoinCmd,
+		);
+
+		const Logger = await import('../utils/logger');
+		const promote = await import('../utils/promote');
+		const sdk = getBalenaSdk();
+		const logger = Logger.getLogger();
+		return promote.join(
+			logger,
+			sdk,
+			params.deviceIpOrHostname,
+			options.application,
+		);
+	}
+}

lib/actions-oclif/key/add.ts

@@ -0,0 +1,85 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	name: string;
+	path: string;
+}
+
+export default class KeyAddCmd extends Command {
+	public static description = stripIndent`
+		Add an SSH key to balenaCloud.
+
+		Register an SSH in balenaCloud for the logged in user.
+
+		If \`path\` is omitted, the command will attempt
+		to read the SSH key from stdin.
+	`;
+
+	public static examples = [
+		'$ balena key add Main ~/.ssh/id_rsa.pub',
+		'$ cat ~/.ssh/id_rsa.pub | balena key add Main',
+	];
+
+	public static args = [
+		{
+			name: 'name',
+			description: 'the SSH key name',
+			required: true,
+		},
+		{
+			name: `path`,
+			description: `the path to the public key file`,
+		},
+	];
+
+	public static usage = 'key add <name> [path]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public static readStdin = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(KeyAddCmd);
+
+		let key: string;
+		if (params.path != null) {
+			const { readFile } = (await import('fs')).promises;
+			key = await readFile(params.path, 'utf8');
+		} else if (this.stdin.length > 0) {
+			key = this.stdin;
+		} else {
+			throw new ExpectedError('No public key file or path provided.');
+		}
+
+		await getBalenaSdk().models.key.create(params.name, key);
+	}
+}

lib/actions-oclif/key/index.ts

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+import { parseAsInteger } from '../../utils/validation';
+
+type IArg<T> = import('@oclif/parser').args.IArg<T>;
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	id: number;
+}
+
+export default class KeyCmd extends Command {
+	public static description = stripIndent`
+		Display an SSH key.
+
+		Display a single SSH key registered in balenaCloud for the logged in user.
+	`;
+
+	public static examples = ['$ balena key 17'];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'id',
+			description: 'balenaCloud ID for the SSH key',
+			parse: (x) => parseAsInteger(x, 'id'),
+			required: true,
+		},
+	];
+
+	public static usage = 'key <id>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<{}, ArgsDef>(KeyCmd);
+
+		const key = await getBalenaSdk().models.key.get(params.id);
+
+		// Use 'name' instead of 'title' to match dashboard.
+		const displayKey = {
+			id: key.id,
+			name: key.title,
+		};
+
+		console.log(getVisuals().table.vertical(displayKey, ['id', 'name']));
+
+		// Since the public key string is long, it might
+		// wrap to lines below, causing the table layout to break.
+		// See https://github.com/balena-io/balena-cli/issues/151
+		console.log('\n' + key.public_key);
+	}
+}

lib/actions-oclif/key/rm.ts

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { parseAsInteger } from '../../utils/validation';
+
+type IArg<T> = import('@oclif/parser').args.IArg<T>;
+
+interface FlagsDef {
+	yes: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	id: number;
+}
+
+export default class KeyRmCmd extends Command {
+	public static description = stripIndent`
+		Remove an SSH key from balenaCloud.
+
+		Remove a single SSH key registered in balenaCloud for the logged in user.
+
+		The --yes option may be used to avoid interactive confirmation.
+	`;
+
+	public static examples = ['$ balena key rm 17', '$ balena key rm 17 --yes'];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'id',
+			description: 'balenaCloud ID for the SSH key',
+			parse: (x) => parseAsInteger(x, 'id'),
+			required: true,
+		},
+	];
+
+	public static usage = 'key rm <id>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		yes: cf.yes,
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			KeyRmCmd,
+		);
+
+		const patterns = await import('../../utils/patterns');
+
+		await patterns.confirm(
+			options.yes ?? false,
+			`Are you sure you want to delete key ${params.id}?`,
+		);
+
+		await getBalenaSdk().models.key.remove(params.id);
+	}
+}

lib/actions-oclif/keys.ts

@@ -0,0 +1,55 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, getVisuals, stripIndent } from '../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+export default class KeysCmd extends Command {
+	public static description = stripIndent`
+		List the SSH keys in balenaCloud.
+
+		List all SSH keys registered in balenaCloud for the logged in user.
+	`;
+	public static examples = ['$ balena keys'];
+
+	public static usage = 'keys';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		this.parse<FlagsDef, {}>(KeysCmd);
+
+		const keys = await getBalenaSdk().models.key.getAll();
+
+		// Use 'name' instead of 'title' to match dashboard.
+		const displayKeys: Array<{ id: number; name: string }> = keys.map((k) => {
+			return { id: k.id, name: k.title };
+		});
+
+		console.log(getVisuals().table.horizontal(displayKeys, ['id', 'name']));
+	}
+}

lib/actions-oclif/leave.ts

@@ -0,0 +1,79 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
+
+interface FlagsDef {
+	help?: void;
+}
+
+interface ArgsDef {
+	deviceIpOrHostname?: string;
+}
+
+export default class LeaveCmd extends Command {
+	public static description = stripIndent`
+		Remove a local device from its balena application.
+
+		Remove a local device from its balena application, causing the device to
+		"leave" the server it is provisioned on. This effectively makes the device
+		"unmanaged". The device must be running balenaOS.
+
+		The device entry on the server is preserved after running this command,
+		so the device can subsequently re-join the server if needed.
+
+		If you don't specify a device hostname or IP, this command will automatically
+		scan the local network for balenaOS devices and prompt you to select one
+		from an interactive picker. This usually requires root privileges.
+	`;
+
+	public static examples = [
+		'$ balena leave',
+		'$ balena leave balena.local',
+		'$ balena leave 192.168.1.25',
+	];
+
+	public static args = [
+		{
+			name: 'deviceIpOrHostname',
+			description: 'the device IP or hostname',
+		},
+	];
+
+	// Hardcoded to preserve camelcase
+	public static usage = 'leave [deviceIpOrHostname]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+	public static primary = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(LeaveCmd);
+
+		const Logger = await import('../utils/logger');
+		const promote = await import('../utils/promote');
+		const sdk = getBalenaSdk();
+		const logger = Logger.getLogger();
+		return promote.leave(logger, sdk, params.deviceIpOrHostname);
+	}
+}

lib/actions-oclif/local/configure.ts

@@ -0,0 +1,328 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	target: string;
+}
+
+export default class LocalConfigureCmd extends Command {
+	public static description = stripIndent`
+		(Re)configure a balenaOS drive or image.
+
+		Configure or reconfigure a balenaOS drive or image.
+	`;
+
+	public static examples = [
+		'$ balena local configure /dev/sdc',
+		'$ balena local configure path/to/image.img',
+	];
+
+	public static args = [
+		{
+			name: 'target',
+			description: 'path of drive or image to configure',
+			required: true,
+		},
+	];
+
+	public static usage = 'local configure <target>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static root = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(LocalConfigureCmd);
+
+		const { promisify } = await import('util');
+		const path = await import('path');
+		const umount = await import('umount');
+		const umountAsync = promisify(umount.umount);
+		const isMountedAsync = promisify(umount.isMounted);
+		const reconfix = await import('reconfix');
+		const denymount = promisify(await import('denymount'));
+		const Logger = await import('../../utils/logger');
+
+		const logger = Logger.getLogger();
+
+		const configurationSchema = await this.prepareConnectionFile(params.target);
+
+		if (await isMountedAsync(params.target)) {
+			await umountAsync(params.target);
+		}
+
+		const dmOpts: any = {};
+		if (process.pkg) {
+			// when running in a standalone pkg install, the 'denymount'
+			// executable is placed on the same folder as process.execPath
+			dmOpts.executablePath = path.join(
+				path.dirname(process.execPath),
+				'denymount',
+			);
+		}
+
+		const dmHandler = (cb: () => void) =>
+			reconfix
+				.readConfiguration(configurationSchema, params.target)
+				.tap((config: any) => {
+					logger.logDebug('Current config:');
+					logger.logDebug(JSON.stringify(config));
+				})
+				.then((config: any) => this.getConfiguration(config))
+				.tap((config: any) => {
+					logger.logDebug('New config:');
+					logger.logDebug(JSON.stringify(config));
+				})
+				.then(async (answers: any) => {
+					if (!answers.hostname) {
+						await this.removeHostname(configurationSchema);
+					}
+					return reconfix.writeConfiguration(
+						configurationSchema,
+						answers,
+						params.target,
+					);
+				})
+				.asCallback(cb);
+
+		await denymount(params.target, dmHandler, dmOpts);
+
+		console.log('Done!');
+	}
+
+	readonly BOOT_PARTITION = 1;
+	readonly CONNECTIONS_FOLDER = '/system-connections';
+
+	getConfigurationSchema(connectionFileName?: string) {
+		if (connectionFileName == null) {
+			connectionFileName = 'resin-wifi';
+		}
+		return {
+			mapper: [
+				{
+					template: {
+						persistentLogging: '{{persistentLogging}}',
+					},
+					domain: [['config_json', 'persistentLogging']],
+				},
+				{
+					template: {
+						hostname: '{{hostname}}',
+					},
+					domain: [['config_json', 'hostname']],
+				},
+				{
+					template: {
+						wifi: {
+							ssid: '{{networkSsid}}',
+						},
+						'wifi-security': {
+							psk: '{{networkKey}}',
+						},
+					},
+					domain: [
+						['system_connections', connectionFileName, 'wifi'],
+						['system_connections', connectionFileName, 'wifi-security'],
+					],
+				},
+			],
+			files: {
+				system_connections: {
+					fileset: true,
+					type: 'ini',
+					location: {
+						path: this.CONNECTIONS_FOLDER.slice(1),
+						// Reconfix still uses the older resin-image-fs, so still needs an
+						// object-based partition definition.
+						partition: this.BOOT_PARTITION,
+					},
+				},
+				config_json: {
+					type: 'json',
+					location: {
+						path: 'config.json',
+						partition: this.BOOT_PARTITION,
+					},
+				},
+			},
+		};
+	}
+
+	inquirerOptions = (data: any) => [
+		{
+			message: 'Network SSID',
+			type: 'input',
+			name: 'networkSsid',
+			default: data.networkSsid,
+		},
+		{
+			message: 'Network Key',
+			type: 'input',
+			name: 'networkKey',
+			default: data.networkKey,
+		},
+		{
+			message: 'Do you want to set advanced settings?',
+			type: 'confirm',
+			name: 'advancedSettings',
+			default: false,
+		},
+		{
+			message: 'Device Hostname',
+			type: 'input',
+			name: 'hostname',
+			default: data.hostname,
+			when(answers: any) {
+				return answers.advancedSettings;
+			},
+		},
+		{
+			message: 'Do you want to enable persistent logging?',
+			type: 'confirm',
+			name: 'persistentLogging',
+			default: data.persistentLogging,
+			when(answers: any) {
+				return answers.advancedSettings;
+			},
+		},
+	];
+
+	getConfiguration = async (data: any) => {
+		const _ = await import('lodash');
+		const inquirer = await import('inquirer');
+
+		// `persistentLogging` can be `undefined`, so we want
+		// to make sure that case defaults to `false`
+		data = _.assign(data, {
+			persistentLogging: data.persistentLogging || false,
+		});
+
+		return inquirer
+			.prompt(this.inquirerOptions(data))
+			.then((answers: any) => _.merge(data, answers));
+	};
+
+	// Taken from https://goo.gl/kr1kCt
+	readonly CONNECTION_FILE = stripIndent`
+		[connection]
+		id=resin-wifi
+		type=wifi
+
+		[wifi]
+		hidden=true
+		mode=infrastructure
+		ssid=My_Wifi_Ssid
+
+		[wifi-security]
+		auth-alg=open
+		key-mgmt=wpa-psk
+		psk=super_secret_wifi_password
+
+		[ipv4]
+		method=auto
+
+		[ipv6]
+		addr-gen-mode=stable-privacy
+		method=auto\
+	`;
+
+	/*
+	 * if the `resin-wifi` file exists (previously configured image or downloaded from the UI) it's used and reconfigured
+	 * if the `resin-sample.ignore` exists it's copied to `resin-wifi`
+	 * if the `resin-sample` exists it's reconfigured (legacy mode, will be removed eventually)
+	 * otherwise, the new file is created
+	 */
+	async prepareConnectionFile(target: string) {
+		const _ = await import('lodash');
+		const imagefs = await import('resin-image-fs');
+
+		return imagefs
+			.listDirectory({
+				image: target,
+				partition: this.BOOT_PARTITION,
+				path: this.CONNECTIONS_FOLDER,
+			})
+			.then((files: string[]) => {
+				// The required file already exists
+				if (_.includes(files, 'resin-wifi')) {
+					return null;
+				}
+
+				// Fresh image, new mode, accoding to https://github.com/balena-os/meta-balena/pull/770/files
+				if (_.includes(files, 'resin-sample.ignore')) {
+					return imagefs
+						.copy(
+							{
+								image: target,
+								partition: this.BOOT_PARTITION,
+								path: `${this.CONNECTIONS_FOLDER}/resin-sample.ignore`,
+							},
+							{
+								image: target,
+								partition: this.BOOT_PARTITION,
+								path: `${this.CONNECTIONS_FOLDER}/resin-wifi`,
+							},
+						)
+						.thenReturn(null);
+				}
+
+				// Legacy mode, to be removed later
+				// We return the file name override from this branch
+				// When it is removed the following cleanup should be done:
+				// * delete all the null returns from this method
+				// * turn `getConfigurationSchema` back into the constant, with the connection filename always being `resin-wifi`
+				// * drop the final `then` from this method
+				// * adapt the code in the main listener to not receive the config from this method, and use that constant instead
+				if (_.includes(files, 'resin-sample')) {
+					return 'resin-sample';
+				}
+
+				// In case there's no file at all (shouldn't happen normally, but the file might have been removed)
+				return imagefs
+					.writeFile(
+						{
+							image: target,
+							partition: this.BOOT_PARTITION,
+							path: `${this.CONNECTIONS_FOLDER}/resin-wifi`,
+						},
+						this.CONNECTION_FILE,
+					)
+					.thenReturn(null);
+			})
+			.then((connectionFileName) =>
+				this.getConfigurationSchema(connectionFileName || undefined),
+			);
+	}
+
+	async removeHostname(schema: any) {
+		const _ = await import('lodash');
+		schema.mapper = _.reject(schema.mapper, (mapper: any) =>
+			_.isEqual(Object.keys(mapper.template), ['hostname']),
+		);
+	}
+}

