feat(metrics,logs): bug & auth fixes

[blue4209211]

Nubi's workspace runs nbctl against a proxy in llm-server, authenticated with the per-command workspace token, to fetch raw metrics and logs into files (nudgebee/nudgebee-enterprise#40463, proxy: nudgebee/nudgebee-enterprise#40619).

Changes

Config

• IsConfigured no longer requires username (unused for auth since fix(auth)!: send API token directly as Bearer, drop /api/auth/token exchange #119).
• A non-empty NUDGEBEE_* env var now wins over a profile in ~/.nudgebee/config.yaml. Before, the profile overrode env.

Metrics / logs commands

• metrics list-metrics calls metrics_list_names. metrics_list is the series query action and returned nothing without queries.
• -o json for metrics query / logs query prints the backend results / logs unchanged, with no JSON-in-strings, even when they don't fit nbctl's types.
• metrics query --step <duration> is sent as step_interval seconds. The request is now one $request: FetchMetricsRequest! variable.
• Empty results are explained on stderr, e.g. No values found for log label "severity" ... (it may be a field inside log lines rather than an indexed label). Stdout stays empty (text) or [] (JSON). Behavior change: "No logs found." / "No Data" moved from stdout to stderr.
• logs query warns on stderr when it returns exactly --limit lines, and gives the --offset for the next page.

Client

• Authorization, cookies and X-Api-Key are written as [REDACTED] in the verbose log (nbctl_graphql.log).
• Request timeout: --http-timeout / NUDGEBEE_HTTP_TIMEOUT (default 30s; 0 disables).

Embedding

• NUDGEBEE_ENABLED_COMMANDS=metrics,logs removes other top-level commands. This is a convenience, not access control; the proxy enforces access.
• The GraphQL documents of the seven metrics/logs commands are exported constants. cmd/workspace_contract_test.go pins their exact text and variables and lists the request fields the proxy allows.

Known limitation (backend, not nbctl)

--step is sent but ignored on the agent path. api-server sends action_params.steps and relay-server only checks step, so relay-server fills step from the window and the agent uses that. The fix belongs in nudgebee-enterprise (api-server prometheusActionParams should also set step).

Testing

• make build passes (lint, go test -race ./..., build).
• Unit tests cover:
  • the request contract for the 7 commands;
  • raw JSON pass-through, including shapes that don't fit nbctl's types;
  • --step;
  • empty-result notes in text and JSON;
  • the limit warning;
  • header redaction;
  • timeout parsing;
  • the command allowlist;
  • env-over-profile, including an empty env var.
• Live on dev:
  • every metrics/logs command;
  • logs query paging;
  • instant, chart and failed queries;
  • an env-only run with an empty HOME, the allowlist, a 50s timeout and verbose on: the token appears neither in the log nor as an Authorization line;
  • 401 and timeout errors.
• Nubi end-to-end: 17 conversations against dev through the llm-server proxy.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces several enhancements to nbctl, including support for limiting available commands via NUDGEBEE_ENABLED_COMMANDS, custom HTTP timeouts, and credential redaction in verbose logs. It also refactors GraphQL queries into shared constants, updates configuration validation to make the username optional, and adds a comprehensive contract test suite. Feedback on the changes highlights a bug in restrictCommands where modifying the commands slice during iteration causes elements to be skipped, and suggests optimizing string(raw) == "null" checks in logs and metrics queries by checking the slice length first to avoid unnecessary memory allocations.