[pan93412]

Summary

Adds zeabur api graphql, a raw GraphQL escape hatch modeled after gh api graphql. It sends any query to the Zeabur API with the logged-in user's existing credentials and prints the raw JSON response, so scripts and coding agents can read fields that no dedicated command exposes yet (e.g. Server.expiresAt, Server.isAutoRenewDisabled, SubscriptionStatus.nextBillingAt, AI Hub auto-recharge settings) without ever handling the token.

zeabur api graphql -f query='query { me { _id username } }'
zeabur api graphql -f query='query($id: ObjectID!) { project(_id: $id) { name } }' -F id=<project-id>
zeabur api graphql -F query=@query.graphql -F limit=10
echo '{"query": "query { me { _id } }"}' | zeabur api graphql --input -

Behavior

• -f/--raw-field key=value adds a string field; -F/--field key=value adds a typed field (true / false / null / integers, @file or @- to read the value). query and operationName are top-level request keys; every other field becomes a GraphQL variable.
• --input file|- reads a complete JSON request body; -f/-F fields are merged on top of it. Standard input can only be consumed once.
• The response body is printed verbatim. The command exits non-zero on non-2xx HTTP responses or when the response contains errors, and still prints the body so callers can inspect the details.
• Uses the normal auth flow (zeabur auth login / ZEABUR_TOKEN) and works with --json (which only silences logs here). The token is never printed or logged, including with --debug.
• --workspace and the saved context do not rewrite the request; team/project IDs must be passed explicitly as variables (documented in the help text and README).

Implementation

• pkg/api: new RawAPI.GraphQLRaw on the client. New now keeps the authenticated *http.Client so the raw request reuses the same OAuth2 transport and endpoint as the typed GraphQL client.
• internal/cmd/api + internal/cmd/api/graphql: new command package, registered in the root command.
• Unit tests (internal/cmd/api/graphql/graphql_test.go) cover field typing, @file, --input - merging, GraphQL/HTTP error exit codes, and invalid input.
• README section documenting the command.

Testing

• go build ./..., go vet ./..., go test ./..., golangci-lint run on the changed packages, gofumpt -l on new files.
• Read-only end-to-end against production with a real token: query { me { _id } } (exit 0), a query with variables, --json --input - from stdin, an invalid field (prints the 422 error body, exit 1), schema introspection confirming Server.expiresAt, Server.isAutoRenewDisabled and SubscriptionStatus.nextBillingAt are reachable, and --debug output contains no auth header or token. No mutations were executed.

Open question

Mutations are allowed, just like gh api graphql. If maintainers would prefer a confirmation prompt or a --allow-mutation guard for agent use, happy to add it.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-22T04:49:38.994179Z	2fa7340	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d4c303452

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1999f2a1be

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[pan93412]

@opencodezebra review

[canyugs]

LGTM. Logic is sound: single = cut keeps values with = intact, stdin is guarded against double reads, the body is printed even on error, and the three Codex findings (UseNumber, null input, big integers) are fixed with tests. CI is green.

Non-blocking: for agent use I would lean toward a --allow-mutation guard or at least a help-text note, but that can be a follow-up.