lib/actions-oclif/local/flash.ts

@@ -0,0 +1,146 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import {
+	getChalk,
+	getCliForm,
+	getVisuals,
+	stripIndent,
+} from '../../utils/lazy';
+import type * as SDK from 'etcher-sdk';
+
+interface FlagsDef {
+	yes: boolean;
+	drive?: string;
+	help: void;
+}
+
+interface ArgsDef {
+	image: string;
+}
+
+export default class LocalFlashCmd extends Command {
+	public static description = stripIndent`
+		Flash an image to a drive.
+
+		Flash a balenaOS image to a drive.
+		Image file may be one of: .img|.zip|.gz|.bz2|.xz
+
+		If --drive is not specified, then it will interactively
+		show a list of available drives for selection.
+	`;
+
+	public static examples = [
+		'$ balena local flash path/to/balenaos.img',
+		'$ balena local flash path/to/balenaos.img --drive /dev/disk2',
+		'$ balena local flash path/to/balenaos.img --drive /dev/disk2 --yes',
+	];
+
+	public static args = [
+		{
+			name: 'image',
+			description: 'path to OS image',
+			required: true,
+		},
+	];
+
+	public static usage = 'local flash <image>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		drive: cf.drive,
+		yes: cf.yes,
+		help: cf.help,
+	};
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			LocalFlashCmd,
+		);
+
+		const { sourceDestination, multiWrite } = await import('etcher-sdk');
+
+		const drive = await this.getDrive(options);
+
+		const yes =
+			options.yes ||
+			(await getCliForm().ask({
+				message: 'This will erase the selected drive. Are you sure?',
+				type: 'confirm',
+				name: 'yes',
+				default: false,
+			}));
+
+		if (!yes) {
+			console.log(getChalk().red.bold('Aborted image flash'));
+			process.exit(0);
+		}
+
+		const file = new sourceDestination.File(
+			params.image,
+			sourceDestination.File.OpenFlags.Read,
+		);
+		const source = await file.getInnerSource();
+
+		const visuals = getVisuals();
+		const progressBars: { [key: string]: any } = {
+			flashing: new visuals.Progress('Flashing'),
+			verifying: new visuals.Progress('Validating'),
+		};
+
+		await multiWrite.pipeSourceToDestinations(
+			source,
+			[drive],
+			(_, error) => {
+				// onFail
+				console.log(getChalk().red.bold(error.message));
+			},
+			(progress: SDK.multiWrite.MultiDestinationProgress) => {
+				// onProgress
+				progressBars[progress.type].update(progress);
+			},
+			true, // verify
+		);
+	}
+
+	async getDrive(options: {
+		drive?: string;
+	}): Promise<SDK.sourceDestination.BlockDevice> {
+		const drive = options.drive || (await getVisuals().drive('Select a drive'));
+
+		const sdk = await import('etcher-sdk');
+
+		const adapter = new sdk.scanner.adapters.BlockDeviceAdapter(() => false);
+		const scanner = new sdk.scanner.Scanner([adapter]);
+		await scanner.start();
+		try {
+			const d = scanner.getBy('device', drive);
+			if (
+				d === undefined ||
+				!(d instanceof sdk.sourceDestination.BlockDevice)
+			) {
+				throw new ExpectedError(`Drive not found: ${options.drive}`);
+			}
+			return d;
+		} finally {
+			scanner.stop();
+		}
+	}
+}

lib/actions-oclif/login.ts

@@ -0,0 +1,192 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, stripIndent, getCliForm } from '../utils/lazy';
+import { ExpectedError } from '../errors';
+
+interface FlagsDef {
+	token: boolean;
+	web: boolean;
+	credentials: boolean;
+	email?: string;
+	user?: string;
+	password?: string;
+	port?: number;
+	help: void;
+}
+
+interface ArgsDef {
+	token?: string;
+}
+
+export default class LoginCmd extends Command {
+	public static description = stripIndent`
+		Login to balena.
+
+		Login to your balena account.
+
+		This command will prompt you to login using the following login types:
+
+		- Web authorization: open your web browser and prompt to authorize the CLI
+		from the dashboard.
+
+		- Credentials: using email/password and 2FA.
+
+		- Token: using a session token or API key from the preferences page.
+`;
+	public static examples = [
+		'$ balena login',
+		'$ balena login --web',
+		'$ balena login --token "..."',
+		'$ balena login --credentials',
+		'$ balena login --credentials --email johndoe@gmail.com --password secret',
+	];
+
+	public static args = [
+		{
+			// Capitano allowed -t to be type boolean|string, which oclif does not.
+			// So -t is now bool, and we check first arg for token content.
+			name: 'token',
+			hidden: true,
+		},
+	];
+
+	public static usage = 'login';
+
+	public static flags: flags.Input<FlagsDef> = {
+		web: flags.boolean({
+			char: 'w',
+			description: 'web-based login',
+			exclusive: ['token', 'credentials'],
+		}),
+		token: flags.boolean({
+			char: 't',
+			description: 'session token or API key',
+			exclusive: ['web', 'credentials'],
+		}),
+		credentials: flags.boolean({
+			char: 'c',
+			description: 'credential-based login',
+			exclusive: ['web', 'token'],
+		}),
+		email: flags.string({
+			char: 'e',
+			description: 'email',
+			exclusive: ['user'],
+			dependsOn: ['credentials'],
+		}),
+		// Capitano version of this command had a second alias for email, 'u'.
+		// Using an oclif hidden flag to support the same behaviour.
+		user: flags.string({
+			char: 'u',
+			hidden: true,
+			exclusive: ['email'],
+			dependsOn: ['credentials'],
+		}),
+		password: flags.string({
+			char: 'p',
+			description: 'password',
+			dependsOn: ['credentials'],
+		}),
+		port: flags.integer({
+			char: 'P',
+			description:
+				'TCP port number of local HTTP login server (--web auth only)',
+			dependsOn: ['web'],
+		}),
+		help: cf.help,
+	};
+
+	public static primary = true;
+
+	public async run() {
+		const { flags: options, args: params } = this.parse<FlagsDef, ArgsDef>(
+			LoginCmd,
+		);
+
+		const balena = getBalenaSdk();
+		const messages = await import('../utils/messages');
+		const balenaUrl = await balena.settings.get('balenaUrl');
+
+		// Consolidate user/email options
+		if (options.user != null) {
+			options.email = options.user;
+		}
+
+		console.log(messages.balenaAsciiArt);
+		console.log(`\nLogging in to ${balenaUrl}`);
+		await this.doLogin(options, params.token);
+
+		const username = await balena.auth.whoami();
+
+		console.info(`Successfully logged in as: ${username}`);
+		console.info(`\
+
+Find out about the available commands by running:
+
+  $ balena help
+
+${messages.reachingOut}`);
+	}
+
+	async doLogin(loginOptions: FlagsDef, token?: string): Promise<void> {
+		// Token
+		if (loginOptions.token) {
+			if (!token) {
+				token = await getCliForm().ask({
+					message: 'Session token or API key from the preferences page',
+					name: 'token',
+					type: 'input',
+				});
+			}
+			const balena = getBalenaSdk();
+			await balena.auth.loginWithToken(token!);
+			if (!(await balena.auth.whoami())) {
+				throw new ExpectedError('Token authentication failed');
+			}
+			return;
+		}
+		// Credentials
+		else if (loginOptions.credentials) {
+			const patterns = await import('../utils/patterns');
+			return patterns.authenticate(loginOptions);
+		}
+		// Web
+		else if (loginOptions.web) {
+			const auth = await import('../auth');
+			await auth.login({ port: loginOptions.port });
+			return;
+		} else {
+			const patterns = await import('../utils/patterns');
+			// User had not selected login preference, prompt interactively
+			const loginType = await patterns.askLoginType();
+			if (loginType === 'register') {
+				const signupUrl = 'https://dashboard.balena-cloud.com/signup';
+				const open = await import('open');
+				open(signupUrl, { wait: false });
+				throw new ExpectedError(`Please sign up at ${signupUrl}`);
+			}
+
+			// Set login options flag from askLoginType, and run again
+			loginOptions[loginType] = true;
+			return this.doLogin(loginOptions);
+		}
+	}
+}

lib/actions-oclif/logout.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import Command from '../command';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
+
+export default class LogoutCmd extends Command {
+	public static description = stripIndent`
+		Logout from balena.
+
+		Logout from your balena account.
+`;
+	public static examples = ['$ balena logout'];
+
+	public static usage = 'logout';
+
+	public async run() {
+		this.parse<{}, {}>(LogoutCmd);
+		await getBalenaSdk().auth.logout();
+	}
+}

lib/actions-oclif/logs.ts

@@ -0,0 +1,183 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
+import { LogMessage } from 'balena-sdk';
+import { IArg } from '@oclif/parser/lib/args';
+
+interface FlagsDef {
+	tail?: boolean;
+	service?: string[];
+	system?: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	device: string;
+}
+
+export default class LogsCmd extends Command {
+	public static description = stripIndent`
+		Show device logs.
+
+		Show logs for a specific device.
+
+		By default, the command prints all log messages and exits.
+
+		To continuously stream output, and see new logs in real time, use the \`--tail\` option.
+
+		If an IP or .local address is passed to this command, logs are displayed from
+		a local mode device with that address. Note that --tail is implied
+		when this command is provided a local mode device.
+
+		Logs from a single service can be displayed with the --service flag. Just system logs
+		can be shown with the --system flag. Note that these flags can be used together.
+
+		Note: --service and --system flags must come after the device parameter, as per examples.
+`;
+	public static examples = [
+		'$ balena logs 23c73a1',
+		'$ balena logs 23c73a1 --tail',
+		'',
+		'$ balena logs 192.168.0.31',
+		'$ balena logs 192.168.0.31 --service my-service',
+		'$ balena logs 192.168.0.31 --service my-service-1 --service my-service-2',
+		'',
+		'$ balena logs 23c73a1.local --system',
+		'$ balena logs 23c73a1.local --system --service my-service',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'device',
+			description: 'device UUID, IP, or .local address',
+			required: true,
+		},
+	];
+
+	public static usage = 'logs <device>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		tail: flags.boolean({
+			description: 'continuously stream output',
+			char: 't',
+		}),
+		service: flags.string({
+			description: stripIndent`
+				Reject logs not originating from this service.
+				This can be used in combination with --system or other --service flags.`,
+			char: 's',
+			multiple: true,
+		}),
+		system: flags.boolean({
+			description:
+				'Only show system logs. This can be used in combination with --service.',
+			char: 'S',
+		}),
+		help: cf.help,
+	};
+
+	public static primary = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			LogsCmd,
+		);
+
+		const balena = getBalenaSdk();
+		const { serviceIdToName } = await import('../utils/cloud');
+		const { displayDeviceLogs, displayLogObject } = await import(
+			'../utils/device/logs'
+		);
+		const { validateIPAddress, validateDotLocalUrl } = await import(
+			'../utils/validation'
+		);
+		const Logger = await import('../utils/logger');
+
+		const logger = Logger.getLogger();
+
+		const displayCloudLog = async (line: LogMessage) => {
+			if (!line.isSystem) {
+				let serviceName = await serviceIdToName(balena, line.serviceId);
+				if (serviceName == null) {
+					serviceName = 'Unknown service';
+				}
+				displayLogObject(
+					{ serviceName, ...line },
+					logger,
+					options.system || false,
+					options.service,
+				);
+			} else {
+				displayLogObject(
+					line,
+					logger,
+					options.system || false,
+					options.service,
+				);
+			}
+		};
+
+		if (
+			validateIPAddress(params.device) ||
+			validateDotLocalUrl(params.device)
+		) {
+			// Logs from local device
+			const { DeviceAPI } = await import('../utils/device/api');
+			const deviceApi = new DeviceAPI(logger, params.device);
+			logger.logDebug('Checking we can access device');
+			try {
+				await deviceApi.ping();
+			} catch (e) {
+				const { ExpectedError } = await import('../errors');
+				throw new ExpectedError(
+					`Cannot access device at address ${params.device}.  Device may not be in local mode.`,
+				);
+			}
+
+			logger.logDebug('Streaming logs');
+			const logStream = await deviceApi.getLogStream();
+			await displayDeviceLogs(
+				logStream,
+				logger,
+				options.system || false,
+				options.service,
+			);
+		} else {
+			// Logs from cloud
+			await Command.checkLoggedIn();
+			if (options.tail) {
+				const logStream = await balena.logs.subscribe(params.device, {
+					count: 100,
+				});
+				// Never resolve (quit with CTRL-C), but reject on a broken connection
+				await new Promise((_resolve, reject) => {
+					logStream.on('line', displayCloudLog);
+					logStream.on('error', reject);
+				});
+			} else {
+				const logMessages = await balena.logs.history(params.device);
+				for (const logMessage of logMessages) {
+					await displayCloudLog(logMessage);
+				}
+			}
+		}
+	}
+}

lib/actions-oclif/note.ts

@@ -0,0 +1,93 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import { ExpectedError } from '../errors';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
+
+interface FlagsDef {
+	device?: string; // device UUID
+	dev?: string; // Alias for device.
+	help: void;
+}
+
+interface ArgsDef {
+	note: string;
+}
+
+export default class NoteCmd extends Command {
+	public static description = stripIndent`
+		Set a device note.
+
+		Set or update a device note. If the note argument is not provided,
+		it will be read from stdin.
+
+		To view device notes, use the \`balena device <uuid>\` command.
+	`;
+
+	public static examples = [
+		'$ balena note "My useful note" --device 7cf02a6',
+		'$ cat note.txt | balena note --device 7cf02a6',
+	];
+
+	public static args = [
+		{
+			name: 'note',
+			description: 'note content',
+		},
+	];
+
+	public static usage = 'note <|note>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		device: { exclusive: ['dev'], ...cf.device },
+		dev: flags.string({
+			exclusive: ['device'],
+			hidden: true,
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public static readStdin = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			NoteCmd,
+		);
+
+		params.note = params.note || this.stdin;
+
+		if (params.note.length === 0) {
+			throw new ExpectedError('Missing note content');
+		}
+
+		options.device = options.device || options.dev;
+		delete options.dev;
+
+		if (options.device == null || options.device.length === 0) {
+			throw new ExpectedError('Missing device UUID (--device)');
+		}
+
+		const balena = getBalenaSdk();
+
+		return balena.models.device.note(options.device!, params.note);
+	}
+}

lib/actions-oclif/os/build-config.ts

@@ -0,0 +1,130 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getCliForm, stripIndent } from '../../utils/lazy';
+import * as _ from 'lodash';
+import type { DeviceTypeJson } from 'balena-sdk';
+
+interface FlagsDef {
+	advanced: boolean;
+	output: string;
+	help: void;
+}
+
+interface ArgsDef {
+	image: string;
+	'device-type': string;
+}
+
+export default class OsBuildConfigCmd extends Command {
+	public static description = stripIndent`
+		Build an OS config and save it to a JSON file.
+
+		Interactively generate an OS config once, so that the generated config
+		file can be used in \`balena os configure\`, skipping the interactive part.
+	`;
+
+	public static examples = [
+		'$ balena os build-config ../path/rpi3.img raspberrypi3 --output rpi3-config.json',
+		'$ balena os configure ../path/rpi3.img --device 7cf02a6 --config rpi3-config.json',
+	];
+
+	public static args = [
+		{
+			name: 'image',
+			description: 'os image',
+			required: true,
+		},
+		{
+			name: 'device-type',
+			description: 'device type',
+			required: true,
+		},
+	];
+
+	public static usage = 'os build-config <image> <device-type>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		advanced: flags.boolean({
+			description: 'show advanced configuration options',
+			char: 'v',
+		}),
+		output: flags.string({
+			description: 'path to output JSON file',
+			char: 'o',
+			required: true,
+		}),
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			OsBuildConfigCmd,
+		);
+
+		const { writeFile } = (await import('fs')).promises;
+
+		const config = await this.buildConfig(
+			params.image,
+			params['device-type'],
+			options.advanced,
+		);
+
+		await writeFile(options.output, JSON.stringify(config, null, 4));
+
+		console.info(`Config file "${options.output}" created successfully.`);
+	}
+
+	async buildConfig(image: string, deviceTypeSlug: string, advanced: boolean) {
+		advanced = advanced || false;
+
+		const { getManifest } = await import('../../utils/helpers');
+
+		const deviceTypeManifest = await getManifest(image, deviceTypeSlug);
+		return this.buildConfigForDeviceType(deviceTypeManifest, advanced);
+	}
+
+	async buildConfigForDeviceType(
+		deviceTypeManifest: DeviceTypeJson.DeviceType,
+		advanced: boolean,
+	) {
+		if (advanced == null) {
+			advanced = false;
+		}
+
+		let override;
+		const questions = deviceTypeManifest.options;
+		if (!advanced) {
+			const advancedGroup = _.find(questions, {
+				name: 'advanced',
+				isGroup: true,
+			});
+
+			if (advancedGroup != null) {
+				const { getGroupDefaults } = await import('../../utils/helpers');
+				override = getGroupDefaults(advancedGroup);
+			}
+		}
+
+		return getCliForm().run(questions, { override });
+	}
+}

lib/actions-oclif/os/configure.ts

@@ -0,0 +1,503 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type * as BalenaSdk from 'balena-sdk';
+import * as _ from 'lodash';
+import * as path from 'path';
+import Command from '../../command';
+
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
+import { CommandHelp } from '../../utils/oclif-utils';
+
+const BOOT_PARTITION = 1;
+const CONNECTIONS_FOLDER = '/system-connections';
+
+interface FlagsDef {
+	advanced?: boolean;
+	app?: string;
+	application?: string;
+	config?: string;
+	'config-app-update-poll-interval'?: number;
+	'config-network'?: string;
+	'config-wifi-key'?: string;
+	'config-wifi-ssid'?: string;
+	device?: string; // device UUID
+	'device-api-key'?: string;
+	'device-type'?: string;
+	help?: void;
+	version?: string;
+	'system-connection': string[];
+	'initial-device-name'?: string;
+}
+
+interface ArgsDef {
+	image: string;
+}
+
+interface Answers {
+	appUpdatePollInterval: number; // in minutes
+	deviceType: string; // e.g. "raspberrypi3"
+	network: 'ethernet' | 'wifi';
+	version: string; // e.g. "2.32.0+rev1"
+	wifiSsid?: string;
+	wifiKey?: string;
+}
+
+const deviceApiKeyDeprecationMsg = stripIndent`
+	The --device-api-key option is deprecated and will be removed in a future release.
+	A suitable key is automatically generated or fetched if this option is omitted.`;
+
+export default class OsConfigureCmd extends Command {
+	public static description = stripIndent`
+		Configure a previously downloaded balenaOS image.
+
+		Configure a previously downloaded balenaOS image for a specific device type or
+		balena application.
+
+		Configuration settings such as WiFi authentication will be taken from the
+		following sources, in precedence order:
+		1. Command-line options like \`--config-wifi-ssid\`
+		2. A given \`config.json\` file specified with the \`--config\` option.
+		3. User input through interactive prompts (text menus).
+
+		The --device-type option may be used to override the application's default
+		device type, in case of an application with mixed device types.
+
+		The --system-connection (-c) option can be used to inject NetworkManager connection
+		profiles for additional network interfaces, such as cellular/GSM or additional
+		WiFi or ethernet connections. This option may be passed multiple times in case there
+		are multiple files to inject. See connection profile examples and reference at:
+		https://www.balena.io/docs/reference/OS/network/2.x/
+		https://developer.gnome.org/NetworkManager/stable/nm-settings.html
+
+		${deviceApiKeyDeprecationMsg.split('\n').join('\n\t\t')}
+
+		Note: This command is currently not supported on Windows natively. Windows users
+		are advised to install the Windows Subsystem for Linux (WSL) with Ubuntu, and use
+		the Linux release of the balena CLI:
+		https://docs.microsoft.com/en-us/windows/wsl/about
+	`;
+	public static examples = [
+		'$ balena os configure ../path/rpi3.img --device 7cf02a6',
+		'$ balena os configure ../path/rpi3.img --device 7cf02a6 --device-api-key <existingDeviceKey>',
+		'$ balena os configure ../path/rpi3.img --app MyApp',
+		'$ balena os configure ../path/rpi3.img --app MyApp --version 2.12.7',
+		'$ balena os configure ../path/rpi3.img --app MyFinApp --device-type raspberrypi3',
+		'$ balena os configure ../path/rpi3.img --app MyFinApp --device-type raspberrypi3 --config myWifiConfig.json',
+	];
+
+	public static args = [
+		{
+			name: 'image',
+			required: true,
+			description: 'path to a balenaOS image file, e.g. "rpi3.img"',
+		},
+	];
+
+	// hardcoded 'os configure' to avoid oclif's 'os:configure' topic syntax
+	public static usage =
+		'os configure ' +
+		new CommandHelp({ args: OsConfigureCmd.args }).defaultUsage();
+
+	public static flags: flags.Input<FlagsDef> = {
+		advanced: flags.boolean({
+			char: 'v',
+			description:
+				'ask advanced configuration questions (when in interactive mode)',
+		}),
+		app: flags.string({
+			description: "same as '--application'",
+			exclusive: ['application', 'device'],
+		}),
+		application: { exclusive: ['app', 'device'], ...cf.application },
+		config: flags.string({
+			description:
+				'path to a pre-generated config.json file to be injected in the OS image',
+		}),
+		'config-app-update-poll-interval': flags.integer({
+			description:
+				'interval (in minutes) for the on-device balena supervisor periodic app update check',
+		}),
+		'config-network': flags.string({
+			description: 'device network type (non-interactive configuration)',
+			options: ['ethernet', 'wifi'],
+		}),
+		'config-wifi-key': flags.string({
+			description: 'WiFi key (password) (non-interactive configuration)',
+		}),
+		'config-wifi-ssid': flags.string({
+			description: 'WiFi SSID (network name) (non-interactive configuration)',
+		}),
+		device: { exclusive: ['app', 'application'], ...cf.device },
+		'device-api-key': flags.string({
+			char: 'k',
+			description:
+				'custom device API key (DEPRECATED and only supported with balenaOS 2.0.3+)',
+		}),
+		'device-type': flags.string({
+			description:
+				'device type slug (e.g. "raspberrypi3") to override the application device type',
+		}),
+		'initial-device-name': flags.string({
+			description:
+				'This option will set the device name when the device provisions',
+		}),
+		help: cf.help,
+		version: flags.string({
+			description: 'balenaOS version, for example "2.32.0" or "2.44.0+rev1"',
+		}),
+		'system-connection': flags.string({
+			multiple: true,
+			char: 'c',
+			required: false,
+			description:
+				"paths to local files to place into the 'system-connections' directory",
+		}),
+	};
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			OsConfigureCmd,
+		);
+		// Prefer options.application over options.app
+		options.application = options.application || options.app;
+		options.app = undefined;
+
+		await validateOptions(options);
+
+		const devInit = await import('balena-device-init');
+		const { promises: fs } = await import('fs');
+		const { generateDeviceConfig, generateApplicationConfig } = await import(
+			'../../utils/config'
+		);
+		const helpers = await import('../../utils/helpers');
+		let app: ApplicationWithDeviceType | undefined;
+		let device;
+		let deviceTypeSlug: string;
+
+		const balena = getBalenaSdk();
+		if (options.device) {
+			device = (await balena.models.device.get(options.device, {
+				$expand: {
+					is_of__device_type: { $select: 'slug' },
+				},
+			})) as DeviceWithDeviceType & {
+				belongs_to__application: BalenaSdk.PineDeferred;
+			};
+			deviceTypeSlug = device.is_of__device_type[0].slug;
+		} else {
+			app = (await balena.models.application.get(options.application!, {
+				$expand: {
+					is_for__device_type: { $select: 'slug' },
+				},
+			})) as ApplicationWithDeviceType;
+			await checkDeviceTypeCompatibility(balena, options, app);
+			deviceTypeSlug =
+				options['device-type'] || app.is_for__device_type[0].slug;
+		}
+
+		const deviceTypeManifest = await helpers.getManifest(
+			params.image,
+			deviceTypeSlug,
+		);
+
+		let configJson: import('../../utils/config').ImgConfig | undefined;
+		if (options.config) {
+			const rawConfig = await fs.readFile(options.config, 'utf8');
+			configJson = JSON.parse(rawConfig);
+		}
+
+		const answers: Answers = await askQuestionsForDeviceType(
+			deviceTypeManifest,
+			options,
+			configJson,
+		);
+		if (options.application) {
+			answers.deviceType = deviceTypeSlug;
+		}
+		answers.version =
+			options.version ||
+			(await getOsVersionFromImage(params.image, deviceTypeManifest, devInit));
+
+		if (_.isEmpty(configJson)) {
+			if (device) {
+				configJson = await generateDeviceConfig(
+					device,
+					options['device-api-key'],
+					answers,
+				);
+			} else {
+				configJson = await generateApplicationConfig(app!, answers);
+			}
+		}
+
+		if (
+			options['initial-device-name'] &&
+			options['initial-device-name'] !== ''
+		) {
+			configJson!.initialDeviceName = options['initial-device-name'];
+		}
+
+		console.info('Configuring operating system image');
+
+		const image = params.image;
+		await helpers.osProgressHandler(
+			await devInit.configure(
+				image,
+				deviceTypeManifest,
+				configJson || {},
+				answers,
+			),
+		);
+
+		if (options['system-connection']) {
+			const files = await Promise.all(
+				options['system-connection'].map(async (filePath) => {
+					const content = await fs.readFile(filePath, 'utf8');
+					const name = path.basename(filePath);
+
+					return {
+						name,
+						content,
+					};
+				}),
+			);
+			const imagefs = await import('resin-image-fs');
+
+			for (const { name, content } of files) {
+				await imagefs.writeFile(
+					{
+						image,
+						partition: BOOT_PARTITION,
+						path: path.join(CONNECTIONS_FOLDER, name),
+					},
+					content,
+				);
+				console.info(`Copied system-connection file: ${name}`);
+			}
+		}
+	}
+}
+
+async function validateOptions(options: FlagsDef) {
+	if (process.platform === 'win32') {
+		throw new ExpectedError(stripIndent`
+			Unsupported platform error: the 'balena os configure' command currently requires
+			the Windows Subsystem for Linux in order to run on Windows. It was tested with
+			the Ubuntu 18.04 distribution from the Microsoft Store. With WSL, a balena CLI
+			release for Linux (rather than Windows) should be installed: for example, the
+			standalone zip package for Linux. (It is possible to have both a Windows CLI
+			release and a Linux CLI release installed simultaneously.) For more information
+			on WSL and the balena CLI installation options, please check:
+			- https://docs.microsoft.com/en-us/windows/wsl/about
+			- https://github.com/balena-io/balena-cli/blob/master/INSTALL.md
+		`);
+	}
+	// The 'device' and 'application' options are declared "exclusive" in the oclif
+	// flag definitions above, so oclif will enforce that they are not both used together.
+	if (!options.device && !options.application) {
+		throw new ExpectedError(
+			"Either the '--device' or the '--application' option must be provided",
+		);
+	}
+	if (!options.application && options['device-type']) {
+		throw new ExpectedError(
+			"The '--device-type' option can only be used in conjunction with the '--application' option",
+		);
+	}
+	if (options['device-api-key']) {
+		console.error(stripIndent`
+			-------------------------------------------------------------------------------------------
+			Warning: ${deviceApiKeyDeprecationMsg.split('\n').join('\n\t\t\t')}
+			-------------------------------------------------------------------------------------------
+		`);
+	}
+
+	await Command.checkLoggedIn();
+}
+
+/**
+ * Wrapper around balena-device-init.getImageOsVersion(). Throws ExpectedError
+ * if the OS image could not be read or the OS version could not be extracted
+ * from it.
+ * @param imagePath Local filesystem path to a balenaOS image file
+ * @param deviceTypeManifest Device type manifest object
+ */
+async function getOsVersionFromImage(
+	imagePath: string,
+	deviceTypeManifest: BalenaSdk.DeviceTypeJson.DeviceType,
+	devInit: typeof import('balena-device-init'),
+): Promise<string> {
+	const osVersion = await devInit.getImageOsVersion(
+		imagePath,
+		deviceTypeManifest,
+	);
+	if (!osVersion) {
+		throw new ExpectedError(stripIndent`
+			Could not read OS version from the image. Please specify the balenaOS
+			version manually with the --version command-line option.`);
+	}
+	return osVersion;
+}
+
+/**
+ * Check that options['device-type'], e.g. 'raspberrypi3', is compatible with
+ * app.device_type, e.g. 'raspberry-pi2'. Throws ExpectedError if they are not
+ * compatible.
+ * @param sdk Balena Node SDK instance
+ * @param options oclif command-line options object
+ * @param app Balena SDK Application model object
+ */
+async function checkDeviceTypeCompatibility(
+	sdk: BalenaSdk.BalenaSDK,
+	options: FlagsDef,
+	app: ApplicationWithDeviceType,
+) {
+	if (options['device-type']) {
+		const [appDeviceType, optionDeviceType] = await Promise.all([
+			sdk.models.device.getManifestBySlug(app.is_for__device_type[0].slug),
+			sdk.models.device.getManifestBySlug(options['device-type']),
+		]);
+		const helpers = await import('../../utils/helpers');
+		if (!helpers.areDeviceTypesCompatible(appDeviceType, optionDeviceType)) {
+			throw new ExpectedError(
+				`Device type ${options['device-type']} is incompatible with application ${options.application}`,
+			);
+		}
+	}
+}
+
+/**
+ * Check if the given options or configJson objects (in this order) contain
+ * the answers to some configuration questions, and interactively ask the
+ * user the questions for which answers are missing. Questions such as:
+ *
+ *     ? Network Connection (Use arrow keys)
+ *       ethernet
+ *     ❯ wifi
+ *     ? Network Connection wifi
+ *     ? Wifi SSID i-ssid
+ *     ? Wifi Passphrase [input is hidden]
+ *
+ * The questions are extracted from the given deviceType "manifest".
+ */
+async function askQuestionsForDeviceType(
+	deviceType: BalenaSdk.DeviceTypeJson.DeviceType,
+	options: FlagsDef,
+	configJson?: import('../../utils/config').ImgConfig,
+): Promise<Answers> {
+	const answerSources: any[] = [camelifyConfigOptions(options)];
+	const defaultAnswers: Partial<Answers> = {};
+	const questions: any = deviceType.options;
+	let extraOpts: { override: object } | undefined;
+
+	if (!_.isEmpty(configJson)) {
+		answerSources.push(configJson);
+	}
+
+	if (!options.advanced) {
+		const advancedGroup: any = _.find(questions, {
+			name: 'advanced',
+			isGroup: true,
+		});
+		if (!_.isEmpty(advancedGroup)) {
+			const helpers = await import('../../utils/helpers');
+			answerSources.push(helpers.getGroupDefaults(advancedGroup));
+		}
+	}
+
+	for (const questionName of getQuestionNames(deviceType)) {
+		for (const answerSource of answerSources) {
+			if (answerSource[questionName] != null) {
+				defaultAnswers[questionName] = answerSource[questionName];
+				break;
+			}
+		}
+	}
+	if (
+		!defaultAnswers.network &&
+		(defaultAnswers.wifiSsid || defaultAnswers.wifiKey)
+	) {
+		defaultAnswers.network = 'wifi';
+	}
+
+	if (!_.isEmpty(defaultAnswers)) {
+		extraOpts = { override: defaultAnswers };
+	}
+
+	return getCliForm().run(questions, extraOpts);
+}
+
+/**
+ * Given a deviceType "manifest" containing "options" properties, return an
+ * array of "question names" as in the following example.
+ *
+ * @param deviceType Device type "manifest", for example:
+ *    {   "slug": "raspberrypi3",
+ *        "options": [{
+ *                "options": [ {
+ *                        "name": "network",
+ *                        "choices": ["ethernet", "wifi"],
+ *                        ... }, {
+ *                        "name": "wifiSsid",
+ *                        "type": "text",
+ *                        ... }, {
+ *                "options": [ {
+ *                        "name": "appUpdatePollInterval",
+ *                        "default": 10,
+ *                        ...
+ * @return Array of question names, for example:
+ *     [ 'network', 'wifiSsid', 'wifiKey', 'appUpdatePollInterval' ]
+ */
+function getQuestionNames(
+	deviceType: BalenaSdk.DeviceTypeJson.DeviceType,
+): Array<keyof Answers> {
+	const questionNames: string[] = _.chain(deviceType.options)
+		.flatMap(
+			(group: BalenaSdk.DeviceTypeJson.DeviceTypeOptions) =>
+				(group.isGroup && group.options) || [],
+		)
+		.map(
+			(groupOption: BalenaSdk.DeviceTypeJson.DeviceTypeOptionsGroup) =>
+				groupOption.name,
+		)
+		.filter()
+		.value();
+	return questionNames as Array<keyof Answers>;
+}
+
+/**
+ * Create and return a new object with the key-value pairs from the input object,
+ * renaming keys that start with the 'config-' prefix as follows:
+ * Sample input:
+ *     { app: 'foo', 'config-wifi-key': 'mykey', 'config-wifi-ssid': 'myssid' }
+ * Output:
+ *     { app: 'foo', wifiKey: 'mykey', wifiSsid: 'myssid' }
+ */
+function camelifyConfigOptions(options: FlagsDef): { [key: string]: any } {
+	return _.mapKeys(options, (_value, key) => {
+		if (key.startsWith('config-')) {
+			return key
+				.substring('config-'.length)
+				.replace(/-[a-z]/g, (match) => match.substring(1).toUpperCase());
+		}
+		return key;
+	});
+}

lib/actions-oclif/os/download.ts

@@ -0,0 +1,96 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	output: string;
+	version?: string;
+	help: void;
+}
+
+interface ArgsDef {
+	type: string;
+}
+
+export default class OsDownloadCmd extends Command {
+	public static description = stripIndent`
+		Download an unconfigured OS image.
+
+		Download an unconfigured OS image for a certain device type.
+		Check available types with \`balena devices supported\`
+
+		Note: Currently this command only works with balenaCloud, not openBalena.
+		If using openBalena, please download the OS from: https://www.balena.io/os/
+
+		If version is not specified the newest stable (non-pre-release) version of OS
+		is downloaded (if available), otherwise the newest version (if all existing
+		versions for the given device type are pre-release).
+
+		You can pass \`--version menu\` to pick the OS version from the interactive menu
+		of all available versions.
+`;
+	public static examples = [
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 1.24.1',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^1.20.0',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version latest',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version default',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version menu',
+	];
+
+	public static args = [
+		{
+			name: 'type',
+			description: 'the device type',
+			required: true,
+		},
+	];
+
+	public static usage = 'os download <type>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		output: flags.string({
+			description: 'output path',
+			char: 'o',
+			required: true,
+		}),
+		version: flags.string({
+			description: stripIndent`
+				exact version number, or a valid semver range,
+				or 'latest' (includes pre-releases),
+				or 'default' (excludes pre-releases if at least one stable version is available),
+				or 'recommended' (excludes pre-releases, will fail if only pre-release versions are available),
+				or 'menu' (will show the interactive menu)
+				`,
+		}),
+		help: cf.help,
+	};
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			OsDownloadCmd,
+		);
+
+		const { downloadOSImage } = await import('../../utils/cloud');
+
+		await downloadOSImage(params.type, options.output, options.version);
+	}
+}

lib/actions-oclif/os/initialize.ts

@@ -0,0 +1,135 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getCliForm, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	type: string;
+	drive?: string;
+	yes: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	image: string;
+}
+
+const INIT_WARNING_MESSAGE = `
+
+Note: Initializing the device may ask for administrative permissions
+because we need to access the raw devices directly.\
+`;
+
+export default class OsInitializeCmd extends Command {
+	public static description = stripIndent`
+		Initialize an os image for a device.
+
+		Initialize an os image for a device with a previously
+		configured operating system image.
+		${INIT_WARNING_MESSAGE}
+	`;
+
+	public static examples = [
+		'$ balena os initialize ../path/rpi.img --type raspberry-pi',
+	];
+
+	public static args = [
+		{
+			name: 'image',
+			description: 'path to OS image',
+			required: true,
+		},
+	];
+
+	public static usage = 'os initialize <image>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		type: flags.string({
+			description:
+				'device type (Check available types with `balena devices supported`)',
+			char: 't',
+			required: true,
+		}),
+		drive: cf.drive,
+		yes: cf.yes,
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			OsInitializeCmd,
+		);
+
+		const { promisify } = await import('util');
+		const umountAsync = promisify((await import('umount')).umount);
+		const { getManifest, sudo } = await import('../../utils/helpers');
+
+		console.info(`Initializing device ${INIT_WARNING_MESSAGE}`);
+
+		const manifest = await getManifest(params.image, options.type);
+
+		const answers = await getCliForm().run(manifest.initialization?.options, {
+			override: {
+				drive: options.drive,
+			},
+		});
+
+		if (answers.drive != null) {
+			const { confirm } = await import('../../utils/patterns');
+			await confirm(
+				options.yes,
+				`This will erase ${answers.drive}. Are you sure?`,
+				`Going to erase ${answers.drive}.`,
+				true,
+			);
+			await umountAsync(answers.drive);
+		}
+
+		await sudo([
+			'internal',
+			'osinit',
+			params.image,
+			options.type,
+			JSON.stringify(answers),
+		]);
+
+		if (answers.drive != null) {
+			// TODO: balena local makes use of ejectAsync, see below
+			// DO we need this / should we do that here?
+
+			// getDrive = (drive) ->
+			// 	driveListAsync().then (drives) ->
+			// 		selectedDrive = _.find(drives, device: drive)
+
+			// 		if not selectedDrive?
+			// 			throw new Error("Drive not found: #{drive}")
+
+			// 		return selectedDrive
+			// if (os.platform() is 'win32') and selectedDrive.mountpoint?
+			// 	ejectAsync = Promise.promisify(require('removedrive').eject)
+			// 	return ejectAsync(selectedDrive.mountpoint)
+
+			await umountAsync(answers.drive);
+			console.info(`You can safely remove ${answers.drive} now`);
+		}
+	}
+}

lib/actions-oclif/os/versions.ts

@@ -0,0 +1,66 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	type: string;
+}
+
+export default class OsVersionsCmd extends Command {
+	public static description = stripIndent`
+		Show available balenaOS versions for the given device type.
+
+		Show the available balenaOS versions for the given device type.
+		Check available types with \`balena devices supported\`.
+	`;
+
+	public static examples = ['$ balena os versions raspberrypi3'];
+
+	public static args = [
+		{
+			name: 'type',
+			description: 'device type',
+		},
+	];
+
+	public static usage = 'os versions <type>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(OsVersionsCmd);
+
+		const {
+			versions: vs,
+			recommended,
+		} = await getBalenaSdk().models.os.getSupportedVersions(params.type);
+
+		vs.forEach((v) => {
+			console.log(`v${v}` + (v === recommended ? ' (recommended)' : ''));
+		});
+	}
+}

lib/actions-oclif/push.ts

@@ -0,0 +1,415 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
+import { dockerignoreHelp, registrySecretsHelp } from '../utils/messages';
+import type { BalenaSDK, Application, Organization } from 'balena-sdk';
+import { ExpectedError, instanceOf } from '../errors';
+
+enum BuildTarget {
+	Cloud,
+	Device,
+}
+
+interface FlagsDef {
+	source?: string;
+	emulated: boolean;
+	dockerfile?: string; // DeviceDeployOptions.dockerfilePath (alternative Dockerfile)
+	nocache?: boolean;
+	'noparent-check'?: boolean;
+	'registry-secrets'?: string;
+	gitignore?: boolean;
+	nogitignore?: boolean;
+	nolive?: boolean;
+	detached?: boolean;
+	service?: string[];
+	system?: boolean;
+	env?: string[];
+	'convert-eol'?: boolean;
+	'noconvert-eol'?: boolean;
+	'multi-dockerignore'?: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	applicationOrDevice: string;
+}
+
+export default class PushCmd extends Command {
+	public static description = stripIndent`
+		Start a remote build on the balena cloud build servers or a local mode device.
+
+		start a build on the remote balena cloud builders,
+		or a local mode balena device.
+
+		When building on the balenaCloud servers, the given source directory will be
+		sent to the remote server. This can be used as a drop-in replacement for the
+		"git push" deployment method.
+
+		When building on a local mode device, the given source directory will be
+		built on the device, and the resulting containers will be run on the device.
+		Logs will be streamed back from the device as part of the same invocation.
+		The web dashboard can be used to switch a device to local mode:
+		https://www.balena.io/docs/learn/develop/local-mode/
+		Note that local mode requires a supervisor version of at least v7.21.0.
+		The logs from only a single service can be shown with the --service flag, and
+		showing only the system logs can be achieved with --system. Note that these
+		flags can be used together.
+
+		When pushing to a local device a live session will be started.
+		The project source folder is watched for filesystem events, and changes
+		to files and folders are automatically synchronized to the running
+		containers. The synchronization is only in one direction, from this machine to
+		the device, and changes made on the device itself may be overwritten.
+		This feature requires a device running supervisor version v9.7.0 or greater.
+
+		${registrySecretsHelp.split('\n').join('\n\t\t')}
+
+		${dockerignoreHelp.split('\n').join('\n\t\t')}
+
+		Note: --service and --env flags must come after the applicationOrDevice parameter,
+		as per examples.
+	`;
+
+	public static examples = [
+		'$ balena push myApp',
+		'$ balena push myApp --source <source directory>',
+		'$ balena push myApp -s <source directory>',
+		'',
+		'$ balena push 10.0.0.1',
+		'$ balena push 10.0.0.1 --source <source directory>',
+		'$ balena push 10.0.0.1 --service my-service',
+		'$ balena push 10.0.0.1 --env MY_ENV_VAR=value --env my-service:SERVICE_VAR=value',
+		'$ balena push 10.0.0.1 --nolive',
+		'',
+		'$ balena push 23c73a1.local --system',
+		'$ balena push 23c73a1.local --system --service my-service',
+	];
+
+	public static args = [
+		{
+			name: 'applicationOrDevice',
+			description: 'application name, or device address (for local pushes)',
+			required: true,
+		},
+	];
+
+	public static usage = 'push <applicationOrDevice>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		source: flags.string({
+			description:
+				'Source directory to be sent to balenaCloud or balenaOS device (default: current working dir)',
+			char: 's',
+		}),
+		emulated: flags.boolean({
+			description: 'Force an emulated build to occur on the remote builder',
+			char: 'f',
+		}),
+		dockerfile: flags.string({
+			description:
+				'Alternative Dockerfile name/path, relative to the source folder',
+		}),
+		nocache: flags.boolean({
+			description: stripIndent`
+                Don't use cached layers of previously built images for this project. This ensures
+                that the latest base image and packages are pulled. Note that build logs may still
+                display the message _"Pulling previous images for caching purposes" (as the cloud
+                builder needs previous images to compute delta updates), but the logs will not
+                display the "Using cache" lines for each build step of a Dockerfile.`,
+
+			char: 'c',
+		}),
+		'noparent-check': flags.boolean({
+			description: `Disable project validation check of 'docker-compose.yml' file in parent folder`,
+		}),
+		'registry-secrets': flags.string({
+			description: stripIndent`
+				Path to a local YAML or JSON file containing Docker registry passwords used to pull base images.
+				Note that if registry-secrets are not provided on the command line, a secrets configuration
+				file from the balena directory will be used (usually $HOME/.balena/secrets.yml|.json)`,
+			char: 'R',
+		}),
+		nolive: flags.boolean({
+			description: stripIndent`
+				Don't run a live session on this push. The filesystem will not be monitored, and changes
+				will not be synchronized to any running containers. Note that both this flag and --detached
+				and required to cause the process to end once the initial build has completed.`,
+		}),
+		detached: flags.boolean({
+			description: stripIndent`
+				When pushing to the cloud, this option will cause the build to start, then return execution
+				back to the shell, with the status and release ID (if applicable).
+
+				When pushing to a local mode device, this option will cause the command to not tail application logs when the build
+				has completed.`,
+
+			char: 'd',
+		}),
+		service: flags.string({
+			description: stripIndent`
+				Reject logs not originating from this service.
+				This can be used in combination with --system and other --service flags.
+				Only valid when pushing to a local mode device.`,
+			multiple: true,
+		}),
+		system: flags.boolean({
+			description: stripIndent`
+				Only show system logs. This can be used in combination with --service.
+				Only valid when pushing to a local mode device.`,
+		}),
+		env: flags.string({
+			description: stripIndent`
+				When performing a push to device, run the built containers with environment
+				variables provided with this argument. Environment variables can be applied
+				to individual services by adding their service name before the argument,
+				separated by a colon, e.g:
+					--env main:MY_ENV=value
+				Note that if the service name cannot be found in the composition, the entire
+				left hand side of the = character will be treated as the variable name.
+			`,
+			multiple: true,
+		}),
+		'convert-eol': flags.boolean({
+			description: 'No-op and deprecated since balena CLI v12.0.0',
+			char: 'l',
+			hidden: true,
+		}),
+		'noconvert-eol': flags.boolean({
+			description: `Don't convert line endings from CRLF (Windows format) to LF (Unix format).`,
+		}),
+		'multi-dockerignore': flags.boolean({
+			description:
+				'Have each service use its own .dockerignore file. See "balena help push".',
+			char: 'm',
+			exclusive: ['gitignore'],
+		}),
+		nogitignore: flags.boolean({
+			description:
+				'No-op (default behavior) since balena CLI v12.0.0. See "balena help push".',
+			char: 'G',
+			hidden: true,
+		}),
+		gitignore: flags.boolean({
+			description: stripIndent`
+				Consider .gitignore files in addition to the .dockerignore file. This reverts
+				to the CLI v11 behavior/implementation (deprecated) if compatibility is required
+				until your project can be adapted.`,
+			char: 'g',
+			exclusive: ['multi-dockerignore'],
+		}),
+		help: cf.help,
+	};
+
+	public static primary = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			PushCmd,
+		);
+
+		const sdk = getBalenaSdk();
+		const { validateProjectDirectory } = await import('../utils/compose_ts');
+
+		const source = options.source || '.';
+		if (process.env.DEBUG) {
+			console.error(`[debug] Using ${source} as build source`);
+		}
+
+		const { dockerfilePath, registrySecrets } = await validateProjectDirectory(
+			sdk,
+			{
+				dockerfilePath: options.dockerfile,
+				noParentCheck: options['noparent-check'] || false,
+				projectPath: source,
+				registrySecretsPath: options['registry-secrets'],
+			},
+		);
+
+		const nogitignore = !options.gitignore;
+		const convertEol = !options['noconvert-eol'];
+
+		const appOrDevice = params.applicationOrDevice;
+		const buildTarget = await this.getBuildTarget(appOrDevice);
+		switch (buildTarget) {
+			case BuildTarget.Cloud:
+				const remote = await import('../utils/remote-build');
+
+				// Check for invalid options
+				const localOnlyOptions = ['nolive', 'service', 'system', 'env'];
+
+				localOnlyOptions.forEach((opt) => {
+					// @ts-ignore : Not sure why typescript wont let me do this?
+					if (options[opt]) {
+						throw new ExpectedError(
+							`The --${opt} flag is only valid when pushing to a local mode device`,
+						);
+					}
+				});
+
+				const app = appOrDevice;
+				await Command.checkLoggedIn();
+				const [token, baseUrl, owner] = await Promise.all([
+					sdk.auth.getToken(),
+					sdk.settings.get('balenaUrl'),
+					this.getAppOwner(sdk, app),
+				]);
+
+				const opts = {
+					dockerfilePath,
+					emulated: options.emulated || false,
+					multiDockerignore: options['multi-dockerignore'] || false,
+					nocache: options.nocache || false,
+					registrySecrets,
+					headless: options.detached || false,
+					convertEol,
+				};
+				const args = {
+					app,
+					owner,
+					source,
+					auth: token,
+					baseUrl,
+					nogitignore,
+					sdk,
+					opts,
+				};
+				await remote.startRemoteBuild(args);
+				break;
+
+			case BuildTarget.Device:
+				const deviceDeploy = await import('../utils/device/deploy');
+				const device = appOrDevice;
+				const servicesToDisplay = options.service;
+
+				// TODO: Support passing a different port
+				try {
+					await deviceDeploy.deployToDevice({
+						source,
+						deviceHost: device,
+						dockerfilePath,
+						registrySecrets,
+						multiDockerignore: options['multi-dockerignore'] || false,
+						nocache: options.nocache || false,
+						nogitignore,
+						noParentCheck: options['noparent-check'] || false,
+						nolive: options.nolive || false,
+						detached: options.detached || false,
+						services: servicesToDisplay,
+						system: options.system || false,
+						env: options.env || [],
+						convertEol,
+					});
+				} catch (e) {
+					const { BuildError } = await import('../utils/device/errors');
+					if (instanceOf(e, BuildError)) {
+						throw new ExpectedError(e.toString());
+					} else {
+						throw e;
+					}
+				}
+				break;
+
+			default:
+				throw new ExpectedError(
+					stripIndent`
+					Build target not recognized. Please provide either an application name or device address.
+
+					The only supported device addresses currently are IP addresses.
+
+					If you believe your build target should have been detected, and this is an error, please
+					create an issue.`,
+				);
+		}
+	}
+
+	async getBuildTarget(appOrDevice: string): Promise<BuildTarget | null> {
+		const {
+			validateApplicationName,
+			validateDotLocalUrl,
+			validateIPAddress,
+		} = await import('../utils/validation');
+
+		// First try the application regex from the api
+		if (validateApplicationName(appOrDevice)) {
+			return BuildTarget.Cloud;
+		}
+
+		if (validateIPAddress(appOrDevice) || validateDotLocalUrl(appOrDevice)) {
+			return BuildTarget.Device;
+		}
+
+		return null;
+	}
+
+	async getAppOwner(sdk: BalenaSDK, appName: string) {
+		const _ = await import('lodash');
+
+		const applications = (await sdk.models.application.getAll({
+			$expand: {
+				organization: {
+					$select: ['handle'],
+				},
+			},
+			$filter: {
+				$eq: [{ $tolower: { $: 'app_name' } }, appName.toLowerCase()],
+			},
+			$select: ['id'],
+		})) as Array<
+			Application & {
+				organization: [Organization];
+			}
+		>;
+
+		if (applications == null || applications.length === 0) {
+			throw new ExpectedError(
+				stripIndent`
+			No applications found with name: ${appName}.
+
+			This could mean that the application does not exist, or you do
+			not have the permissions required to access it.`,
+			);
+		}
+
+		if (applications.length === 1) {
+			return applications[0].organization[0].handle;
+		}
+
+		// If we got more than one application with the same name it means that the
+		// user has access to a collab app with the same name as a personal app. We
+		// present a list to the user which shows the fully qualified application
+		// name (user/appname) and allows them to select
+		const entries = _.map(applications, (app) => {
+			const username = app.organization[0].handle;
+			return {
+				name: `${username}/${appName}`,
+				extra: username,
+			};
+		});
+
+		const { selectFromList } = await import('../utils/patterns');
+		const selected = await selectFromList(
+			`${entries.length} applications found with that name, please select the application you would like to push to`,
+			entries,
+		);
+
+		return selected.extra;
+	}
+}

lib/actions-oclif/scan.ts

@@ -0,0 +1,171 @@
+/**
+ * @license
+ * Copyright 2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { LocalBalenaOsDevice } from 'balena-sync';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getVisuals, stripIndent } from '../utils/lazy';
+
+interface FlagsDef {
+	verbose: boolean;
+	timeout?: number;
+	help: void;
+}
+
+export default class ScanCmd extends Command {
+	public static description = stripIndent`
+		Scan for balenaOS devices on your local network.
+
+		Scan for balenaOS devices on your local network.
+`;
+
+	public static examples = [
+		'$ balena scan',
+		'$ balena scan --timeout 120',
+		'$ balena scan --verbose',
+	];
+
+	public static usage = 'scan';
+
+	public static flags: flags.Input<FlagsDef> = {
+		verbose: flags.boolean({
+			char: 'v',
+			default: false,
+			description: 'display full info',
+		}),
+		timeout: flags.integer({
+			char: 't',
+			description: 'scan timeout in seconds',
+		}),
+		help: cf.help,
+	};
+
+	public static primary = true;
+	public static root = true;
+
+	public async run() {
+		const _ = await import('lodash');
+		const { SpinnerPromise } = getVisuals();
+		const { discover } = await import('balena-sync');
+		const prettyjson = await import('prettyjson');
+		const { ExpectedError } = await import('../errors');
+		const dockerUtils = await import('../utils/docker');
+
+		const dockerPort = 2375;
+		const dockerTimeout = 2000;
+
+		const { flags: options } = this.parse<FlagsDef, {}>(ScanCmd);
+
+		const discoverTimeout =
+			options.timeout != null ? options.timeout * 1000 : undefined;
+
+		// Find active local devices
+		const activeLocalDevices: LocalBalenaOsDevice[] = await new SpinnerPromise({
+			promise: discover.discoverLocalBalenaOsDevices(discoverTimeout),
+			startMessage: 'Scanning for local balenaOS devices..',
+			stopMessage: 'Reporting scan results',
+		}).filter(async ({ address }: { address: string }) => {
+			const docker = dockerUtils.createClient({
+				host: address,
+				port: dockerPort,
+				timeout: dockerTimeout,
+			}) as any;
+			try {
+				await docker.pingAsync();
+				return true;
+			} catch (err) {
+				return false;
+			}
+		});
+
+		// Exit with message if no devices found
+		if (_.isEmpty(activeLocalDevices)) {
+			// TODO: Consider whether this should really be an error
+			throw new ExpectedError(
+				process.platform === 'win32'
+					? ScanCmd.noDevicesFoundMessage + ScanCmd.windowsTipMessage
+					: ScanCmd.noDevicesFoundMessage,
+			);
+		}
+
+		// Query devices for info
+		const devicesInfo = await Promise.all(
+			activeLocalDevices.map(async ({ host, address }) => {
+				const docker = dockerUtils.createClient({
+					host: address,
+					port: dockerPort,
+					timeout: dockerTimeout,
+				}) as any;
+				const [dockerInfo, dockerVersion] = await Promise.all([
+					docker.infoAsync().catchReturn('Could not get Docker info'),
+					docker.versionAsync().catchReturn('Could not get Docker version'),
+				]);
+				return {
+					host,
+					address,
+					dockerInfo,
+					dockerVersion,
+				};
+			}),
+		);
+
+		// Reduce properties if not --verbose
+		if (!options.verbose) {
+			devicesInfo.forEach((d: any) => {
+				d.dockerInfo = _.isObject(d.dockerInfo)
+					? _.pick(d.dockerInfo, ScanCmd.dockerInfoProperties)
+					: d.dockerInfo;
+				d.dockerVersion = _.isObject(d.dockerVersion)
+					? _.pick(d.dockerVersion, ScanCmd.dockerVersionProperties)
+					: d.dockerVersion;
+			});
+		}
+
+		// Output results
+		console.log(prettyjson.render(devicesInfo, { noColor: true }));
+	}
+
+	protected static dockerInfoProperties = [
+		'Containers',
+		'ContainersRunning',
+		'ContainersPaused',
+		'ContainersStopped',
+		'Images',
+		'Driver',
+		'SystemTime',
+		'KernelVersion',
+		'OperatingSystem',
+		'Architecture',
+	];
+
+	protected static dockerVersionProperties = ['Version', 'ApiVersion'];
+
+	protected static noDevicesFoundMessage =
+		'Could not find any balenaOS devices on the local network.';
+
+	protected static windowsTipMessage = `
+
+Note for Windows users:
+  The 'scan' command relies on the Bonjour service. Check whether Bonjour is
+  installed (Control Panel > Programs and Features). If not, you can download
+  Bonjour for Windows (included with Bonjour Print Services) from here:
+  https://support.apple.com/kb/DL999
+
+  After installing Bonjour, restart your PC and run the 'balena scan' command
+  again.`;
+}

lib/actions-oclif/settings.ts

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+export default class SettingsCmd extends Command {
+	public static description = stripIndent`
+		Print current settings.
+
+		Use this command to display current balena CLI settings.
+`;
+	public static examples = ['$ balena settings'];
+
+	public static usage = 'settings';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public async run() {
+		this.parse<FlagsDef, {}>(SettingsCmd);
+
+		const settings = await getBalenaSdk().settings.getAll();
+
+		const prettyjson = await import('prettyjson');
+		console.log(prettyjson.render(settings));
+	}
+}

lib/actions-oclif/ssh.ts

@@ -0,0 +1,393 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
+import {
+	parseAsInteger,
+	validateDotLocalUrl,
+	validateIPAddress,
+} from '../utils/validation';
+import * as BalenaSdk from 'balena-sdk';
+
+interface FlagsDef {
+	port?: number;
+	tty: boolean;
+	verbose: boolean;
+	noproxy: boolean;
+	help: void;
+}
+
+interface ArgsDef {
+	applicationOrDevice: string;
+	serviceName?: string;
+}
+
+export default class NoteCmd extends Command {
+	public static description = stripIndent`
+		SSH into the host or application container of a device.
+
+		Start a shell on a local or remote device. If a service name is not provided,
+		a shell will be opened on the host OS.
+
+		If an application name is provided, an interactive menu will be presented
+		for the selection of an online device. A shell will then be opened for the
+		host OS or service container of the chosen device.
+
+		For local devices, the IP address and .local domain name are supported.
+		If the device is referenced by IP or \`.local\` address, the connection
+		is initiated directly to balenaOS on port \`22222\` via an
+		openssh-compatible client. Otherwise, any connection initiated remotely
+		traverses the balenaCloud VPN.
+
+		Commands may be piped to the standard input for remote execution (see examples).
+		Note however that remote command execution on service containers (as opposed to
+		the host OS) is not currently possible when a device UUID is used (instead of
+		an IP address) because of a balenaCloud backend limitation.
+
+		Note: \`balena ssh\` requires an openssh-compatible client to be correctly
+		installed in your shell environment. For more information (including Windows
+		support) please check:
+			https://github.com/balena-io/balena-cli/blob/master/INSTALL.md#additional-dependencies,
+	`;
+
+	public static examples = [
+		'$ balena ssh MyApp',
+		'$ balena ssh f49cefd',
+		'$ balena ssh f49cefd my-service',
+		'$ balena ssh f49cefd --port <port>',
+		'$ balena ssh 192.168.0.1 --verbose',
+		'$ balena ssh f49cefd.local my-service',
+		'$ echo "uptime; exit;" | balena ssh f49cefd',
+		'$ echo "uptime; exit;" | balena ssh 192.168.0.1 myService',
+	];
+
+	public static args = [
+		{
+			name: 'applicationOrDevice',
+			description: 'application name, device uuid, or address of local device',
+			required: true,
+		},
+		{
+			name: 'serviceName',
+			description: 'service name, if connecting to a container',
+			required: false,
+		},
+	];
+
+	public static usage = 'ssh <applicationOrDevice> [serviceName]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		port: flags.integer({
+			description: stripIndent`
+				SSH server port number (default 22222) if the target is an IP address or .local
+				hostname. Otherwise, port number for the balenaCloud gateway (default 22).`,
+			char: 'p',
+			parse: (p) => parseAsInteger(p, 'port'),
+		}),
+		tty: flags.boolean({
+			description:
+				'Force pseudo-terminal allocation (bypass TTY autodetection for stdin)',
+			char: 't',
+		}),
+		verbose: flags.boolean({
+			description: 'Increase verbosity',
+			char: 'v',
+		}),
+		noproxy: flags.boolean({
+			description: 'Bypass global proxy configuration for the ssh connection',
+		}),
+		help: cf.help,
+	};
+
+	public static primary = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			NoteCmd,
+		);
+
+		// if we're doing a direct SSH connection locally...
+		if (
+			validateDotLocalUrl(params.applicationOrDevice) ||
+			validateIPAddress(params.applicationOrDevice)
+		) {
+			const { performLocalDeviceSSH } = await import('../utils/device/ssh');
+			return await performLocalDeviceSSH({
+				address: params.applicationOrDevice,
+				port: options.port,
+				forceTTY: options.tty,
+				verbose: options.verbose,
+				service: params.serviceName,
+			});
+		}
+
+		const { getProxyConfig, which } = await import('../utils/helpers');
+		const { checkLoggedIn, getOnlineTargetUuid } = await import(
+			'../utils/patterns'
+		);
+		const sdk = getBalenaSdk();
+
+		const proxyConfig = getProxyConfig();
+		const useProxy = !!proxyConfig && !options.noproxy;
+
+		// this will be a tunnelled SSH connection...
+		await checkLoggedIn();
+		const uuid = await getOnlineTargetUuid(sdk, params.applicationOrDevice);
+		let version: string | undefined;
+		let id: number | undefined;
+
+		const device = await sdk.models.device.get(uuid, {
+			$select: ['id', 'supervisor_version', 'is_online'],
+		});
+		id = device.id;
+		version = device.supervisor_version;
+
+		const [whichProxytunnel, username, proxyUrl] = await Promise.all([
+			useProxy ? which('proxytunnel', false) : undefined,
+			sdk.auth.whoami(),
+			// note that `proxyUrl` refers to the balenaCloud "resin-proxy"
+			// service, currently "balena-devices.com", rather than some
+			// local proxy server URL
+			sdk.settings.get('proxyUrl'),
+		]);
+
+		const getSshProxyCommand = () => {
+			if (!proxyConfig) {
+				return;
+			}
+			if (!whichProxytunnel) {
+				console.warn(stripIndent`
+					Proxy is enabled but the \`proxytunnel\` binary cannot be found.
+					Please install it if you want to route the \`balena ssh\` requests through the proxy.
+					Alternatively you can pass \`--noproxy\` param to the \`balena ssh\` command to ignore the proxy config
+					for the \`ssh\` requests.
+
+					Attempting the unproxied request for now.`);
+				return;
+			}
+
+			const p = proxyConfig;
+			if (p.username && p.password) {
+				// proxytunnel understands these variables for proxy authentication.
+				// Setting the variables instead of command-line options avoids the
+				// need for shell-specific escaping of special characters like '$'.
+				process.env.PROXYUSER = p.username;
+				process.env.PROXYPASS = p.password;
+			}
+
+			return [
+				'proxytunnel',
+				`--proxy=${p.host}:${p.port}`,
+				// ssh replaces these %h:%p variables in the ProxyCommand option
+				// https://linux.die.net/man/5/ssh_config
+				'--dest=%h:%p',
+				...(options.verbose ? ['--verbose'] : []),
+			];
+		};
+
+		const proxyCommand = useProxy ? getSshProxyCommand() : undefined;
+
+		if (username == null) {
+			const { ExpectedError } = await import('../errors');
+			throw new ExpectedError(
+				`Opening an SSH connection to a remote device requires you to be logged in.`,
+			);
+		}
+
+		// At this point, we have a long uuid with a device
+		// that we know exists and is accessible
+		let containerId: string | undefined;
+		if (params.serviceName != null) {
+			containerId = await this.getContainerId(
+				sdk,
+				uuid,
+				params.serviceName,
+				{
+					port: options.port,
+					proxyCommand,
+					proxyUrl: proxyUrl || '',
+					username: username!,
+				},
+				version,
+				id,
+			);
+		}
+
+		let accessCommand: string;
+		if (containerId != null) {
+			accessCommand = `enter ${uuid} ${containerId}`;
+		} else {
+			accessCommand = `host ${uuid}`;
+		}
+
+		const command = this.generateVpnSshCommand({
+			uuid,
+			command: accessCommand,
+			verbose: options.verbose,
+			port: options.port,
+			proxyCommand,
+			proxyUrl: proxyUrl || '',
+			username: username!,
+		});
+
+		const { spawnSshAndThrowOnError } = await import('../utils/ssh');
+		return spawnSshAndThrowOnError(command);
+	}
+
+	async getContainerId(
+		sdk: BalenaSdk.BalenaSDK,
+		uuid: string,
+		serviceName: string,
+		sshOpts: {
+			port?: number;
+			proxyCommand?: string[];
+			proxyUrl: string;
+			username: string;
+		},
+		version?: string,
+		id?: number,
+	): Promise<string> {
+		const semver = await import('balena-semver');
+
+		if (version == null || id == null) {
+			const device = await sdk.models.device.get(uuid, {
+				$select: ['id', 'supervisor_version'],
+			});
+			version = device.supervisor_version;
+			id = device.id;
+		}
+
+		let containerId: string | undefined;
+		if (semver.gte(version, '8.6.0')) {
+			const apiUrl = await sdk.settings.get('apiUrl');
+			// TODO: Move this into the SDKs device model
+			const request = await sdk.request.send({
+				method: 'POST',
+				url: '/supervisor/v2/containerId',
+				baseUrl: apiUrl,
+				body: {
+					method: 'GET',
+					deviceId: id,
+				},
+			});
+			if (request.status !== 200) {
+				throw new Error(
+					`There was an error connecting to device ${uuid}, HTTP response code: ${request.status}.`,
+				);
+			}
+			const body = request.body;
+			if (body.status !== 'success') {
+				throw new Error(
+					`There was an error communicating with device ${uuid}.\n\tError: ${body.message}`,
+				);
+			}
+			containerId = body.services[serviceName];
+		} else {
+			console.error(stripIndent`
+			Using legacy method to detect container ID. This will be slow.
+			To speed up this process, please update your device to an OS
+			which has a supervisor version of at least v8.6.0.
+		`);
+			// We need to execute a balena ps command on the device,
+			// and parse the output, looking for a specific
+			// container
+			const childProcess = await import('child_process');
+			const { escapeRegExp } = await import('lodash');
+			const { which } = await import('../utils/helpers');
+			const { deviceContainerEngineBinary } = await import(
+				'../utils/device/ssh'
+			);
+
+			const sshBinary = await which('ssh');
+			const sshArgs = this.generateVpnSshCommand({
+				uuid,
+				verbose: false,
+				port: sshOpts.port,
+				command: `host ${uuid} "${deviceContainerEngineBinary}" ps --format "{{.ID}} {{.Names}}"`,
+				proxyCommand: sshOpts.proxyCommand,
+				proxyUrl: sshOpts.proxyUrl,
+				username: sshOpts.username,
+			});
+
+			if (process.env.DEBUG) {
+				console.error(`[debug] [${sshBinary}, ${sshArgs.join(', ')}]`);
+			}
+			const subProcess = childProcess.spawn(sshBinary, sshArgs, {
+				stdio: [null, 'pipe', null],
+			});
+			const containers = await new Promise<string>((resolve, reject) => {
+				const output: string[] = [];
+				subProcess.stdout.on('data', (chunk) => output.push(chunk.toString()));
+				subProcess.on('close', (code: number) => {
+					if (code !== 0) {
+						reject(
+							new Error(
+								`Non-zero error code when looking for service container: ${code}`,
+							),
+						);
+					} else {
+						resolve(output.join(''));
+					}
+				});
+			});
+
+			const lines = containers.split('\n');
+			const regex = new RegExp(`\\/?${escapeRegExp(serviceName)}_\\d+_\\d+`);
+			for (const container of lines) {
+				const [cId, name] = container.split(' ');
+				if (regex.test(name)) {
+					containerId = cId;
+					break;
+				}
+			}
+		}
+
+		if (containerId == null) {
+			throw new Error(
+				`Could not find a service ${serviceName} on device ${uuid}.`,
+			);
+		}
+		return containerId;
+	}
+
+	generateVpnSshCommand(opts: {
+		uuid: string;
+		command: string;
+		verbose: boolean;
+		port?: number;
+		username: string;
+		proxyUrl: string;
+		proxyCommand?: string[];
+	}) {
+		return [
+			...(opts.verbose ? ['-vvv'] : []),
+			'-t',
+			...['-o', 'LogLevel=ERROR'],
+			...['-o', 'StrictHostKeyChecking=no'],
+			...['-o', 'UserKnownHostsFile=/dev/null'],
+			...(opts.proxyCommand && opts.proxyCommand.length
+				? ['-o', `ProxyCommand=${opts.proxyCommand.join(' ')}`]
+				: []),
+			...(opts.port ? ['-p', opts.port.toString()] : []),
+			`${opts.username}@ssh.${opts.proxyUrl}`,
+			opts.command,
+		];
+	}
+}

lib/actions-oclif/tag/rm.ts

@@ -0,0 +1,133 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { disambiguateReleaseParam } from '../../utils/normalization';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	application?: string;
+	device?: string;
+	release?: string;
+	help: void;
+	app?: string;
+}
+
+interface ArgsDef {
+	tagKey: string;
+}
+
+export default class TagRmCmd extends Command {
+	public static description = stripIndent`
+		Remove a tag from an application, device or release.
+
+		Remove a tag from an application, device or release.
+	`;
+
+	public static examples = [
+		'$ balena tag rm myTagKey --application MyApp',
+		'$ balena tag rm myTagKey --device 7cf02a6',
+		'$ balena tag rm myTagKey --release 1234',
+		'$ balena tag rm myTagKey --release b376b0e544e9429483b656490e5b9443b4349bd6',
+	];
+
+	public static args = [
+		{
+			name: 'tagKey',
+			description: 'the key string of the tag',
+			required: true,
+		},
+	];
+
+	public static usage = 'tag rm <tagKey>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		application: {
+			...cf.application,
+			exclusive: ['app', 'device', 'release'],
+		},
+		device: {
+			...cf.device,
+			exclusive: ['app', 'application', 'release'],
+		},
+		release: {
+			...cf.release,
+			exclusive: ['app', 'application', 'device'],
+		},
+		help: cf.help,
+		app: flags.string({
+			description: "same as '--application'",
+			exclusive: ['application', 'device', 'release'],
+		}),
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			TagRmCmd,
+		);
+
+		// Prefer options.application over options.app
+		options.application = options.application || options.app;
+		delete options.app;
+
+		const balena = getBalenaSdk();
+
+		// Check user has specified one of application/device/release
+		if (!options.application && !options.device && !options.release) {
+			throw new ExpectedError(TagRmCmd.missingResourceMessage);
+		}
+
+		if (options.application) {
+			return balena.models.application.tags.remove(
+				tryAsInteger(options.application),
+				params.tagKey,
+			);
+		}
+		if (options.device) {
+			return balena.models.device.tags.remove(
+				tryAsInteger(options.device),
+				params.tagKey,
+			);
+		}
+		if (options.release) {
+			const releaseParam = await disambiguateReleaseParam(
+				balena,
+				options.release,
+			);
+
+			return balena.models.release.tags.remove(releaseParam, params.tagKey);
+		}
+	}
+
+	protected static missingResourceMessage = stripIndent`
+					To remove a resource tag, you must provide exactly one of:
+
+					  * An application, with --application <appname>
+					  * A device, with --device <uuid>
+					  * A release, with --release <id or commit>
+
+					See the help page for examples:
+
+					  $ balena help tag rm
+	`;
+}

lib/actions-oclif/tag/set.ts

@@ -0,0 +1,156 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import { ExpectedError } from '../../errors';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { disambiguateReleaseParam } from '../../utils/normalization';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	application?: string;
+	device?: string;
+	release?: string;
+	help: void;
+	app?: string;
+}
+
+interface ArgsDef {
+	tagKey: string;
+	value?: string;
+}
+
+export default class TagSetCmd extends Command {
+	public static description = stripIndent`
+		Set a tag on an application, device or release.
+
+		Set a tag on an application, device or release.
+
+		You can optionally provide a value to be associated with the created
+		tag, as an extra argument after the tag key. If a value isn't
+		provided, a tag with an empty value is created.
+	`;
+
+	public static examples = [
+		'$ balena tag set mySimpleTag --application MyApp',
+		'$ balena tag set myCompositeTag myTagValue --application MyApp',
+		'$ balena tag set myCompositeTag myTagValue --device 7cf02a6',
+		'$ balena tag set myCompositeTag "my tag value with whitespaces" --device 7cf02a6',
+		'$ balena tag set myCompositeTag myTagValue --release 1234',
+		'$ balena tag set myCompositeTag --release 1234',
+		'$ balena tag set myCompositeTag --release b376b0e544e9429483b656490e5b9443b4349bd6',
+	];
+
+	public static args = [
+		{
+			name: 'tagKey',
+			description: 'the key string of the tag',
+			required: true,
+		},
+		{
+			name: 'value',
+			description: 'the optional value associated with the tag',
+			required: false,
+		},
+	];
+
+	public static usage = 'tag set <tagKey> [value]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		application: {
+			...cf.application,
+			exclusive: ['app', 'device', 'release'],
+		},
+		device: {
+			...cf.device,
+			exclusive: ['app', 'application', 'release'],
+		},
+		release: {
+			...cf.release,
+			exclusive: ['app', 'application', 'device'],
+		},
+		help: cf.help,
+		app: flags.string({
+			description: "same as '--application'",
+			exclusive: ['application', 'device', 'release'],
+		}),
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			TagSetCmd,
+		);
+
+		// Prefer options.application over options.app
+		options.application = options.application || options.app;
+		delete options.app;
+
+		const balena = getBalenaSdk();
+
+		// Check user has specified one of application/device/release
+		if (!options.application && !options.device && !options.release) {
+			throw new ExpectedError(TagSetCmd.missingResourceMessage);
+		}
+
+		if (params.value == null) {
+			params.value = '';
+		}
+
+		if (options.application) {
+			return balena.models.application.tags.set(
+				tryAsInteger(options.application),
+				params.tagKey,
+				params.value,
+			);
+		}
+		if (options.device) {
+			return balena.models.device.tags.set(
+				tryAsInteger(options.device),
+				params.tagKey,
+				params.value,
+			);
+		}
+		if (options.release) {
+			const releaseParam = await disambiguateReleaseParam(
+				balena,
+				options.release,
+			);
+
+			return balena.models.release.tags.set(
+				releaseParam,
+				params.tagKey,
+				params.value,
+			);
+		}
+	}
+
+	protected static missingResourceMessage = stripIndent`
+					To set a resource tag, you must provide exactly one of:
+
+					  * An application, with --application <appname>
+					  * A device, with --device <uuid>
+					  * A release, with --release <id or commit>
+
+					See the help page for examples:
+
+					  $ balena help tag set
+	`;
+}

lib/actions-oclif/tags.ts

@@ -0,0 +1,131 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import { ExpectedError } from '../errors';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, getVisuals, stripIndent } from '../utils/lazy';
+import { disambiguateReleaseParam } from '../utils/normalization';
+import { tryAsInteger } from '../utils/validation';
+import { isV12 } from '../utils/version';
+
+interface FlagsDef {
+	application?: string;
+	device?: string;
+	release?: string;
+	help: void;
+	app?: string;
+}
+
+export default class TagsCmd extends Command {
+	public static description = stripIndent`
+		List all tags for an application, device or release.
+
+		List all tags and their values for a particular application,
+		device or release.
+	`;
+
+	public static examples = [
+		'$ balena tags --application MyApp',
+		'$ balena tags --device 7cf02a6',
+		'$ balena tags --release 1234',
+		'$ balena tags --release b376b0e544e9429483b656490e5b9443b4349bd6',
+	];
+
+	public static usage = 'tags';
+
+	public static flags: flags.Input<FlagsDef> = {
+		application: {
+			...cf.application,
+			exclusive: ['app', 'device', 'release'],
+		},
+		device: {
+			...cf.device,
+			exclusive: ['app', 'application', 'release'],
+		},
+		release: {
+			...cf.release,
+			exclusive: ['app', 'application', 'device'],
+		},
+		help: cf.help,
+		app: flags.string({
+			description: "same as '--application'",
+			exclusive: ['application', 'device', 'release'],
+		}),
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(TagsCmd);
+
+		// Prefer options.application over options.app
+		options.application = options.application || options.app;
+		delete options.app;
+
+		const balena = getBalenaSdk();
+
+		// Check user has specified one of application/device/release
+		if (!options.application && !options.device && !options.release) {
+			throw new ExpectedError(this.missingResourceMessage);
+		}
+
+		let tags;
+
+		if (options.application) {
+			tags = await balena.models.application.tags.getAllByApplication(
+				tryAsInteger(options.application),
+			);
+		}
+		if (options.device) {
+			tags = await balena.models.device.tags.getAllByDevice(
+				tryAsInteger(options.device),
+			);
+		}
+		if (options.release) {
+			const releaseParam = await disambiguateReleaseParam(
+				balena,
+				options.release,
+			);
+
+			tags = await balena.models.release.tags.getAllByRelease(releaseParam);
+		}
+
+		if (!tags || tags.length === 0) {
+			throw new ExpectedError('No tags found');
+		}
+
+		console.log(
+			isV12()
+				? getVisuals().table.horizontal(tags, ['tag_key', 'value'])
+				: getVisuals().table.horizontal(tags, ['id', 'tag_key', 'value']),
+		);
+	}
+
+	protected missingResourceMessage = stripIndent`
+					To list tags for a resource, you must provide exactly one of:
+
+					  * An application, with --application <appname>
+					  * A device, with --device <uuid>
+					  * A release, with --release <id or commit>
+
+					See the help page for examples:
+
+					  $ balena help tags
+	`;
+}

lib/actions-oclif/tunnel.ts

@@ -0,0 +1,246 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import {
+	NoPortsDefinedError,
+	InvalidPortMappingError,
+	ExpectedError,
+} from '../errors';
+import * as cf from '../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
+import { getOnlineTargetUuid } from '../utils/patterns';
+import * as _ from 'lodash';
+import { tunnelConnectionToDevice } from '../utils/tunnel';
+import { createServer, Server, Socket } from 'net';
+import { tryAsInteger } from '../utils/validation';
+import { IArg } from '@oclif/parser/lib/args';
+
+interface FlagsDef {
+	port: string[];
+	help: void;
+}
+
+interface ArgsDef {
+	deviceOrApplication: string;
+}
+
+export default class TunnelCmd extends Command {
+	public static description = stripIndent`
+		Tunnel local ports to your balenaOS device.
+
+		Use this command to open local ports which tunnel to listening ports on your balenaOS device.
+
+		For example, you could open port 8080 on your local machine to connect to your managed balenaOS
+		device running a web server listening on port 3000.
+
+		Port mappings are specified in the format: <remotePort>[:[localIP:]localPort]
+		localIP defaults to 'localhost', and localPort defaults to the specified remotePort value.
+
+		You can tunnel multiple ports at any given time.
+
+		Note: Port mappings must come after the deviceOrApplication parameter, as per examples.
+	`;
+
+	public static examples = [
+		'# map remote port 22222 to localhost:22222',
+		'$ balena tunnel myApp -p 22222',
+		'',
+		'# map remote port 22222 to localhost:222',
+		'$ balena tunnel 2ead211 -p 22222:222',
+		'',
+		'# map remote port 22222 to any address on your host machine, port 22222',
+		'$ balena tunnel 1546690 -p 22222:0.0.0.0',
+		'',
+		'# map remote port 22222 to any address on your host machine, port 222',
+		'$ balena tunnel myApp -p 22222:0.0.0.0:222',
+		'',
+		'# multiple port tunnels can be specified at any one time',
+		'$ balena tunnel myApp -p 8080:3000 -p 8081:9000',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'deviceOrApplication',
+			description: 'device uuid or application name/id',
+			parse: (x) => tryAsInteger(x),
+			required: true,
+		},
+	];
+
+	public static usage = 'tunnel <deviceOrApplication>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		port: flags.string({
+			description:
+				'port mapping in the format <remotePort>[:[localIP:]localPort]',
+			char: 'p',
+			multiple: true,
+		}),
+		help: cf.help,
+	};
+
+	public static primary = true;
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			TunnelCmd,
+		);
+
+		const Logger = await import('../utils/logger');
+		const logger = Logger.getLogger();
+		const sdk = getBalenaSdk();
+
+		const logConnection = (
+			fromHost: string,
+			fromPort: number,
+			localAddress: string,
+			localPort: number,
+			deviceAddress: string,
+			devicePort: number,
+			err?: Error,
+		) => {
+			const logMessage = `${fromHost}:${fromPort} => ${localAddress}:${localPort} ===> ${deviceAddress}:${devicePort}`;
+
+			if (err) {
+				logger.logError(`${logMessage} :: ${err.message}`);
+			} else {
+				logger.logLogs(logMessage);
+			}
+		};
+
+		if (options.port === undefined) {
+			throw new NoPortsDefinedError();
+		}
+
+		const uuid = await getOnlineTargetUuid(sdk, params.deviceOrApplication);
+		const device = await sdk.models.device.get(uuid);
+
+		logger.logInfo(`Opening a tunnel to ${device.uuid}...`);
+
+		const localListeners = _.chain(options.port)
+			.map((mapping) => {
+				return this.parsePortMapping(mapping);
+			})
+			.map(async ({ localPort, localAddress, remotePort }) => {
+				try {
+					const handler = await tunnelConnectionToDevice(
+						device.uuid,
+						remotePort,
+						sdk,
+					);
+
+					const server = createServer(async (client: Socket) => {
+						try {
+							await handler(client);
+							logConnection(
+								client.remoteAddress || '',
+								client.remotePort || 0,
+								client.localAddress,
+								client.localPort,
+								device.vpn_address || '',
+								remotePort,
+							);
+						} catch (err) {
+							logConnection(
+								client.remoteAddress || '',
+								client.remotePort || 0,
+								client.localAddress,
+								client.localPort,
+								device.vpn_address || '',
+								remotePort,
+								err,
+							);
+						}
+					});
+
+					await new Promise<Server>((resolve, reject) => {
+						server.on('error', reject);
+						server.listen(localPort, localAddress, () => {
+							resolve(server);
+						});
+					});
+
+					logger.logInfo(
+						` - tunnelling ${localAddress}:${localPort} to ${device.uuid}:${remotePort}`,
+					);
+
+					return true;
+				} catch (err) {
+					logger.logWarn(
+						` - not tunnelling ${localAddress}:${localPort} to ${
+							device.uuid
+						}:${remotePort}, failed ${JSON.stringify(err.message)}`,
+					);
+
+					return false;
+				}
+			})
+			.value();
+
+		const results = await Promise.all(localListeners);
+		if (!results.includes(true)) {
+			throw new ExpectedError('No ports are valid for tunnelling');
+		}
+
+		logger.logInfo('Waiting for connections...');
+	}
+
+	/**
+	 * Parse a port mapping specification string in the format:
+	 *  <remotePort>[:[localIP:]localPort]
+	 * @param portMapping
+	 */
+	parsePortMapping(portMapping: string) {
+		const mappingElements = portMapping.split(':');
+
+		let localAddress = 'localhost';
+
+		// First element is always remotePort
+		const remotePort = parseInt(mappingElements[0], undefined);
+		let localPort = remotePort;
+
+		if (mappingElements.length === 2) {
+			// [1] could be localAddress or localPort
+			if (/^\d+$/.test(mappingElements[1])) {
+				localPort = parseInt(mappingElements[1], undefined);
+			} else {
+				localAddress = mappingElements[1];
+			}
+		} else if (mappingElements.length === 3) {
+			// [1] is localAddress, [2] is localPort
+			localAddress = mappingElements[1];
+			localPort = parseInt(mappingElements[2], undefined);
+		} else if (mappingElements.length > 3) {
+			throw new InvalidPortMappingError(portMapping);
+		}
+
+		// Validate results
+		if (!this.isValidPort(remotePort) || !this.isValidPort(localPort)) {
+			throw new InvalidPortMappingError(portMapping);
+		}
+
+		return { remotePort, localAddress, localPort };
+	}
+
+	isValidPort(port: number) {
+		const MAX_PORT_VALUE = Math.pow(2, 16) - 1;
+		return port > 0 && port <= MAX_PORT_VALUE;
+	}
+}

lib/actions-oclif/util/available-drives.ts

@@ -0,0 +1,75 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { stripIndent, getChalk, getVisuals } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+export default class UtilAvailableDrivesCmd extends Command {
+	public static description = stripIndent`
+		List available drives.
+
+		List available drives which are usable for writing an OS image to.
+		Does not list system drives.
+	`;
+
+	public static usage = 'util available-drives';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public async run() {
+		this.parse<FlagsDef, {}>(UtilAvailableDrivesCmd);
+
+		const sdk = await import('etcher-sdk');
+
+		const adapter = new sdk.scanner.adapters.BlockDeviceAdapter(() => false);
+		const scanner = new sdk.scanner.Scanner([adapter]);
+		await scanner.start();
+
+		function prepareDriveInfo(drive: any) {
+			const size = drive.size / 1000000000;
+			return {
+				device: drive.device,
+				size: `${size.toFixed(1)} GB`,
+				description: drive.description,
+			};
+		}
+
+		if (scanner.drives.size === 0) {
+			console.error(
+				`${getChalk().red(
+					'x',
+				)} No available drives were detected, plug one in!`,
+			);
+		} else {
+			console.log(
+				getVisuals().table.horizontal(
+					Array.from(scanner.drives).map(prepareDriveInfo),
+					['device', 'size', 'description'],
+				),
+			);
+		}
+		scanner.stop();
+	}
+}

lib/actions-oclif/version.ts

@@ -0,0 +1,89 @@
+/**
+ * @license
+ * Copyright 2019 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../command';
+import { stripIndent } from '../utils/lazy';
+
+interface FlagsDef {
+	all?: boolean;
+	json?: boolean;
+	help: void;
+}
+
+export interface JsonVersions {
+	'balena-cli': string;
+	'Node.js': string;
+}
+
+export default class VersionCmd extends Command {
+	public static description = stripIndent`
+		Display version information for the balena CLI and/or Node.js.
+
+		Display version information for the balena CLI and/or Node.js.
+
+		The --json option is recommended when scripting the output of this command,
+		because the JSON format is less likely to change and it better represents
+		data types like lists and empty strings. The 'jq' utility may be helpful
+		in shell scripts (https://stedolan.github.io/jq/manual/).
+`;
+	public static examples = [
+		'$ balena version',
+		'$ balena version -a',
+		'$ balena version -j',
+	];
+
+	public static usage = 'version';
+
+	public static flags: flags.Input<FlagsDef> = {
+		all: flags.boolean({
+			char: 'a',
+			default: false,
+			description:
+				'include version information for additional components (Node.js)',
+		}),
+		json: flags.boolean({
+			char: 'j',
+			default: false,
+			description:
+				'output version information in JSON format for programmatic use',
+		}),
+		help: flags.help({ char: 'h' }),
+	};
+
+	public async run() {
+		const { flags: options } = this.parse<FlagsDef, {}>(VersionCmd);
+		const versions: JsonVersions = {
+			'balena-cli': (await import('../../package.json')).version,
+			'Node.js':
+				process.version && process.version.startsWith('v')
+					? process.version.slice(1)
+					: process.version,
+		};
+		if (options.json) {
+			console.log(JSON.stringify(versions, null, 4));
+		} else {
+			if (options.all) {
+				console.log(`balena-cli version "${versions['balena-cli']}"`);
+				console.log(`Node.js version "${versions['Node.js']}"`);
+			} else {
+				// backwards compatibility
+				console.log(versions['balena-cli']);
+			}
+		}
+	}
+}